SS5/25 starter kit: a useful guide

In your first month of Supervisory Statement (SS) 5/25 implementation, build a single, Board‑readable evidence pack that proves you have (i) governance and ownership in place, (ii) a structured internal assessment and prioritised plan, and (iii) a repeatable way to generate analysis outputs and store them for audit/supervisory review.

• Executive sponsor(s): Chief Risk Officer and/or equivalent subject matter function-holder
• Core delivery owners: Head of Risk Framework, Climate Risk Lead, Internal Capital Adequacy Assessment Process (ICAAP)/ Internal Liquidity Adequacy Assessment Process (ILAAP) owner, Data Governance lead, Model Risk lead
• Approvers: Risk Committee / Board Risk Committee (and Board as needed)

1. Latest risk appetite statement, risk taxonomy, and risk register structure.
2. Your existing climate risk governance artefacts: committee terms of reference (ToRs), reporting packs, minutes (even if immature).
3. Any existing Climate Scenario Analysis (CSA) outputs, assumptions notes, model documentation, and validation materials.
4. Your prudential documents and processes that climate will need to inform (e.g., ICAAP/ILAAP narrative and supporting analysis).
5. A list of key portfolios/exposures (for banks and building societies, usually starting with mortgage and core lending books).

Step 1 — Create a single SS5/25 tracker. Build one spreadsheet (or equivalent) with the columns: Expectation area → current state → gap → owner → target date → evidence link. Keep the expectation areas aligned to SS5/25’s core themes (governance, risk management integration, CSA, data, disclosures, and banking‑specific considerations). This becomes your “control tower” for implementation and evidence.

Step 2 — Agree ownership, cadence, and decision rights. Write a one‑page Responsible, Accountable, Consulted and Informed (RACI) matrix that names who is responsible for: materiality assessment sign‑off, CSA design approvals, data governance controls, and how climate risk insights feed risk appetite and capital/liquidity discussions. Then set a monthly steering cadence (and a shorter fortnightly delivery cadence if you are behind). This isn’t bureaucracy: it is the mechanism that makes your work “decision‑useful” rather than a one‑off exercise.

Step 3 — Build an “Evidence Register”. Create a document library structure that mirrors your tracker:

• Governance (ToRs, agendas, minutes, decision logs)
• Risk management integration (taxonomy mappings, risk register updates, appetite proposals)
• CSA (scenario inventory, assumptions log, outputs, management conclusions)
• Data (data register, proxy policy, data quality issues log)
• Disclosures (narrative fact base, sign‑off trail)

Step 4 — Produce a Board‑ready pack. Keep it to 6–10 slides plus a short appendix:

• What changed / why it matters (one slide)
• Current maturity snapshot (one slide with “red, amber, green” status per workstream)
• Top 5 gaps and risks (one slide)
• 90‑day plan and resources (two slides)
• Decisions needed from the Board/committee (one slide)
• Appendix: tracker extract and evidence list

Step 5 — Make CSA repeatable. Don’t aim for perfection; aim for repeatability and traceability:

• Write a scenario inventory (what scenarios, horizons, and why).
• Create an assumptions & limitations log (what data proxies you used; what you do not capture).
• Create a results commentary template (how results will be summarised for management; what decisions it should inform). This aligns with the shift towards scenario analysis being decision‑useful and documented, not just technical output.

Step 6 — Add climate risk to routine Management Information (MI). Define what will be reported monthly (e.g., key exposure concentrations, top vulnerabilities, progress against plan) vs quarterly (scenario refresh progress, materiality review refresh, risk appetite changes). Embed this into existing packs rather than building a parallel reporting world.

Step 7 — Lock in sign‑off trail. Make sure at least one committee has:

• reviewed your tracker status,
• challenged scope/materiality,
• agreed the plan and near‑term milestones, and
• recorded actions/decisions in minutes. If it isn’t documented, it will be hard to evidence progress later.

