Picture a flood reaching two warehouses on the same street. One reopens in a week. The other loses its stock and a key customer. The hazard was the same, and what differed was vulnerability: how easily each site is harmed and how well it copes.
A climate vulnerability assessment looks at that difference across a company’s sites, operations, and suppliers. This guide explains what climate vulnerability means, how it links to hazard, exposure, and risk, what a climate risk and vulnerability assessment (CRVA) includes, and how a company runs one at facility level.
What Is Climate Vulnerability?
The IPCC defines vulnerability as “the propensity or predisposition to be adversely affected.” It adds that vulnerability “encompasses a variety of concepts and elements, including sensitivity or susceptibility to harm and lack of capacity to cope and adapt.” An older IPCC definition from 2007, still widely quoted, folded exposure into vulnerability. The current definition, from 2022, keeps exposure as a separate idea.
For a company, climate vulnerability has two parts:
- Sensitivity: how much a site or operation is harmed when a hazard hits. Equipment at ground level, a process that needs steady cooling water, or one access road all raise it.
- Capacity to cope and adapt: how well the business absorbs the hit and adjusts over time. Flood barriers, backup power, spare stock, a second supplier, insurance, and a tested continuity plan all add to it.
Vulnerability is a concept, and there is no single formula for it. Frameworks and practitioners assess it in different ways, from site surveys and engineering reviews to scored checklists. Whatever the method, write it down and apply it the same way at every site.
How Hazard, Exposure, and Vulnerability Combine Into Climate Risk
Climate risk comes from three things meeting. The hazard is the flood, heatwave, or storm. Exposure is whether your people, buildings, or supply routes sit where that hazard can reach them. Vulnerability is how badly they are harmed when it does, and how well they recover. The IPCC describes risk as coming from “dynamic interactions between climate-related hazards with the exposure and vulnerability” of what is affected.
Remove any one of the three and the risk falls away. A factory on high ground has little flood exposure, however sensitive its machines are. A floodplain warehouse with raised racking, sealed doors, and a tested plan is exposed but far less vulnerable. That is why two sites with the same hazard rating can carry very different risk.
Where Companies Meet Climate Risk and Vulnerability Assessment Requirements
Few rules ask for a vulnerability assessment by that name. The requirement usually sits inside physical risk work:
- EU Taxonomy: an activity reported as Taxonomy-aligned must show it does no significant harm to climate adaptation. That test calls for a climate risk and vulnerability assessment (CRVA): screen which physical climate risks could affect the activity over its lifetime, assess how material they are, then assess adaptation solutions. It applies to the activities a company reports as aligned.
- ESRS E1: companies in scope describe how they identify climate hazards, using at least high-emission scenarios, and how their assets and business activities “may be exposed and are sensitive” to them, across own operations and the upstream and downstream value chain. Our guide to ESRS E1 physical risk methodology covers the detail.
- IFRS S2 and national versions such as UK SRS and AASB S2: companies disclose the amount and percentage of assets or business activities “vulnerable to climate-related physical risks,” as our guide to IFRS S2 paragraph 29(c) explains.
Lenders, insurers, and investors ask the same questions in due diligence whether or not a rule applies.
What a Climate Risk and Vulnerability Assessment Includes
A corporate CRVA framework usually covers:
- Scope, time horizons, and scenarios, with the reasons written down
- The climate hazards that can reach each site under each scenario
- Exposure of each site, supplier, and route
- Sensitivity of the buildings and the processes inside them
- Existing measures and the capacity to cope and adapt
- A ranked view of which sites and hazards are material
- Adaptation options, costs, and owners
- A record of data, assumptions, and limits that an auditor can follow
Free Climate Risk Report
Run a free climate risk assessment for your location
12 hazards across multiple emission scenarios and four time horizons, for any site. Start free, no call required.
Exposure, Sensitivity, and Adaptive Capacity at a Facility
Most corporate assessments organize the work around three questions. In the IPCC framing exposure sits beside vulnerability, but it is the natural first question, so it belongs on the same checklist.
Exposure
Exposure captures what climate hazards can physically reach an asset or location. A coastal warehouse is exposed to sea level rise and storm surge. An inland data center may be exposed to heat waves and wildfire smoke. A manufacturing facility in a flood plain has exposure to river flooding.
Key questions: What climate hazards affect this location? How intense are they? How frequently do they occur? Will exposure increase under future climate scenarios? The answer comes from hazard maps and climate projections, starting from the site’s coordinates.
Sensitivity
Sensitivity measures how much an asset would be affected if exposed to a hazard. Two facilities with identical flood exposure may have different sensitivities: one with critical equipment at ground level, another with everything elevated. Age of infrastructure, dependency on climate-sensitive inputs (water, stable temperatures), and workforce factors all contribute to sensitivity.
Key questions: How would this asset be affected if the hazard occurs? What are the dependencies and vulnerabilities in operations? Are there single points of failure? The answer comes mostly from site teams and engineering records. Published flood damage curves cover the building structure and contents, but not the process inside.
Adaptive Capacity
Adaptive capacity reflects the ability to adjust to climate impacts, either by reducing harm or capturing opportunities. Organizations with strong adaptive capacity have financial reserves to invest in resilience, diversified supplier networks, robust business continuity plans, and institutional flexibility to make rapid decisions.
Key questions: What resources exist to respond to climate impacts? Are there backup systems and alternative suppliers? How quickly can the organization recover from disruption? The answer comes from inside the company, and most screening models assume none of these measures exist, so record the ones you have.
