← University
Risk Governance: The Board's Risk Oversight Role
0 of 6

A regional credit union operating across 4 branches in central Alberta has served its membership for over 35 years, offering personal banking, agricultural lending, and small business financing to approximately 28,000 members. The board of directors consists of 9 elected members drawn from the membership, most of whom bring professional backgrounds in agriculture, accounting, or local business ownership but none of whom possess formal expertise in information technology, cybersecurity, or environmental regulation.

Over the past 18 months, the credit union has undertaken a significant digital transformation initiative, migrating its core banking platform to a cloud-based system and launching a mobile application that now handles approximately 40 percent of routine member transactions. The board approved the $2.3 million capital expenditure for this project based on management presentations emphasizing operational efficiency and competitive necessity, but the directors received limited information about the cybersecurity implications of the new architecture or the credit union's incident response capabilities. A recent internal audit identified 3 areas of concern regarding data protection protocols, though the board has not yet received a formal briefing on the findings.

Simultaneously, the credit union's agricultural lending portfolio faces emerging pressures related to climate variability. Drought conditions over the past 2 growing seasons have increased delinquency rates among farm borrowers, and several of the credit union's largest commercial real estate loans involve properties in flood-prone areas that have experienced 2 significant water events in the past 5 years. The board has discussed these exposures informally but has never articulated a formal risk appetite statement or established quantitative thresholds for concentration risk in climate-vulnerable sectors.

The credit union does not maintain a dedicated risk committee. Risk oversight has historically been folded into the audit committee's mandate, though that committee's terms of reference focus primarily on financial reporting and regulatory compliance. The chief executive officer has proposed creating a separate risk committee, but several directors have questioned whether the administrative burden would be justified for an organization of this size. The board chair has asked management to prepare materials for a governance retreat where the directors will consider how to structure their oversight responsibilities going forward.

Complicating the timing, a neighbouring credit union recently experienced a ransomware attack that disrupted member services for 11 days and generated significant media coverage. The provincial regulator has signalled increased scrutiny of technology governance across the sector, and the board anticipates questions about its own preparedness during the next supervisory examination.

Climate and ESG Risk Governance: The Evolving Canadian Expectation

Climate and environmental, social, and governance risk has moved from the margins of board discussion to the centre of fiduciary responsibility in Canada. What boards once treated as a matter of corporate reputation or voluntary disclosure has become embedded in legal expectation, regulatory requirement, and stakeholder demand. Directors who serve on the boards of corporations, non-profits, charities, co-operatives, and public bodies across the country now confront a governance landscape where failing to understand and oversee climate-related and broader sustainability risks can expose the organization to financial loss, regulatory sanction, and reputational damage. Understanding this evolving Canadian expectation is no longer optional for competent board service.

The foundation of climate and environmental, social, and governance risk governance rests on the same fiduciary principles that govern all board oversight. Directors owe duties of care and loyalty to the organizations they serve. Under the Canada Business Corporations Act, as of the date of authorship, directors must act honestly and in good faith with a view to the best interests of the corporation, and they must exercise the care, diligence, and skill that a reasonably prudent person would exercise in comparable circumstances. The Canada Not-for-profit Corporations Act imposes substantially similar duties on directors of federal non-profit corporations. Provincial business corporations legislation across British Columbia, Alberta, Saskatchewan, and Ontario contains parallel formulations, though the precise statutory language varies. Quebec's Civil Code of Quebec establishes duties for directors of corporations and non-profit legal persons through its distinct civil law framework, requiring administrators to act with prudence and diligence in the interest of the legal person. Regardless of jurisdiction, the common thread is that directors must bring reasonable care to their oversight responsibilities, and that care must respond to the material risks facing the organization.

Climate risk and the broader category of environmental, social, and governance risk have become material to a widening range of Canadian organizations. For corporations whose operations involve emissions, resource extraction, transportation, or manufacturing, the physical risks of climate change and the transition risks associated with decarbonization policy are now quantifiable and significant. For non-profits and charities, climate events can disrupt service delivery, damage facilities, and strain operating budgets. Professional associations must consider how climate policy affects the industries their members serve. Credit unions and co-operatives with real estate holdings or agricultural lending portfolios face direct exposure to weather volatility and shifting land values. Public bodies charged with infrastructure oversight must account for the long-term resilience of assets against rising temperatures, flooding, and extreme weather. Across all these organizational types, the social and governance dimensions of sustainability risk are equally pressing. Workforce expectations around equity and inclusion, community relationships, supply chain ethics, and board diversity all fall within the scope of responsible governance. Directors who neglect these considerations are not exercising the care and diligence that contemporary standards demand.