A proportionate approach is not “doing less” by default; it is doing what is necessary for your exposure profile as per the materiality assessment and evidencing the rationale. For smaller institutions with simpler balance sheets, your proportionality story should include:

• a clear statement of portfolio profile and concentrations,
• a documented materiality assessment and why it is reasonable for your firm, and
• a plan that scales analysis depth to where risk is most plausible (for many building societies, start with mortgage collateral and concentration hot‑spots).

Most importantly: document limitations and proxies used and ensure governance sign‑off is explicit in minutes and the evidence register.

• SS5/25 tracker with owners, milestones, and evidence links
• Evidence register / document library structure with version control
• Board/committee minutes showing discussion and decisions
• Scenario inventory and assumptions/limitations log (even if early)
• MI cadence decision and the first embedded MI pack section

Define, document, and govern a proportionate SS5/25 implementation scope that is defensible for firms with simpler business models: clear materiality logic, scaled Climate Scenario Analysis (CSA) approach, explicit limitations, and a set of evidence artefacts that show purposeful progress.

• Owner: Chief Risk Officer (CRO) and / or equivalent subject matter function-holder (accountable for materiality and scope decisions)
• Delivery lead: Climate Risk Lead (coordinates materiality, CSA approach, and documentation)
• Contributors: Credit risk, Treasury, Internal Capital Adequacy Assessment Process (ICAAP) / Internal Liquidity Adequacy Assessment Process (ILAAP) owner owner, Data Governance lead, Finance, Internal Audit (as reviewer)

1. Portfolio overview: products, sectors, geographies, concentrations (especially mortgages for a building society for instance).
2. Current risk register and taxonomy; existing risk appetite metrics.
3. Existing CSA work (even if high level), plus any climate data sources/proxies.
4. Committee calendar and governance artefacts for approvals and minutes.
5. A list of “known questions” from stakeholders (typical examples include building society questions on minimum expectations and ICAAP impacts).

Step 1 — Define what proportionality means for your firm. Write a one‑page “Proportionality Charter” that states:

• the principle you are applying (scale depth to risk exposure),
• what is in scope (portfolios, risk types, horizons), and
• how the approach will evolve as data and capabilities improve.

Step 2 — Create materiality criteria that are simple and testable. Pick 4–6 criteria that your Board can understand and that can be revisited annually, for example: concentration thresholds, geographic hot‑spots, product sensitivity (e.g., long‑dated mortgage collateral), and business model dependencies. Then document:

• thresholds,
• data sources or proxies, and
• known uncertainties/limitations. Your goal is to prove that the firm’s scope choices are reasoned and governed.

Step 3 — Map climate risk pathways to your balance sheet. Keep it pragmatic:

• identify the main exposures (for instance mortgage and core lending),
• map physical and transition pathways at a “first pass” level, and
• highlight where you expect second‑order impacts (e.g., affordability stress, collateral vulnerability, or sector policy impacts). This becomes the narrative bridge between “climate risk” and existing risk categories.

Step 4 — Scale your CSA approach to the proportionality decision. Define a CSA plan that is proportionate and repeatable:

• number of scenarios (a small, justified set is acceptable if documented),
• time horizons (short/medium/long aligned to your decision needs),
• physical and/or transition risk models (per product / asset class),
• cadence (e.g., annual full refresh plus interim monitoring), and
• output expectations (what will be reported, how it will be incorporated into financial risks for instance and what decisions it informs). Document the rationale for every choice and store it in the evidence register.

Step 5 — Write down your limitations and compensating controls. If you use proxies or high‑level assumptions, state:

• what limitation exists (coverage, granularity, uncertainty),
• what you do to avoid over‑interpreting outputs (prudence, stress, expert judgement), and
• what your plan is to improve (data or model upgrades). This is essential for smaller firms where perfect data is not realistic.

Step 6 — Get explicit governance sign‑off. Take the proportionality and materiality pack to a committee (and Board where appropriate), and make sure minutes show:

• the committee reviewed scope criteria and exclusions,
• challenged assumptions and limitations, and
• agreed the scaled CSA plan and milestones.

