ESG risk assessment framework: watchlist, engage or divest?

An ESG risk assessment framework, at an asset manager, is the written method by which a sustainability risk or an ESG incident in a holding becomes a decision: no action, a watchlist, engagement, escalation or divestment. Matrices and heat maps rate risks; they do not decide anything, and they leave nothing a supervisor can test. The framework that holds up is a decision file for each incident: the evidence, the norm, the severity, each fund's clause and deadline, the options weighed, the decision, the reason and the people who approved it. Botminds' ESG Risk Monitoring is an agentic solution that assembles that file as the work happens and leaves every decision to a person.

The figure below is one such file, from the solution's sample data: a proposal to divest a palm-oil grower after eighteen months of engagement. The company, the funds and the people are fictional; the structure is the point.

What is an ESG risk assessment framework?

It is the part of a manager's risk management that deals with sustainability risk, written down. In the EU it is not optional. Since 1 August 2022, an alternative investment fund manager's risk management policy must let it assess each fund's exposure to "market, liquidity, sustainability and counterparty risks", and senior management is "responsible for the integration of sustainability risks" (Delegated Regulation (EU) 2021/1255); UCITS management companies carry the same duties.

The principal adverse impact standards add a governance test of their own. A manager's statement must date the governing body's approval of its adverse-impact policies and say who is responsible for carrying them out (Delegated Regulation (EU) 2022/1288, Article 7(1)). A framework therefore needs an approval date, owners and a method, not just a list of risks.

What is an ESG risk assessment matrix, and why is it not enough?

A matrix scores risks by likelihood and impact and colours the result. The idea is sound, and the regulation uses it: methodologies must explain how they "take into account the probability of occurrence and the severity of those principal adverse impacts, including their potentially irremediable character" (Article 7(1)(c)). What a matrix lacks is everything after the score: who must do what, by when, for which fund, and what happens if they do not.

That gap is where supervisors look. The EU's national authorities found, among the main issues in their 2023–24 review, the "lack of properly documented policies and lack of escalation procedures in case of breach of the policies" (ESMA final report, 30 June 2025). The SEC's examiners singled out, as an effective practice, procedures that recorded the ESG factors weighed in each investment decision at the time it was made (SEC risk alert, 9 April 2021). Escalation and contemporaneous reasons are properties of decisions, not of matrices.

The ESG risk assessment process: four decisions and who makes each

A workable process has four decisions in sequence, each with an owner and a clock: put the company on a watchlist, engage, escalate, and divest. Most incidents stop at the first or second. The point of writing all four down is that a company can move along them without anyone having to reinvent the rules in the middle of a controversy.

When should a company go on an ESG watchlist?

When the evidence is serious enough to require a decision but not yet strong enough, or not yet final enough, to require a sale. In the sample, a first-instance court judgment against a nickel miner for contaminating a river made the company a potential violator: watchlist within five business days, engagement, and a committee decision within 90 days. The judgment could still be appealed, so the policy did not allow a sale, and the analyst wrote down why.

A watchlist entry is a decision with a reason, not a holding pen. It should carry watch conditions that will move the company on: in the sample, whether an appeal is filed, whether a remediation plan arrives, whether severity rises to 5, and whether an appeal court upholds the ruling. Each is checked by the agents and each, if it fires, returns the company to a person.

When is engagement the right answer?

When the company can still fix the problem and the fund has a plausible way to make it. Engagement has evidence behind it: Hoepner and co-authors found that engagement on ESG issues reduces companies' downside risk, and that the companies whose downside risk fell most also had fewer environmental incidents afterwards (Review of Finance, 2024). The asks should be specific and checkable. In the sample letter to the nickel miner's board of commissioners there were four, each cited to a page of the ruling: a remediation plan within 60 days, independent quarterly water tests, the grounds of any appeal, and a meeting with representatives of the 1,240 affected households.

Engagement asks, each cited to the ruling

Engagement needs an end date as much as a start. A framework should say how long a company has to meet its milestones, how many may be missed before escalation, and who decides. The tracking of milestones themselves belongs with stewardship, which Botminds covers in Stewardship Engagement Tracking; its guide to ESG engagement tracking and outcome KPIs shows how milestones are measured.

