Environmental, social, 
and governance  
(ESG) transformation

2
ESG transformation refers to a total mindset within 
an organization that includes an active awareness of 
the risk of climate change and a greater sense of social 
responsibility and their incorporation at every decision 
level from top to bottom. This article discusses ESG 
at the governance and controls level for insurers. With 
governance being the body setting the tone at the top, 
it is important for insurers to embrace the concept of 
ESG transformation at the governance level to enforce 
sustainability of ESG in governance and internal controls.
On March 21, 2022, the Securities and Exchange 
Commission (SEC) released a proposed rule to regulate 
the disclosure of climate-related risks across public 
companies.1 The rule requires public insurers to 
include climate-related disclosures in their registration 
statements and reporting, including climate-related risks 
that are likely to have a material impact on the business, 
results of operations, or financial condition. This would 
include disclosure of greenhouse gas (GHG) emissions.2 
The SEC proposed rules are built into the disclosure 
framework of the Task Force on Climate-related 
Financial Disclosures (TCFD) and the GHG Protocol.
In April 2022, the Executive (EX) Committee of the 
National Association of Insurance Commissioners (NAIC) 
approved revisions to the annual Climate Risk Disclosure 
Survey to better align with the TCFD disclosure framework 
and the GHG Protocol.3
While the comment period has closed, the SEC received 
almost 15,000 comments related to the proposed rules. 
With this high response rate, the discussion of the 
rules is prevalent throughout the industry. If passed, 
it should lead to greater consistency and comparability 
of emissions and climate-related data across companies, 
industries, and locations.
As a result of this new regulation requirement, finance 
teams will play a crucial role in ensuring that the existing 
financial reporting systems and processes are updated 
to include the correct information to meet the disclosure 
requirements. Many insurers are wondering what 
the best approach is to comply with this SEC rule and 
NAIC revision and produce financial disclosures that 
capture sufficient and reliable data. Beginning with the 
end in mind, insurers should review and assess how 
the existing financial reporting architecture should be 
enhanced to manage these changes and what would 
be the ideal governance structure that can enable 
an effective climate-related disclosure. 
ESG transformation refers to a total 
mindset within an organization that 
includes an active awareness of the 
risk of climate change and a greater 
sense of social responsibility 
and their incorporation at every 
decision level from top to bottom.
Environmental, social, and governance (ESG) transformation
2

Environmental, social, and governance (ESG) transformation
ESG governance
3
As a part of this journey, governance bodies will play 
a pivotal role in establishing top-down accountability 
mechanisms to support the SEC proposed rules on 
climate change. To achieve the expected results, 
organizations should treat this as a large-scale 
change by establishing a robust plan that highlights 
key timelines, internal and external stakeholders, 
and interdependencies to allow them to manage the 
various projects. Having a strong governance structure 
can facilitate effective decision-making and balance 
competing priorities. 
Insurers should consider building an ESG governance 
body that comprises a diverse team with skill sets to 
understand each aspect of ESG reporting requirements 
and their effective execution. ESG initiatives have 
typically been managed separately from the rest of 
the business, either by a sustainability group or through 
the corporate or marketing departments. Given that 
the sustainability information is prepared outside 
of the financial reporting team, the ESG group within 
a company should, at a minimum, include the following 
background: underwriting, investments, data/risk 
management, corporate social responsibility (CSR) 
reporting, marketing, internal audit, and financial 
reporting. The combination of those backgrounds 
can support an effective ESG reporting process for 
the long run. The ESG governance body should work 
on integrating ESG into the overall organizational 
strategy by fostering a corporate culture aimed to 
reduce environmental risks and increase climate resilience, 
and by supporting corporate initiatives related to energy 
and environmental sustainability strategies and programs 
in the workplace (e.g., green leaders, green training).          
This can enable ESG to be an integral part of the overall 
corporate vision and future planning at the organization 
and facilitate the mitigation of risking the omission 
of ESG materials from regulatory filings. 
Although the insurance industry (specifically property 
and casualty insurers) has been proactively monitoring 
climate risk for years, ESG transformation provides an 
opportunity to broaden the governance framework 
to include meaningful controls and processes. Many 
insurers have already started to align their underwriting 
and investment strategies with ESG principles, which 
in turn can help them achieve robust governance and 
transparency within the organization. 
Furthermore, a sustainable ESG strategy should include 
motivation from leaders to take on leadership roles 
in sustainability programs or local communities’ green 
opportunities as well as training that fosters awareness 
of climate-related risks.
Governance bodies will play a 
pivotal role in establishing top-
down accountability mechanisms 
to support the SEC proposed 
rules on climate change.