Step 7 — Translate proportionality into a prioritised plan. Using the agreed scope, build a plan with: workstreams, owners, target dates, and evidence artefacts. This makes proportionality operational rather than theoretical.

A proportionate approach is not “doing less” by default; it is doing what is necessary for your exposure profile as per the materiality assessment and evidencing the rationale. A defensible approach could be to:

1. clearly state the simplicity of exposures,
2. focus first on the most plausible transmission channels for your portfolio, and
3. document why the chosen CSA scope and data proxies are appropriate (and where they are limited). Similarly, firms should avoid “generic” programmes and instead show how proportionality follows their actual exposures and decision needs (e.g., which portfolios matter most, what time horizons drive risk appetite and capital narrative).

• Proportionality charter (one page) with version history
• Materiality criteria and thresholds + limitations register
• Pathway mapping note (balance sheet exposures → climate pathways → existing risk categories)
• CSA plan (scenarios, horizons, models, cadence, outputs, decisions informed)
• Committee minutes and approvals evidencing challenge and sign‑off

Define, document, and govern a practical and proportionate framework that explains how Climate Scenario Analysis (CSA) outputs are translated into credit risk decision-making. This includes establishing a linkage map from climate drivers to Probability of Default (PD), Loss Given Default (LGD), and Expected Credit Loss (ECL) considerations, clarifying where outputs inform expert judgement vs modelled inputs, and evidencing limitations, uncertainty, and governance controls.

The objective is not to fully model climate-adjusted credit parameters from day one, but to demonstrate a clear, traceable, and controlled methodology linking climate insights to credit risk oversight that is defensible under the Prudential Risk Authority’s (PRA) expectations.

• Owner: Chief Risk Officer (CRO) (accountable for how climate considerations influence credit risk decisions)
• Delivery lead: Credit Risk function (responsible for integrating CSA outputs into credit processes and governance)
• Contributors: Climate Risk Lead (provides CSA outputs and interpretation) Model Risk (framework for model use, overlays, and limitations) Finance / Provisioning teams (ECL implications) Data Governance (data lineage and controls) Internal Audit (independent review and challenge)

• Credit risk model inventory (PD, LGD, Exposure at Default (EAD), International Financial Reporting Standards (IFRS) 9 frameworks)
• CSA outputs mapped to relevant climate pathways (physical and transition)
• Portfolio segmentation (mortgages, commercial real estate, corporates, sector exposures)
• Existing risk appetite framework and credit risk metrics
• Documentation standards and governance frameworks (model use, expert judgement policies)
• Existing overlays or stress testing methodologies

Step 1 — Define a “use policy” for CSA outputs

Clarify upfront how CSA outputs can be used across credit risk management:

• What can inform qualitative expert judgement (e.g. sector vulnerability signals)?
• What requires model governance before quantitative use (e.g. PD adjustments)?
• Where CSA outputs are informational only (no direct impact on decisions yet)

This prevents inappropriate or inconsistent use of climate outputs and aligns with model risk expectations.

Step 2 — Map exposures to relevant climate pathways

Start with a simple but structured mapping:

• Identify core portfolios (e.g. mortgages, corporate lending)
• Link each to relevant physical risks (e.g. flood, heat stress) and transition risks (e.g. carbon pricing, regulation)
• Assign scenario pathways at a high level (e.g. orderly vs disorderly transition)

The goal is to establish a consistent translation layer between climate scenarios and credit exposures.

Step 3 — Build the credit risk linkage map

Develop a structured driver → pathway → credit lens → decision impact framework:

• Climate driver (e.g. carbon price increase, flood frequency)
• Transmission pathway (macroeconomic, sectoral, collateral)
• Credit lens: PD (borrower affordability, sector profitability) LGD (collateral value, recovery assumptions) ECL (forward-looking provisioning adjustments)
• Governance decision point (overlay, monitoring metric, escalation threshold)

This linkage map is the core artefact demonstrating how CSA outputs feed into credit risk governance.

