Raymond Cheung
Chartered Actuary · CRO · Board Adviser · Singapore
Meeting disclosure requirements and being genuinely prepared to manage ESG risks are very different states. Many companies are achieving the first while quietly deferring the second. That gap will close — on someone else's timeline.
There is a version of ESG that organisations are getting quite good at. They are producing sustainability reports. They are disclosing Scope 1 and 2 emissions. They are appointing ESG committees and publishing diversity targets. They are meeting the reporting requirements that regulators, investors and lenders are increasingly mandating. That is compliance, and compliance is not nothing — it signals seriousness and creates accountability.
But there is a different question — a harder one — that compliance does not answer: Is your organisation actually prepared to manage ESG risks as they materialise? Is climate physical risk embedded in your capital planning? Are supply chain labour risks visible in your procurement process? Is your governance framework capable of handling the liability questions that are beginning to move through courts in multiple jurisdictions? That is readiness. And most organisations are significantly further along on the compliance journey than the readiness journey.
Why the gap exists
The gap exists for understandable reasons. Compliance has a clear deliverable — a report, a disclosure, a rating. Readiness is harder to define and harder to measure. Compliance has a deadline — a regulatory requirement, an investor expectation, a reporting period. Readiness does not come with a deadline until the moment a risk materialises and you discover you were not prepared for it.
And compliance, in many organisations, is owned by a dedicated function — sustainability, legal, investor relations — that has the skills and the mandate to produce the required outputs. Readiness requires the risk function, the finance function, the operations function and the board to understand what ESG risks mean for how the organisation operates. That requires broader organisational change.
“Compliance tells stakeholders what you are measuring. Readiness determines whether you will respond effectively when those measurements become decisions.”
What readiness actually requires
I think about ESG readiness across three dimensions, based on what I see in the organisations I advise.
- Risk integration. ESG risks — climate physical, transition, social and governance risks — need to be visible inside the enterprise risk framework, not alongside it. That means they appear in risk registers, are stress-tested against capital, and have named owners with authority to act.
- Decision relevance. ESG considerations need to show up in actual decisions — capital allocation, M&A due diligence, supplier selection, product design — not just in reporting. If your sustainability report is not informing your investment committee, the work is not embedded.
- Board capability. Directors need the literacy to ask meaningful questions about ESG risk, to challenge management on the adequacy of the organisation's response, and to understand where their personal fiduciary obligations are now touching ESG territory. That requires deliberate investment in board education.
The timeline question
The reason I phrase this as a gap that will close on someone else's timeline is because that is precisely what I observe. The regulatory requirements on ESG disclosure and risk management are tightening — MAS guidelines in Singapore, HKMA requirements, ASEAN taxonomy developments, global ISSB standards. The liability questions — who is responsible when an organisation's climate risk disclosure turns out to be materially misleading — are moving through legal systems. The physical risks — rising insurance costs, asset impairments, supply chain disruptions — are arriving ahead of schedule.
None of those timelines are controlled by the organisation. Compliance gives you some protection — it shows you were paying attention. But readiness is what determines whether you respond well when the moment arrives. I would rather help organisations build the second than produce the first alone.
About the author
Raymond Cheung is a Chartered Actuary, C-suite executive and board adviser with more than 20 years of experience across Asia in risk management, insurance, ESG and corporate governance. He is the CEO of CER Consultancy and an accredited trainer at SMU Academy and the Singapore College of Insurance.