ESRS IRO Assessment Framework: How to Identify Impacts, Risks, and Opportunities

What the IRO assessment is and why it determines everything else

Every CSRD sustainability report starts with the same question: what is material? The answer comes from the IRO assessment. Get it wrong and you either report on topics that don’t matter (wasting everyone’s time) or miss topics that do (creating an assurance finding on day one). The double materiality assessment under ESRS 1 requires you to identify impacts, risks, and opportunities across the entity’s own operations and its value chain. Most first-year CSRD reports in 2025 showed that companies underestimated how long this process takes. They also underestimated how much documentation the assurance provider expects.

The IRO assessment is the process by which a company identifies its sustainability-related impacts, risks, and opportunities (collectively “IROs”) and determines which of them are material. “Material” in this context means: significant enough to require disclosure in the sustainability report under ESRS. Every subsequent reporting decision flows from this assessment.

If a topical standard (ESRS E1 through ESRS G1) covers a topic that the IRO assessment determines is not material, the company can omit all disclosure requirements in that standard. The exception is ESRS E1 (Climate Change): even if climate change is assessed as not material, the company must provide a detailed explanation of why, per ESRS 2 IRO-2. For every other topic, a brief explanation suffices.

The IRO assessment is not a survey. It is not a stakeholder workshop that produces a coloured matrix and nothing else. Under the ESRS, it is a structured, documented, repeatable process that the assurance provider will review. EFRAG’s implementation guidance (published May 2024) provides a non-binding illustration of how the assessment should work, but the binding requirements are in ESRS 1 chapter 3 and ESRS 2 section 4.1.

For auditors, the IRO assessment is the first thing you review on a CSRD assurance engagement. If the client’s assessment is undocumented, uses undefined criteria, or reaches conclusions that contradict observable facts, you have a scope problem before you’ve looked at a single data point.

The two materiality perspectives: impact and financial

Double materiality is the defining feature of the ESRS framework. It requires companies to assess sustainability matters from two perspectives. A topic is material if it meets the threshold under either one.

Impact materiality (ESRS 1, paragraphs 43 to 47, the “inside-out” perspective): a sustainability matter is material from an impact perspective if it is connected to actual or potential, positive or negative impacts on people or the environment. The company assesses impacts across its own operations and its upstream and downstream value chain, including impacts on stakeholders with no direct contractual relationship with the company.

For actual negative impacts, materiality is determined by the severity of the impact. ESRS 1 defines severity using four criteria: scale (how grave the impact is), scope (how widespread it is), irremediability (how difficult it is to reverse), and, for potential impacts, likelihood. For potential negative impacts, severity is combined with the probability that the impact will occur.

For positive impacts, materiality is determined by scale and scope (for actual positive impacts) with likelihood added for potential ones.

Financial materiality (ESRS 1, paragraphs 48 to 55, the “outside-in” perspective): a sustainability matter is material from a financial perspective if it triggers or could trigger material financial effects on the company. This includes effects on the company’s development, financial position, financial performance, cash flows, access to finance, or cost of capital. The assessment considers risks and opportunities arising from the company’s impacts on sustainability matters and from its dependencies on natural, human, and social resources.

Financial materiality is assessed based on likelihood and the magnitude of the potential financial effect, evaluated over short-term (one reporting year), medium-term (up to five years), and long-term (beyond five years) horizons.

The ESRS explicitly states that information is always material if its omission or concealment could reasonably be expected to influence the decisions of the users of the sustainability report (ESRS 1, paragraph 48). This is a catch-all provision that prevents purely mechanical application of the scoring criteria from excluding obviously significant matters.

How to structure the assessment process

EFRAG’s implementation guidance illustrates the assessment as a sequential process, though the ESRS do not prescribe a specific methodology. Based on the requirements in ESRS 1 and the first-year experience of Wave 1 reporters, the following structure produces documentation that satisfies the assurance provider’s expectations.

Step 1: Map the value chain. Before you can identify where IROs arise, you need a documented picture of the entity’s value chain. This includes upstream suppliers, the entity’s own operations (by location, by activity), and downstream customers and end users. ESRS 1 paragraph 63 requires the entity to include upstream and downstream value chain activities in its assessment. A company that limits its IRO assessment to its own operations will miss material topics. The value chain map does not need to be exhaustive at entity level, but it must be specific enough that you can trace each identified IRO back to a value chain stage.