Step 4 — Distinguish qualitative vs quantitative use

Document clearly:

• Where climate risk informs narrative overlays or expert judgement
• Where there is potential for quantitative incorporation into models
• Where usage is intentionally limited due to data or methodological constraints

This avoids overstating model sophistication and supports a transparent proportional approach.

Step 5 — Record limitations and compensating controls

Explicitly document:

• Data gaps and reliance on proxies
• Uncertainty in scenario outputs and transmission channels
• Limitations in mapping climate drivers to credit parameters

Then define compensating controls, such as:

• Conservative overlays or stress adjustments
• Governance review thresholds
• Enhanced monitoring metrics

This is critical to prevent over-reliance on immature methodologies.

Step 6 — Establish change control and triggers

Define what would trigger updates to the framework:

• New CSA outputs or scenario revisions
• Changes in portfolio composition
• Emerging regulatory expectations
• Model redevelopment cycles

Ensure there is a formal escalation pathway for material changes to credit risk assumptions.

Step 7 — Obtain explicit governance approval

Take the linkage framework to the appropriate committee(s) and ensure documentation shows:

• Clear articulation of how CSA informs credit risk decisions
• Challenge on limitations and assumptions
• Agreement on qualitative vs quantitative use boundaries

Committee minutes should explicitly evidence review, challenge, and approval.

A proportionate approach does not require fully climate-adjusted PD/LGD models immediately. Instead, firms should aim to:

• Demonstrate a clear and consistent linkage methodology
• Prioritise material portfolios and transmission channels
• Use expert judgement where necessary, with proper governance
• Be transparent about what is not yet modelled and why

The key expectation is traceability and governance, not technical perfection.

• CSA-to-credit linkage map (core artefact)
• Documented use policy (qualitative vs quantitative applications)
• Limitations register with compensating controls
• Portfolio mapping (exposures → climate pathways)
• Governance approvals and committee minutes
• Version-controlled change log (updates and triggers)

Define, document, and govern a practical and proportionate approach to embedding climate risk within the Internal Capital Adequacy Assessment Process (ICAAP). This requires establishing a clear linkage between climate scenario outputs, materiality assessments, and the firm’s capital narrative, ensuring that climate risk is reflected in risk identification, stress testing, and capital adequacy considerations.

The objective is to demonstrate a structured, transparent, and decision-useful integration of Climate Scenario Analysis (CSA) into ICAAP. The approach should evidence how climate considerations inform risk appetite, capital planning, and management decisions, supported by a robust governance and documentation framework.

• Owner: Chief Risk Officer (CRO) (accountable for ICAAP integrity and inclusion of climate risk)
• Delivery lead: ICAAP owner (responsible for drafting and integrating climate content into the ICAAP document)
• Contributors: Climate Risk Lead (provides CSA outputs and interpretation), Finance / Treasury (capital planning, financial narrative, scenario consistency), Risk specialists (credit, market, liquidity as relevant), Model Risk (validation of any quantitative elements) Internal Audit (independent challenge and review)

• ICAAP structure and existing capital assessment framework
• Materiality and proportionality assessment for climate risk
• CSA outputs (scenarios, pathways, key risk drivers)
• Risk appetite statement and supporting metrics
• Existing governance artefacts and committee minutes
• Financial planning assumptions (baseline and stressed scenarios)

Step 1 — Define where climate risk sits within ICAAP

Decide explicitly how climate risk is incorporated across ICAAP sections:

• Risk identification: how climate risk is recognised within the risk universe
• Scenario analysis and stress testing: how CSA aligns with ICAAP stress scenarios
• Capital adequacy narrative: how climate risk influences capital planning and resilience

This ensures climate risk is embedded rather than isolated within the ICAAP framework.