4
Environmental, social, and governance (ESG) transformation
Risk assessment
Climate-related risks are defined as the actual or 
potential negative impacts of climate-related conditions 
and events on a registrant’s consolidated financial 
statements, business operations, or value chain. Under 
the SEC proposed rule, a registrant must disclose the 
following information:
Governance of climate-related risks: 
How identified climate-related risks have or are 
likely to have a material impact on a company’s 
strategy; business model; outlook over the 
short, medium, and long term; and risk 
management processes.
Climate-related financial statement 
metrics (e.g., disaggregated climate impacts 
on financial statement line items) and impact 
of climate-related physical events and transition 
activities on estimates and assumptions.
GHG emissions including Scopes 1 and 2 
(and Scope 3 phased in if material or if 
registrant has Scope 3 target).
Reasonable assurance phased in for 
accelerated and large accelerated filers over 
certain GHG emissions disclosures; limited 
assurance precedes.
Information about climate-related targets 
and transition plans.
Public insurers should consider revisiting their current 
overall risk assessment strategy and framework to 
account for the above-mentioned risks associated 
with climate. The enterprise risk assessment should 
be updated to reflect the impact of climate change-
related risks. 
The ESG team should conduct a materiality and risk 
assessment to identify the sustainability areas that 
are important and material to the organization. 
The ESG team should also implement appropriate 
board oversight for ESG, similar to board oversight 
on other matters such as audits. The ESG team 
should then integrate ESG topics into the enterprise 
risk management (ERM) process, given how prevalent 
ESG-related risks are. In the proposed SEC rule, there 
is no requirement on the ESG board; however, the rule 
seems to suggest that the board should have expertise 
in GHG or environment-type science.
It is crucial for insurers to clearly understand the impact 
of climate change in the following risks:	
• Financial risk, including data accuracy due to internal
and external data sources	
• Third-party risk and the potential for negative business
impacts, such as loss of customers related to third-
party ESG practices	
• Reputational risk, such as ability to reach ESG-related
goals set publicly by the organization	
• Regulatory risk, including the ability to fulfill regulatory
obligations and confirm accuracy of regulatory
data inputs
Furthermore, insurers should specifically understand 
how the ESG-related changes will impact the following 
risks in their overall risk assessment:	
• Insurance risk: The risk that actual experience
deviates adversely from insurance assumptions,
including mortality, morbidity, and policyholder
behavior assumptions.	
• Material risk: The risk of loss from changes in
interest rates, equity prices, and foreign currency
exchange rates.	
• Liquidity risk: The risk that the company is unable
to meet near-term obligations as they come due.	
• Operational risk: The risk of loss resulting from
inadequate or failed processes or systems.

Environmental, social, and governance (ESG) transformation
5
Data management
Insurers should first assess their system capabilities 
and process flows to consider the data needed to 
support ESG reporting requirements. Given that ESG 
significantly increases the volume and complexities of 
data that must be captured, the company’s IT capabilities 
and processes may require enhancements to manage 
the increased workload. Otherwise, the company should 
assess leveraging a third-party service to help support 
ESG data management with adequate tools.
One common gap that insurers face in their existing 
reporting concerns how actuarial considerations may 
be included—for example, impacts on reserving, 
underwriting, pricing, or stress testing/event modeling. 
Many insurers do not have a tool in place that captures 
results at a sufficiently granular level to support ESG 
reporting. Implementing a strong solution can drive 
considerable time savings in the reporting process 
as the time required to manually compile and process 
data will be exponentially higher in the face of the 
increased volumes of data.
Many insurers have therefore recognized that 
implementing a strong solution represents the 
backbone of a strong financial reporting architecture 
and are deploying solutions to facilitate a smooth 
production run and reduce the operational risk of 
generating robust disclosures. Insurers that do not 
have a strong repository in place should begin by 
defining their strategy for managing this actuarial data 
and assess in-house and vendor alternatives that may 
fill this gap.
Furthermore, insurers should think through what 
technology solution might be appropriate to support 
compliance with ESG in the long run. The technology 
should be able to capture more specifically accurate 
and complete data (e.g., GHG emissions including 
Scopes 1 and 2) to support ESG reporting requirements 
and allow comparability within the industry.
Many insurers do not have a tool 
in place that captures results at 
a sufficiently granular level to 
support ESG reporting.