How to Conduct a Climate Vulnerability Assessment
While methodologies vary, most vulnerability assessments follow a five-step process that moves from scoping through prioritization.
Step 1: Define Scope
Determine what assets, locations, or systems to assess. This might be a single facility, a portfolio of properties, a supply chain tier, or enterprise-wide operations. Establish time horizons for the assessment (baseline conditions, 2030, 2050) and identify which climate scenarios to use (typically SSP2-4.5 for intermediate warming and SSP5-8.5 for high emissions).
Step 2: Identify Climate Hazards
Map the relevant climate hazards for each location. Acute hazards include floods, storms, heat waves, wildfires, and droughts. Chronic hazards include sea level rise, temperature increases, precipitation pattern shifts, and water stress. Not all hazards are relevant everywhere: a facility in Arizona faces different threats than one in coastal Florida.
Step 3: Assess Exposure and Sensitivity
For each location-hazard pair, evaluate exposure levels (low, medium, high, extreme) based on geographic and climate data. Then assess sensitivity by examining asset characteristics, operational dependencies, and structural vulnerabilities. The combination of exposure and sensitivity indicates potential impact.
Step 4: Evaluate Adaptive Capacity
Assess the organization’s ability to respond to and recover from identified climate impacts. Consider financial resources, operational flexibility, existing resilience measures, insurance coverage, and institutional capacity for decision-making. Higher adaptive capacity reduces overall vulnerability even when exposure and sensitivity are high. Record the defenses and plans already in place.
Step 5: Prioritize and Plan Adaptation Actions
Combine exposure, sensitivity, and adaptive capacity assessments to identify the assets most at risk. Use a risk matrix to prioritize: assets with high exposure, high sensitivity, and low adaptive capacity require immediate attention. Develop adaptation plans that either reduce exposure (relocate), decrease sensitivity (harden infrastructure), or build adaptive capacity (improve response capabilities). Check each option for side effects as well: a flood wall, embankment or new well can push risk onto neighbors or store it up for later, a pattern known as maladaptation.
For a detailed quantitative methodology with worked examples covering geocoding, flood depth modeling, damage curves, and expected annual damage calculations, see our 7-step climate vulnerability assessment methodology guide.
You may also see the term climate vulnerability and capacity analysis (CVCA). That is a participatory method from the aid agency CARE for working with communities on local adaptation plans. For company sites, the steps above are the closer fit.
Sample Climate Risk Assessment
See a full climate risk assessment, end to end
We’ll email you a complete worked example for a manufacturing site: 12 hazards, multiple scenarios, and value-at-risk out to 2050. It’s a complete worked example of a climate vulnerability assessment, from geocoding to expected annual damage.
Climate Vulnerability vs. Climate Risk: What’s the Difference?
The terms are often confused, but they represent different concepts in climate assessment.
| Aspect | Climate Vulnerability | Climate Risk |
|---|---|---|
| Definition | Propensity to be harmed: sensitivity and limited capacity to cope and adapt | Potential for harm from hazard, exposure, and vulnerability together |
| Focus | Asset/system characteristics | Likelihood and consequences |
| Primary use | Identify what needs protection | Prioritize based on probability |
In practice, companies rarely assess vulnerability first. They screen hazards and exposure across every site, because that needs only coordinates, then assess vulnerability in depth at the sites the screen flags, because that needs knowledge of the site.
Frequently Asked Questions
What is the difference between climate vulnerability and climate risk?
Climate vulnerability is how easily something is harmed and how well it copes. Climate risk is the potential for harm once a hazard, exposure to it, and vulnerability come together. A site can face a severe hazard and still carry low risk if it is well protected.
Who needs to conduct a climate vulnerability assessment?
Companies reporting under ESRS E1, IFRS S2, or its national versions assess how exposed and sensitive their assets are, and companies reporting Taxonomy-aligned activities need a formal CRVA for those activities. Lenders and insurers ask the same questions of borrowers and policyholders. Any business with physical sites or climate-exposed suppliers benefits.
What is included in a climate risk and vulnerability assessment framework?
Scope and scenarios, the hazards that can reach each site, exposure, sensitivity, existing measures and capacity to adapt, a ranked list of material sites, adaptation options, and a record of data and assumptions.
How do you evaluate climate vulnerability at a company level?
Screen hazards and exposure across all sites, pick the sites and hazards that matter most to what each site does, then assess sensitivity and existing measures with each site team. Roll the results into one ranked register with named owners for adaptation actions.
What are the main climate hazards to consider in a vulnerability assessment?
The main hazards fall into two categories. Acute hazards include floods (river, coastal, pluvial), heat waves, cold stress, wildfires, severe storms, and droughts. Chronic hazards include sea level rise, long-term temperature increases, precipitation pattern changes, and water stress. The relevant hazards depend on geographic location: coastal facilities face different threats than inland or high-altitude sites.
Conclusion
Climate vulnerability assessment provides the foundation for understanding which assets and operations are most susceptible to climate impacts. By systematically evaluating exposure, sensitivity, and adaptive capacity, organizations can prioritize where to focus resilience investments and meet growing regulatory requirements.
For organizations managing multiple locations or supply chains, automated platforms like Continuuiti’s climate risk tool enable physical climate risk assessment at scale, screening exposure across 12 hazards, multiple scenarios, and time horizons, so site teams can focus the vulnerability work where it counts.
