How to Screen Flood and Heat Exposure Across Business Facilities

The free global flood dataset that sits behind a large share of corporate physical risk screening has grid cells of 5 by 5 arc-minutes. At the equator that is roughly 10 kilometres by 10 kilometres.

One cell of that size contains your factory, the ridge behind it, the river in front of it and the drainage ditch that will actually flood you. EPRI's evaluation of flood risk tools says as much about WRI's Aqueduct Floods, rating it useful "for screening and comparing locations around the world, rather than providing in-depth local assessment."

That is not a criticism of the tool, which does exactly what it says. It is a problem with how the output gets used, because a number pulled from a 10 kilometre cell often ends up in a risk register column headed "likelihood" and from there into a disclosure.

What The Disclosure Standards Ask For

Both main frameworks now want location-level answers, which is why the register matters rather than the narrative.

IFRS S2 requires, among its cross-industry metrics, the amount and percentage of assets or business activities vulnerable to climate-related physical risks. That is paragraph 29(c), and it is a quantity, not a description.

ESRS E1-9 goes further on geography. Its application guidance requires an undertaking to disclose the location of its significant assets at material physical risk, aggregated by NUTS level 3 codes for assets inside the EU, a drafting choice aligned with Commission Implementing Regulation (EU) 2022/2453 and its template on exposures subject to physical risk. Alongside that sit the monetary amount of assets at material physical risk, split between acute and chronic risk, across short, medium and long term, assessed before adaptation, plus the share already addressed by adaptation actions and the amount and proportion of net revenue at risk.

Read that list as a specification for your register columns and it writes itself. You need, per site: the hazard, whether it is acute or chronic, the asset value exposed, a time horizon, a likelihood, a revenue consequence, and whether anything has been done. Anything your register cannot produce, your disclosure cannot either.

Matching Data Resolution To The Decision

There is a usable ladder of precision, and the honest approach is to be explicit about which rung you are standing on.

Global screening datasets sit at kilometre scale. Aqueduct Floods at 5 by 5 arc-minutes is the example above. National and commercial models run far finer: EPRI's review records roughly 10 metres for one US inland flood model, about 3 metres for First Street's national data, and below 1 metre for one asset-level product. Those differences are not incremental. Flood depth is decided by metres of elevation, so a 10 kilometre cell and a 1 metre grid are answering different questions.

The practical sequence is a tiered one. Screen every site with the free global layer, accept that the output is triage rather than assessment, then buy fine-resolution modelling only for the sites the screen flags and for any site carrying concentrated value or single-source production.

Geocoding precision deserves its own line in the method note. Milliman's actuarial guidance on geocoding points out that a parcel centroid and the building's lowest adjacent grade can differ by up to several metres in elevation, and that centroids sometimes fall in a different risk zone than the building itself. If your site list carries postcodes or parcel centroids rather than rooftop matches or building footprints, your flood screen may be describing the car park.

Expressing Likelihood So It Can Be Audited

The likelihood column is where most registers quietly stop being useful, because they carry words rather than numbers. High, medium and low cannot be aggregated across a portfolio, cannot be multiplied by a consequence, and cannot be challenged.

Use annual exceedance probability. USGS recommends exactly this, preferring the term "1-percent AEP flood" to "100-year flood," and explains why: floods happen irregularly, and in a thousand-year record the gaps between events of that size range from about 15 years to more than 150. Two such floods in consecutive years are not evidence that the model is broken.

Then compound it across the life of the asset, because that is the number a board understands. For a site in the 1-percent AEP floodplain, USGS gives a 26 per cent chance of flooding at least once across a 30-year mortgage. The same arithmetic applied to other exposures is sobering:

A warehouse on a 1-in-20 floodplain is more likely than not to flood during a 20-year lease. Written as "medium," that fact does not survive the journey to the capital committee.

Treating Heat As Two Separate Risks

ESRS already forces the distinction by requiring the acute and chronic split, and heat is the hazard where it matters most. One row cannot hold both.

The acute row is about work stoppage and worker safety. The governing metric is not air temperature but wet bulb globe temperature, standardised under ISO 7243, which combines temperature, humidity, radiant heat and air movement. Indoors near furnaces or under metal roofing, WBGT and the weather forecast part company. Action levels derived from NIOSH and reproduced in OSHA's technical guidance scale with workload and acclimatisation: roughly 30 degrees Celsius WBGT for acclimatised workers on light work against about 28 for the unacclimatised, about 28 and 25 for moderate work, and about 26 and 23 for heavy work. Count the days per year your site exceeds the relevant threshold and you have a likelihood figure that an auditor can test.