6		
							
Internal controls and reporting
The SEC proposed rule on climate change requires
insurers to disclose both qualitative and quantitative
information related to GHG inside and outside the 
financial statements. Furthermore, the proposed  
rules require public insurers to include climate  
change disclosures in their registration statement  
 
and Exchange Act annual report in Management’s 
Discussion and Analysis (MD&A) and in the notes  
of their audited financial statements.
One of the biggest challenges insurers will likely face 
is how to ensure the existence of adequate internal 
controls to support effective and accurate reporting  
of climate change-related information.
Insurers should revisit their control environment  
and determine whether they are building robust  
internal controls to support effective ESG reporting.  
 
The following are some items to consider: 
1. Controls around data
A. Processes are in place to provide data needed
to meet ESG reporting requirements
B. Processes are in place to ensure data related to
GHG is available, accurate, secure, and complete
C. Process is in place for data reliance on third parties 
2. Reporting ESG data
A. Definition of ESG targets and metrics
B. Structure of the report to be used for ESG metrics
C.
Impact of ESG targets and metrics on the overall
enterprise risk assessment
3. Tools
A. Assessment of the existing tools and their
capacity to support the ESG reporting requirement
B. Assessment of effectiveness of Information
Technology General Controls (ITGCs) around
the technology supporting ESG reporting
Next steps
Insurers should consider the impact of the proposed 
and adopted regulatory changes in their overall 
reporting. Forward-looking insurers should consider 
the impact of the proposed and adopted regulatory 
changes, with a focus on the implications on their 
governance and internal controls frameworks, 
and perform an initial assessment of their ESG 
reporting readiness.

Environmental, social, and governance (ESG) transformation
7
Authors
Diane Nyemba
Manager
Deloitte Risk & Financial Advisory
Deloitte & Touche LLP
dnyemba@deloitte.com 
David Sherwood
Managing Director
Deloitte & Touche LLP
dsherwood@deloitte.com
Additional contributors
Fahad Qayyum
Risk & Financial Advisory 
Deloitte & Touche LLP 
Tom Marazzo 
Risk & Financial Advisory 
Deloitte & Touche LLP 
Paul D’Aloia
Risk & Financial Advisory
Deloitte & Touche LLP
Bryan Benjamin
Risk & Financial Advisory
Deloitte & Touche LLP
Matt Martinez
Audit & Assurance
Deloitte & Touche LLP
Endnotes
1.	
Securities and Exchange Commission (SEC), Proposed Rule Release No. 33-11042, The Enhancement and Standardization 
of Climate-Related Disclosures for Investors.
2.	
SEC, “SEC proposes rules to enhance and standardize climate-related disclosures for investors,” press release, March 21, 2022. 
3.	
NAIC, 2022 Spring National Meeting materials, Kansas City, Missouri, April 6, 2022.

About this publication
This publication contains general information only and Deloitte is not, by means of 
this publication, rendering accounting, business, financial, investment, legal, tax, or 
other professional advice or services. This publication is not a substitute for such 
professional advice or services, nor should it be used as a basis for any decision or 
action that may affect your business. Before making any decision or taking any action 
that may affect your business, you should consult a qualified professional adviser.
Deloitte shall not be responsible for any loss sustained by any person who relies on 
this publication.
About Deloitte 
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private 
company limited by guarantee (“DTTL”), its network of member firms, and their 
related entities. DTTL and each of its member firms are legally separate and 
independent entities. DTTL (also referred to as “Deloitte Global”) does not provide 
services to clients. In the United States, Deloitte refers to one or more of the US 
member firms of DTTL, their related entities that operate using the “Deloitte” name 
in the United States, and their respective affiliates. Certain services may not be 
available to attest clients under the rules and regulations of public accounting. 
Please see www.deloitte.com/about to learn more about our global network of 
member firms.
Copyright © 2023 Deloitte Development LLC. All rights reserved.