Canadian regulatory expectations have crystallized around climate disclosure in particular. The Canadian Securities Administrators have advanced requirements for climate-related disclosure among reporting issuers, drawing heavily on the framework developed by the Task Force on Climate-related Financial Disclosures. While these securities law requirements apply most directly to publicly traded companies, their influence extends further. Lenders, insurers, and major customers increasingly require climate disclosure from private companies, non-profits with significant operations, and organizations seeking government contracts. The Office of the Superintendent of Financial Institutions has issued guidance on climate risk management for federally regulated financial institutions, and this guidance shapes expectations for credit unions and co-operatives that operate in similar risk environments. Even organizations outside the formal reach of these regulatory frameworks find that funders, donors, and partners expect some form of climate and sustainability reporting. The practical effect is that boards across the Canadian organizational landscape must treat climate and environmental, social, and governance risk as a standing item on the governance agenda.

The governance challenge lies in integrating these considerations into the board's existing risk oversight responsibilities rather than treating them as a separate silo. Climate risk is not a standalone matter to be delegated to a sustainability committee and forgotten. It intersects with strategic planning, capital allocation, human resources, legal compliance, and reputation management. Directors must understand how climate and environmental, social, and governance factors affect the organization's risk profile and must ensure that management has the information, processes, and resources to identify, assess, and manage these risks. This requires boards to ask probing questions about the organization's exposure to physical climate hazards, the financial implications of carbon pricing and emissions regulation, the resilience of supply chains to climate disruption, and the expectations of stakeholders regarding sustainability performance. It also requires boards to consider how the organization's own activities contribute to or mitigate climate change and broader social concerns, recognizing that stakeholders increasingly expect organizations to account for their impact as well as their exposure.

The legal framework supports this integrated approach. While Canadian corporate and non-profit legislation does not typically mandate specific climate or sustainability oversight structures, the general duties of care and loyalty require directors to address material risks. Courts and regulators interpreting these duties look to evolving standards of reasonable practice. What a prudent director would do in 2026 differs from what might have sufficed a decade ago. The incorporation of climate risk into mainstream risk management frameworks, the proliferation of disclosure standards, and the emergence of fiduciary guidance from bodies like the Canadian Coalition for Good Governance all contribute to a rising baseline of expected competence. Directors who remain ignorant of climate and environmental, social, and governance risk, or who fail to ensure that management is addressing these matters, may find themselves exposed to liability claims or regulatory criticism.

Quebec's civil law framework introduces some distinctive considerations. Under the Civil Code of Quebec, the duties of administrators are articulated in terms of prudence, diligence, honesty, and loyalty, and administrators must act within the limits of the powers conferred on them. The civil law tradition emphasizes the administrator's obligation to inform themselves and to take reasonable steps to protect the patrimony of the legal person. While the conceptual vocabulary differs from common law jurisdictions, the practical implications for climate and environmental, social, and governance risk governance are similar. Administrators of Quebec corporations and non-profits must ensure that they understand the risks facing the organization and that appropriate measures are in place to manage those risks. The evolving recognition of climate risk as a material governance concern applies equally in Quebec, and administrators who fail to engage with these issues may face scrutiny under the general standards of administrative conduct.

The practical operation of climate and environmental, social, and governance risk governance varies depending on organizational size, sector, and complexity. A large public company with significant emissions will have dedicated sustainability teams, formal disclosure processes, and board committees with explicit oversight mandates. A regional charity with limited staff may address these matters more informally, relying on the executive director to flag relevant risks and the board to ensure that basic resilience planning is in place. The underlying governance obligation, however, is consistent. Directors must exercise reasonable oversight, ask appropriate questions, and ensure that management is giving adequate attention to material risks. The nature and depth of that oversight should be proportionate to the organization's risk profile and resources.

Consider the situation facing a regional health foundation based in Kelowna, British Columbia. The foundation holds a substantial investment portfolio and owns several properties that house community health programs. For years, the board focused its risk discussions on investment performance, fundraising targets, and program delivery. Climate risk rarely appeared on the agenda. In the summer of 2025, a severe wildfire season forced the evacuation of one of the foundation's properties for three weeks, disrupted programming, and caused $1.2 million in smoke and water damage. The foundation's insurance covered most of the direct costs, but the policy renewal that followed brought a forty percent premium increase and new exclusions for wildfire-related damage. At the same time, the foundation's investment manager began reporting on the carbon intensity of the portfolio and flagging transition risk exposure in several holdings. A major donor inquired about the foundation's approach to climate resilience and indicated that future gifts would depend on a credible sustainability commitment. The board, which had not previously discussed these matters in any structured way, suddenly faced urgent questions about property risk, investment policy, insurance adequacy, and stakeholder communication.