The chronic row is about equipment and cost, and it is the one companies skip. Electrical and cooling plant is rated against a design ambient temperature and loses capacity above it. Guidance built on IEEE C57.91 puts the derating of a self-cooled oil-filled transformer at roughly 1.5 per cent of capacity per degree Celsius above a 30 degree base design ambient, measured as a 24-hour average, with about 1 per cent per degree for forced-air units. A site whose summer average has drifted three degrees above the design basis is running a transformer with several per cent less headroom than the nameplate claims, every year, with no incident to log.

A Worked Register

The rows below are illustrative, for a notional manufacturer with four sites. The structure is the point rather than the numbers.

Three features of that table do the work.

The likelihood column states the resolution it came from. The Coimbatore row openly says 10 kilometres, which flags it for proper modelling rather than pretending to a precision it does not have.

The business interruption column describes mechanism, not money. A rupee figure invites argument; "sole source for two product lines" and "6 weeks to requalify" tell an operations director what to do.

Every owner is a person, not a department. "Facilities" owns nothing.

Looking Beyond The Site Boundary

The Chennai apron row above carries the lesson that most registers learn the hard way. The site was not damaged. It was unreachable.

Downtime frequently has nothing to do with your building. Access roads, the feeding substation, the water utility, the port and the ability of staff to travel are all outside the fence and all capable of stopping production on their own. Each belongs in the register as its own row, with its own likelihood, because the flood that closes the approach road is a far more frequent event than the one that reaches your floor slab.

The same logic runs up the supply chain. Contingent business interruption cover is where this surfaces commercially, and the usual discovery is that the policy names a handful of suppliers while the register names one that is not on the list. Screening your own sites and not your single-source suppliers leaves the largest exposure unmeasured.

Notes For Indian Sites

Two features of the Indian context change the register rather than just its numbers.

There is no national occupational heat standard. Heat action planning runs through NDMA and state and city authorities, with nearly 200 city plans finalised and NDMA working toward roughly 300 more as of early 2025, though reporting on their implementation is consistently more sceptical than the count suggests. The practical consequence is that your WBGT thresholds and work-rest cycles are a company standard you set and defend, not a rule you inherit. Write the threshold into the register and into contractor requirements, because that is where most exposed hours sit.

Flood data is the harder gap. Site-resolution fluvial and pluvial modelling is uneven across Indian cities, which means more of your portfolio will sit at screening resolution for longer. Say so in the method note rather than letting a 10 kilometre figure pass as an assessment.

Before It Goes To Assurance

Four checks catch most of what reviewers find.

Confirm every site is geocoded to a building, not a postcode, and record which. Confirm the likelihood column holds probabilities with a stated resolution and horizon, not adjectives. Confirm heat appears twice for every hot site, once acute and once chronic, because the disclosure standard asks for that split. And confirm each row names a person who knows they own it.

The register is not the deliverable. The disclosure, the capital plan and the insurance renewal are the deliverables, and all three read from the same table. A register that cannot answer what percentage of asset value sits at material physical risk, by site, before adaptation, is not a risk register yet. It is a list of worries.

General guidance only. The worked register is illustrative and its figures are invented to show structure; they are not estimates for any real location. Flood and heat hazard data vary widely in resolution, vintage and method, and screening-level outputs should not be presented as site assessments. Occupational heat exposure limits differ by jurisdiction, workload definition and measurement protocol, and the WBGT values cited are indicative action levels rather than legal limits in most countries. Equipment derating figures depend on the specific unit, cooling class and loading profile, and should be confirmed with the manufacturer. Disclosure requirements under IFRS S2 and ESRS are subject to amendment and phase-in; read them against the current adopted text. Confirm requirements with your assurance provider, insurer and relevant authority, and take professional engineering, legal and insurance advice for any specific site or decision.

Sources

International Sustainability Standards Board, European Financial Reporting Advisory Group, Commission Implementing Regulation (EU) 2022/2453, Eurostat, NUTS classification, United States Geological Survey, Electric Power Research Institute, World Resources Institute, First Street Foundation, Milliman, ISO 7243, National Institute for Occupational Safety and Health, United States Occupational Safety and Health Administration, IEEE C57.91, IEC 60076, National Disaster Management Authority, India Meteorological Department

This article is intended for general professional information and does not constitute legal, financial, or investment advice.