Step 2: Screen all ESRS topics. The ESRS provide a defined list of sustainability topics across ten topical standards (five environmental, four social, one governance). The entity must screen every topic in this list to determine whether it is connected to any IRO in the entity’s value chain. The screening should also consider sector-specific topics, drawing on EFRAG’s sector guidance (once available) or interim sources like SASB and GRI sector standards. At this stage, no topic should be eliminated without documentation. The output is a longlist of potentially relevant IROs.

Step 3: Identify specific IROs for each relevant topic. For each topic that passes the screening, the entity identifies the specific impacts, risks, and opportunities that apply to its situation. “Climate change” is a topic. “Scope 1 GHG emissions from four production facilities totalling approximately 14,000 tCO2e” is an impact. “Physical climate risk to the Rotterdam facility from sea-level rise over a 30-year horizon” is a risk. The more specific the IRO description, the more defensible the subsequent assessment.

Step 4: Assess each IRO against materiality criteria. The scoring happens at this step. Each IRO is assessed against the impact materiality criteria (severity, likelihood) and the financial materiality criteria (likelihood, magnitude of financial effect). EFRAG does not prescribe a rating scale. The entity chooses its own (1 to 5, 1 to 4, qualitative categories). Whatever scale is used must be documented, including the definition of each level, and applied consistently across all IROs.

Step 5: Determine the materiality threshold. The entity must define a threshold above which an IRO is considered material. This threshold must be documented and justified. A common approach is to set a combined severity/likelihood score above which the IRO is deemed material for impact purposes, with a separate combined magnitude/likelihood score for financial purposes. If an IRO exceeds the threshold under either perspective, it is material.

Step 6: Document the outcome and map to ESRS disclosures. For each material IRO, the entity identifies which ESRS disclosure requirements apply. For each non-material topic, the entity prepares a brief explanation (or, for ESRS E1, a detailed explanation). The outcome feeds directly into ESRS 2 IRO-2, which requires a table mapping the ESRS covered by the sustainability statement.

This entire process must be completed before the entity begins collecting data for specific disclosures. In practice, many Wave 1 entities ran the IRO assessment in parallel with data collection, which created rework when the assessment concluded that certain topics were not material (data collected for nothing) or that additional topics were material (data collection started too late).

Scoring criteria for impacts

ESRS 1 paragraph 45 defines severity for negative impacts. ESRS 1 Application Requirement AR 11 provides further guidance. The criteria are applied to each identified impact individually.

Scale measures the gravity of the impact. How serious is the harm to people or the environment? A workplace fatality has higher scale than a minor injury. A discharge that renders a river habitat unrecoverable has higher scale than one that causes temporary degradation.

Scope measures the breadth of the impact. How many people or how large an environmental area is affected? An impact affecting one community has narrower scope than one affecting an entire watershed. An impact affecting 50 employees has narrower scope than one affecting 5,000.

Irremediability measures how difficult it is to restore the situation to its previous state. Biodiversity loss in a primary forest is highly irremediable. A data privacy breach affecting employee records is remediable (records can be secured, affected individuals notified).

Likelihood applies only to potential impacts (not actual ones). An unlikely but severe potential impact may still be material if the severity is high enough. ESRS 1 paragraph 44 states that among potential negative impacts, severity takes precedence over likelihood in determining materiality. A catastrophic but unlikely event cannot be dismissed purely because it is improbable.

The entity documents the assessment of each criterion for each IRO. The documentation should show the specific evidence used to assess each criterion (industry data, incident records, regulatory findings, stakeholder feedback), not just the final score.

Scoring criteria for risks and opportunities

Financial materiality follows a different assessment framework. ESRS 1 paragraph 50 and Application Requirement AR 15 define the criteria.

For risks, the entity assesses the likelihood that the risk materialises and the magnitude of the potential financial effect. Magnitude includes both the absolute size of the effect and its concentration (does the effect hit one revenue stream or the entire entity). The assessment covers short-term, medium-term, and long-term time horizons. A risk that is unlikely in the short term but highly likely over a 20-year horizon may still be financially material if the magnitude is large.