The implications of this scenario illustrate the cost of reactive governance. Had the board engaged with climate risk earlier, it might have commissioned a physical risk assessment of its properties, reviewed insurance coverage for adequacy and exclusions, considered whether its investment policy addressed climate-related financial risk, and developed a basic position on sustainability for stakeholder communication. These steps would not have prevented the wildfire, but they would have positioned the organization to respond more effectively and to demonstrate to funders and insurers that it was managing risk responsibly. The board's failure to anticipate these issues left it scrambling to catch up, negotiating insurance renewals from a position of weakness, and responding to donor concerns without an established framework. Directors who had assumed that climate risk was someone else's problem discovered that it was very much their own.

The scenario also reveals the interconnection of climate risk with other governance responsibilities. The property damage raised questions about asset management and capital planning. The insurance renewal implicated risk transfer strategy and financial sustainability. The investment portfolio discussion engaged the board's fiduciary duty to manage charitable assets prudently. The donor inquiry touched on stakeholder relations and organizational reputation. None of these matters could be neatly separated from the others, and addressing them required the board to take a holistic view of how climate risk affected the foundation's operations, finances, and relationships. Directors who had previously thought of climate as an environmental issue external to their core responsibilities came to understand it as a governance issue woven through every aspect of the organization's work.

For boards seeking to apply these lessons, several practical steps offer a starting point. Directors should ensure that climate and environmental, social, and governance risk appears explicitly on the board's risk register or equivalent oversight framework. This does not require elaborate analysis in every case, but it does require acknowledgment that these risks exist and some assessment of their relevance to the organization. Boards should ask management to report on the organization's exposure to physical climate hazards, transition risks from regulatory or market changes, and social and governance factors that could affect operations or reputation. The depth of this reporting will vary with organizational capacity, but even a brief annual summary is better than silence.

Boards should review the organization's insurance coverage with climate risk in mind, paying attention to policy exclusions, coverage limits, and premium trends. Directors should understand whether the organization's capital planning and asset management take account of long-term climate scenarios. For organizations with investment portfolios, the board should inquire whether the investment policy addresses climate-related financial risk and whether the investment manager provides relevant reporting. Boards should consider whether the organization's strategic plan reflects climate and sustainability considerations and whether management has the capacity to implement any commitments the organization makes. Directors should document their discussions of climate and environmental, social, and governance risk in board minutes, creating a record that demonstrates diligent oversight.

Boards should also consider their own composition and competence. Climate and sustainability expertise is increasingly valuable at the board table, and nominating committees should assess whether the board has adequate knowledge to oversee these issues. Where expertise is lacking, boards may seek external advice or arrange for director education on climate risk governance. The goal is not to make every director a climate scientist but to ensure that the board collectively has sufficient understanding to ask the right questions and evaluate management's responses. Directors should be wary of treating climate and environmental, social, and governance matters as a compliance checkbox rather than a genuine governance responsibility. The organizations that navigate this landscape most effectively are those whose boards engage substantively with the underlying risks and opportunities rather than merely satisfying disclosure requirements.

The evolving Canadian expectation around climate and environmental, social, and governance risk governance reflects a broader shift in how society understands organizational responsibility. Boards are increasingly expected to account not only for financial performance but also for environmental impact, social contribution, and governance integrity. This expectation is reinforced by regulatory developments, stakeholder demands, and the practical reality that climate change and sustainability challenges pose material risks to organizational success. Directors who embrace this reality and integrate climate and environmental, social, and governance considerations into their oversight practice are better positioned to protect the organizations they serve and to fulfil their fiduciary obligations. Those who resist or ignore these developments may find themselves explaining to regulators, funders, or courts why they failed to address risks that prudent directors would have seen coming.

The Canadian governance landscape in 2026 demands that directors take climate and environmental, social, and governance risk seriously. This is not a matter of ideology or preference but of diligence and care. The legal duties that have always required directors to understand and oversee material risks now encompass the climate and sustainability challenges that define this era. Boards that rise to this challenge will serve their organizations and communities well. Those that do not will bear the consequences of governance failure in a world where the stakes have never been higher.

Continue with University access

This lesson is part of a $149 course. Purchase the course or sign in with an active membership to keep reading.

See purchase options