Step 2 — Establish a clear materiality and inclusion rationale

Document a defensible rationale explaining:

• Why climate risk is material or immaterial to the firm’s capital position
• Which portfolios, risk types, and time horizons are considered
• What elements are included vs excluded from ICAAP

This rationale should align with the firm’s broader proportionality framework and be clearly evidenced to stakeholders and regulators.

Step 3 — Translate CSA outputs into ICAAP-relevant insights

Define how climate scenarios inform ICAAP analysis:

• Identify key transmission channels (e.g. credit deterioration, market shocks, liquidity strain)
• Translate CSA outputs into directional impacts (e.g. increased default risk, collateral volatility)
• Link these to ICAAP components such as stress testing or capital buffers

Importantly, distinguish between:

• Directional insights (used to inform narrative and assumptions)
• Sensitivity analysis (quantification where feasible)

This step bridges the gap between climate modelling and capital assessment logic.

Step 4 — Document assumptions, limitations, and uncertainty

Clearly set out:

• Key assumptions underpinning climate risk analysis
• Limitations in data, models, and scenario translation
• Areas where simplifications or proxies are used

Then define appropriate management overlays or prudential adjustments, ensuring that ICAAP conclusions remain conservative and credible despite uncertainty.

Step 5 — Develop a structured ICAAP climate annex

Create a dedicated annex (or clearly defined section) that includes:

• Climate risk materiality assessment
• Summary of CSA approach and outputs
• Linkage to ICAAP stress testing and capital narrative
• Assumptions, limitations, and governance references
• Cross-references to supporting evidence

This annex becomes the primary artefact demonstrating integration and traceability.

Step 6 — Align governance and decision-making

Ensure that climate risk considerations are:

• Reviewed within ICAAP governance forums
• Subject to challenge and discussion at committee level
• Linked to strategic decisions (e.g. capital allocation, risk appetite adjustments)

Document how CSA outputs have influenced management judgement, not just been presented for information.

Step 7 — Secure approval and evidence decisions

Obtain formal approval through the appropriate governance bodies and ensure documentation shows:

• Review of climate risk inclusion and materiality rationale
• Challenge on assumptions and limitations
• Agreement on how climate risk is reflected in the capital narrative

Committee minutes should provide a clear audit trail of decisions and rationale.

To achieve a proportionate ICAAP integration, firms should aim to:

• Demonstrate a clear linkage between CSA outputs and capital considerations
• Focus on material risk channels and portfolios
• Use expert judgement supported by structured analysis
• Be transparent about limitations and areas of ongoing development

For smaller firms or those with simpler balance sheets, a credible approach may rely on:

• High-level sensitivity analysis rather than full modelling
• Narrative-based capital considerations supported by CSA insights
• Conservative assumptions embedded in capital planning

The key expectation is that climate risk is actively considered in capital adequacy, not treated as a purely theoretical exercise.

• ICAAP climate annex (core integration artefact)
• Inclusion / exclusion and materiality rationale
• CSA summary tailored to ICAAP use
• Documentation of assumptions, limitations, and overlays
• Governance approvals and committee minutes
• Evidence links to underlying data, models, and analysis

Define, document, and govern a practical climate data governance framework that supports climate risk management, Climate Scenario Analysis (CSA), risk reporting, and SS5/25 implementation. The objective is to establish a minimum viable data operating model that enables consistent analysis, transparent limitations, and a clear evidence trail, without creating unnecessary complexity.

Firms should demonstrate that climate data is being managed in a structured and transparent way, proportionate to the firm's size, complexity, and risk profile.

Owner: Chief Risk Officer (CRO) – accountable for ensuring climate risk data supports effective risk management.

Delivery lead: Data Governance Lead – responsible for maintaining data governance standards, controls, and reporting.