For opportunities, the same framework applies. Likelihood of realisation combined with magnitude of the potential financial benefit.

ESRS 1 paragraph 50 requires the entity to consider connections between its impacts and its dependencies, and then to trace how those connections generate financial risks. If a company’s operations depend on a water source that its own activities are degrading (an impact), the degradation creates a dependency risk. If regulation tightens access to that water source in response to degradation, the financial risk increases. The IRO assessment must trace these causal chains explicitly.

The entity also considers whether risks and opportunities could affect its access to finance or cost of capital. A material sustainability risk that increases the entity’s credit spread is financially material even if it has no direct effect on operating profit in the current year. Credit rating agencies now incorporate ESG risk assessments, making this a concrete consideration rather than a theoretical one.

What ESRS 2 IRO-1 requires you to disclose

ESRS 2 IRO-1 is the disclosure requirement that describes the process. It does not require the entity to publish the detailed scoring of every IRO. It requires the entity to explain how it arrived at its conclusions.

The disclosure must include a description of the methodologies and assumptions applied. It must also include an overview of the process to identify and assess potential and actual impacts on people and the environment (including the due diligence process), plus an overview of the process to identify and assess risks and opportunities with potential financial effects. These two overviews must each address how the entity has considered the connections between its impacts, dependencies, and the resulting risks and opportunities.

For impacts (ESRS 2 IRO-1 paragraph (b)), the entity must describe how it screens its operations and value chain, how it engages with affected stakeholders, and how it assesses severity. The entity must also explain how it prioritises negative impacts based on severity and likelihood. For financial risks and opportunities (ESRS 2 IRO-1 paragraph (c)), the entity must describe how it links impacts and dependencies to financial effects, how it assesses likelihood and magnitude, and what thresholds it used.

The disclosure must also explain any changes to the methodology compared to the previous reporting period. For first-year reporters, this requirement does not apply.

From the auditor’s perspective, IRO-1 is the disclosure that provides the audit trail. If the entity discloses that it “conducted workshops with internal experts” but cannot produce documentation showing which experts attended, what evidence was considered, what scores were assigned, and how the threshold was applied, the assurance provider will identify a gap. The disclosure should be specific enough that a third party can understand the process and replicate it in principle.

Worked example: IRO assessment for a manufacturing entity

Client: Dekker Precision Parts B.V., Eindhoven. Annual revenue: €65M. Employees: 280. Sector: Precision machining for automotive and medical device OEMs. Four production facilities in the Netherlands and one in Poland.

Step 1: Value chain mapped

Upstream: steel and aluminium suppliers (primarily German and Swedish), coolant and lubricant suppliers, energy providers. Own operations: five production facilities, one logistics centre. Downstream: automotive OEM assembly plants (mainly German), medical device manufacturers (German and Swiss), aftermarket distributors.

Step 2: Screening

The entity screened all ten ESRS topical standards. Topics eliminated at screening (with justification): ESRS E3 (Water and marine resources: all facilities use municipal water supply, no water-intensive processes, no discharges to water bodies), ESRS E4 (Biodiversity: all facilities on existing industrial estates, no proximity to protected areas), ESRS S3 (Affected communities: no operations in sensitive areas, no indigenous peoples affected), ESRS S4 (Consumers and end users: B2B only, products embedded in OEM products, no direct consumer exposure).

Step 3: Specific IROs identified

For ESRS E1 (Climate Change), the entity identified five IROs: Scope 1 emissions from natural gas combustion at the four NL facilities (actual negative impact, E1-IRO-001), Scope 2 emissions from purchased electricity (actual negative impact, E1-IRO-002), physical climate risk to the Polish facility from flooding (potential financial risk, E1-IRO-003), transition risk from customer decarbonisation requirements (potential financial risk, E1-IRO-004), and opportunity from offering low-carbon machining services to medical device OEMs (potential financial opportunity, E1-IRO-005).