When should a fund divest on ESG grounds?

When the fund's own policy requires it and the evidence meets the policy's standard: typically a final finding or the most severe grade, with engagement failed or pointless. In the sample, a palm-oil grower has stood at severity 5 since March 2025, with forced-labour indicators at its estates and a US import detention order. Of four engagement milestones agreed in April 2025, one was met; an independent labour audit was never published, recruitment fees were only 31% repaid, and in October workers said their passports were still held. The analyst proposed divestment.

Then the exit is mechanical, and should be. Two votes from different committee members; the proposer cannot vote. Compliance codes the restriction in the order management system within one business day. Portfolio managers sell $54.7 million across four funds to zero within 30 business days; the agents' liquidity estimate is 4.2 trading days at 20% of average volume. Every step is on the audit trail, and the evidence file is sealed when the position is gone.

The divestment file as the second voter sees it

Can a company come off the list?

It should be able to, and the framework should say how. Public enforcement shows the path. In 2020, U.S. Customs and Border Protection ordered the detention of palm oil from FGV Holdings Berhad after "a year-long investigation" found forced-labour indicators (CBP, 30 September 2020). On 15 January 2026 it modified the order, stating that "FGV has taken actions to identify, correct and prevent forced labor" (CBP, 15 January 2026). A fund that excluded the company over those findings needs a written test for reinstatement, or the exclusion outlives the reason for it.

The same applies within a fund's own process. A potential violator whose judgment is overturned on appeal should leave the watchlist by a decision, with the reason, just as it entered. EU rules expect the correction of breaches "in the best interest of the investors" (ESMA guidelines on fund names, paragraph 22), and that cuts both ways.

What should the framework record, and for how long?

Everything a stranger would need to follow a decision from its source to its outcome, kept as long as the strictest rule in scope. A US adviser must keep required books and records for not less than five years (17 CFR 275.204-2); the sample configuration keeps decisions seven years and evidence files ten. EU managers will want the same file to show who held the "expertise for the effective integration of sustainability risks" on each decision.

How ESG Risk Monitoring builds the file

The agents assemble each file as the incident unfolds: the Watcher and Merge agents bring the sources, the Severity and Second Opinion agents the two scores, the Mapping agent the norm and each fund's clause with its deadline, the Action agent the proposal and the drafted letter or divestment file, the Evidence agent the trail. People make every decision in the file, and none of the agents can send a letter, vote, code a restriction or trade.

The approval step in ESG Risk Monitoring, signed and on the trail

The solution's design target is that no screened fund holds a flagged issuer past its policy window without a signed decision; in the sample's third quarter, all 9 incidents of severity 4 or 5 in screened funds had a signed decision inside their window. Those are sample figures and a target, not a customer's result. How severity is graded before any of this starts is in ESG controversy score: two scorers; the agents are on the ESG Risk Monitoring page.

Questions people ask

What are the steps of an ESG risk assessment process?

Find the incident at its source, match it to holdings, grade its severity, map it to the norm and to each fund's clause, decide the step (no action, watchlist, engagement, escalation or divestment), approve it, act on it, and record each step with its reason. The grading and matching can be automated; the decisions should stay with people.

What is an ESG escalation policy?

The part of the framework that says what happens when engagement fails or severity rises: who proposes the next step, who approves it, and by when. EU supervisors found missing escalation procedures among the main weaknesses in their 2025 review of sustainability-risk integration.

When should an asset manager divest for ESG reasons?

When the fund's own policy requires it and the evidence meets its standard, typically a final finding or the most severe grade with engagement failed. The decision should need more than one approver and never the proposer, and the sale should follow a set timetable.

Is there an ESG risk assessment template?

No regulator publishes one for asset managers. The fields on this page make a practical template: incident, norm and grade, funds and clauses, engagement so far, options weighed, votes, exit plan and trail. EU rules add an approval date and allocated responsibilities for the policies behind it.

Does divesting or engaging reduce ESG risk more?

They do different jobs. Engagement can reduce a company's risk: research published in 2024 links successful ESG engagement with lower downside risk and fewer environmental incidents. Divestment removes the fund's exposure when the company will not change or the fund's promise leaves no choice.