Contributors:

• Climate Risk Lead (defines climate data requirements)
• IT and Data Architecture teams (data sourcing and infrastructure)
• Credit Risk, Finance and Treasury (consumer and challenge functions)
• Risk Governance team (evidence retention and reporting)
• Internal Audit (independent review)

Before establishing a climate data governance framework, firms should assemble:

• Inventory of climate datasets
• Internal portfolio and exposure data sources
• Existing data governance standards
• CSA requirements
• Regulatory and reporting requirements
• Existing data quality reporting
• Current risk and management information needs

These inputs provide the foundation for identifying critical climate data and prioritising governance efforts.

Step 1 — Create a climate data register

The starting point is a central climate data register. The register should provide a complete inventory of climate-related datasets and data fields used in analysis, reporting, and decision-making.

The purpose of the register is to create transparency around the data that supports climate risk assessments and governance activities. Without a register, firms may struggle to explain where data originated or whether the same data is being used consistently across exercises.

Step 2 — Define critical climate data elements

Not all climate data requires the same level of governance.

Firms should identify the climate data elements that directly support material risk assessments, such as:

• Sector classifications
• Geographic exposure information
• Property location data
• Flood and physical risk indicators
• Carbon emissions metrics
• Energy performance information
• Scenario variables and outputs

This allows governance and quality efforts to focus on the information most relevant to decision-making and regulatory expectations.

Step 3 — Establish a proxy policy if necessary

Climate risk analysis often relies on incomplete data. Rather than avoiding analysis altogether, firms should establish a documented proxy policy explaining:

• When proxies can be used
• Who approves their use
• How proxy methodologies are selected
• How limitations are documented
• When proxy replacement should be considered

Examples may include sector-average emissions data, regional hazard indicators, or estimated energy efficiency measures. The important control is not eliminating proxies but ensuring their use is transparent and governed.

Step 4 — Define data quality metrics

Firms should establish a small set of climate data quality indicators that can be reported consistently over time.

These measures should be incorporated into regular management information so that stakeholders can understand the strengths and weaknesses of available climate data.

For smaller firms, a limited set of metrics is usually sufficient, provided they are monitored consistently.

Step 5 — Document data lineage and controls

For each critical climate dataset, firms should document:

• Source systems
• Data transformations
• Manual interventions
• Validation checks
• Storage locations
• Output destinations

The objective is to create a traceable pathway from source data to management conclusions.

Good lineage documentation helps support governance reviews, internal audit work, and regulatory engagement by demonstrating how climate data flows through the organisation.

Step 6 — Establish a climate data issues log

Climate data governance should include a formal process for identifying and managing data issues.

The issues log should record:

• Description of issue
• Impact assessment
• Severity
• Owner
• Target resolution date
• Remediation status

Examples may include missing property data, incomplete emissions coverage, outdated external datasets, or weaknesses in data lineage documentation.

A structured issues process demonstrates ongoing improvement and helps prevent known limitations from being forgotten.

Step 7 — Align governance and reporting

Climate data quality should be reviewed through existing governance structures rather than creating unnecessary new committees.

Governance reporting should include:

• Data quality metrics
• Open issues
• Key limitations
• Remediation progress
• Material data risks

This ensures senior management understands the quality of the information supporting climate-related decisions.

Step 8 — Link data evidence to analysis outputs

A common weakness is the inability to connect analysis outputs back to source data.

Firms should therefore maintain clear links between:

• Climate datasets
• Analysis runs
• Assumptions logs
• Scenario outputs
• Management summaries
• Committee papers

This creates an evidence trail that supports transparency and repeatability.

Step 9 — Review data governance periodically

Climate data capabilities will evolve over time.

Periodic reviews should assess:

• Dataset relevance
• Quality trends
• Continued use of proxies
• Changes in reporting requirements
• Emerging regulatory expectations

The climate data register should be updated whenever significant changes occur.

A proportionate climate data governance framework does not require large-scale data transformation programmes.

A credible and proportionate approach may consist of:

• A simple climate data register
• Clearly documented ownership
• A practical proxy policy
• Basic data quality metrics
• A structured issues log
• Annual governance review

The key objective is to demonstrate that climate data is understood, controlled, and sufficiently reliable for its intended use. Firms should focus governance efforts on the data that supports material risks and decision-making rather than attempting to perfect every dataset.