Step 4: Assessment

The entity used a 1-to-5 scale for each criterion. For impact materiality: scale (1=negligible, 5=catastrophic), scope (1=isolated, 5=systemic), irremediability (1=fully reversible, 5=permanent). For financial materiality: likelihood (1=remote, 5=near-certain), magnitude (1=immaterial, 5=existential). Combined score = highest single criterion for severity, multiplied by likelihood for potential impacts.

E1-IRO-001 (Scope 1 actual negative impact): Scale 2, Scope 2, Irremediability 3. Combined severity: 3 (highest criterion). As an actual impact, no likelihood adjustment needed. Materiality threshold for impacts: combined severity of 3 or above = material. Conclusion: material.

E1-IRO-004 (Transition risk from customer decarbonisation): Likelihood 4 (OEM customers have published 2030 targets), Magnitude 4 (loss of automotive revenue stream would affect approximately €28M, or 43% of revenue). Combined score: 16. Financial materiality threshold: combined score of 9 or above = material. Conclusion: material.

Step 5: Threshold applied

Of the total IROs identified across all topics, 14 were assessed as material. The entity mapped these to the relevant ESRS disclosure requirements.

Step 6: ESRS 2 IRO-2 table completed

The entity prepared a table showing which ESRS disclosure requirements are covered in the sustainability statement, with cross-references to the relevant sections. For topics assessed as not material, the entity included brief explanations per ESRS 2 IRO-2.

The reviewer sees a file with a documented value chain map and individually identified and scored IROs. The file also contains a defined scoring methodology, a clear materiality threshold with justification, and a complete ESRS mapping table.

Practical checklist for auditors reviewing an IRO assessment

1. Verify that the entity screened all ten ESRS topical standards. If any standard was eliminated at screening, check that the rationale is documented and supported by evidence. Pay particular attention to ESRS E1: if climate change was assessed as not material, verify that the detailed explanation required by IRO-2 is present and substantiated.
2. Check that the scoring methodology is defined before the assessment was performed, not reverse-engineered from the results. The methodology should include definitions for each score level and a materiality threshold. Both should be documented in a standalone methodology note, not embedded in the results.
3. For each material IRO, verify that the evidence supporting the severity or financial materiality assessment is specific to the entity. Generic industry data is acceptable as one input but should be supplemented by entity-specific information (incident records, customer requirements, regulatory correspondence, geographic analysis).
4. Test whether any obvious IROs are missing. Compare the entity’s identified IROs against sector benchmarks (SASB materiality map, GRI sector standards, EFRAG sector guidance when available). If the entity’s sector peers have identified a topic as material and the entity has not, the auditor should inquire about the rationale.
5. Check that the value chain coverage extends to upstream and downstream activities as required by ESRS 1 paragraph 63. An assessment that covers only the entity’s own operations is incomplete by definition.
6. Verify that ESRS 2 IRO-1 disclosure describes the actual process used, not a generic description copied from guidance documents. The disclosure should be specific enough that a reader can understand what the entity did and how it reached its conclusions.

Common mistakes

• Running the IRO assessment as a one-time stakeholder workshop with no follow-up documentation. The workshop may be a useful input, but the assessment requires documented screening of all ESRS topics, individually scored IROs, and a defined methodology. A workshop that produces only a materiality matrix without underlying scoring is insufficient for assurance purposes.
• Treating impact materiality and financial materiality as interchangeable. They are distinct perspectives with different assessment criteria (ESRS 1, paragraphs 43 to 47 for impact, paragraphs 48 to 55 for financial). A topic can be material under one perspective but not the other. The assessment must address both separately.
• Setting the materiality threshold too high to avoid reporting on difficult topics. The threshold must be reasonable and documented. An entity that sets the threshold so that only two topics are material, when sector peers report on eight to ten, will face scrutiny from the assurance provider.

Related Ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• ESRS 1, General Requirements: Chapter 3 (paragraphs 37–55) sets out the double materiality assessment framework and the IRO identification process.
• ESRS 2, General Disclosures: IRO-1 requires disclosure of the assessment methodology; IRO-2 requires a table mapping which ESRS are covered in the sustainability statement.
• EFRAG Implementation Guidance (May 2024): non-binding illustration of how the IRO assessment should work in practice.
• ESRS 1 Application Requirement AR 11: further guidance on assessing severity for negative impacts (scale, scope, irremediability).