Core evidence artefacts should include:

• Climate data register
• Data ownership records
• Proxy policy
• Data quality metrics and Management Information (MI)
• Data lineage documentation
• Issues and remediation log
• Governance sign-off records
• Evidence register links
• Periodic review documentation

Together, these artefacts demonstrate that climate risk data is managed consistently, limitations are understood, and the firm has a defensible governance framework capable of supporting ongoing SS5/25 implementation.

Firms should establish a practical and proportionate framework for governing climate-related models, methodologies, tools, and analytical outputs.

The objective is not to treat every climate tool like a regulatory capital model. Instead, firms should demonstrate that climate methodologies are documented, governed, reviewed, validated appropriately, and subject to change control.

This is particularly important where outputs influence:

• Risk appetite
• Portfolio monitoring
• Internal Capital Adequacy Assessment Process (ICAAP) conclusions
• Strategic planning
• Credit judgement
• Provisioning discussions
• Board reporting

Owner: Chief Risk Officer (CRO)

Delivery lead: Model Risk / Validation function

Key contributors:

• Climate Risk Lead
• Data Governance
• Credit Risk, Finance, Treasury and ICAAP teams
• Tool and methodology owners
• Internal Audit

Firms should assemble:

• Existing model inventory
• Model risk policy and validation standards
• Climate scenario methodologies
• Assumptions and limitations logs
• Governance artefacts and approvals
• Evidence register structure
• Historical climate analysis outputs

Step 1 – Identify climate models and tools

Start by identifying all climate-related methodologies used across the firm.

This may include:

• Scenario analysis tools
• Physical risk assessments
• Transition risk methodologies
• Portfolio heatmaps
• Vendor tools
• Spreadsheet-based models
• Expert judgement frameworks

If outputs influence management decisions or risk assessment, they should be considered within model governance.

Step 2 – Add them to the model inventory

Each climate tool should be recorded with:

• Owner
• Purpose
• Methodology
• Use case
• Validation status
• Review date

The inventory should also distinguish whether outputs are:

• Informational
• Directional
• Sensitivity-based
• Decision-influencing

The more influential the output, the stronger the controls required.

Step 3 – Assess decision criticality

Document how outputs are used across the organisation.

A practical classification is:

Level / Typical Use

Low / Awareness and exploratory analysis

Medium / Portfolio monitoring and management judgement

High / Capital planning, provisioning, lending decisions, regulatory submissions

Validation, governance, and documentation requirements should increase with decision criticality.

Step 4 – Standardise documentation

Establish a minimum documentation pack for all climate tools.

This should cover:

• Purpose and scope
• Portfolio coverage
• Data inputs and lineage
• Scenario assumptions
• Methodology
• Limitations
• Use restrictions
• Governance arrangements
• Change control requirements
• Evidence references

Documentation does not need to be lengthy, but it should allow an independent reviewer to understand the methodology and its limitations.

Step 5 – Record assumptions and uncertainty

Climate risk analysis contains significant uncertainty.

Documentation should capture:

• Data limitations
• Scenario limitations
• Use of proxies
• Methodological simplifications
• Calibration constraints
• Expert judgement
• Interpretation boundaries

The important control is ensuring uncertainty is understood and reflected in how outputs are used.

Step 6 – Define tiered validation requirements

Validation should be proportionate to use.

Level 1 – Documentation and reasonableness review

Suitable for exploratory or informational outputs.

Typical activities:

• Documentation review
• Ownership confirmation
• Assumptions review
• Reasonableness checks

Level 2 – Methodology review

Suitable where outputs inform management judgement or governance discussions.

Typical activities:

• Scenario review
• Data quality assessment
• Logic testing
• Sensitivity analysis
• Challenge of assumptions

Level 3 – Independent validation

Suitable where outputs influence capital, provisioning, lending strategy, risk limits, or regulatory engagement.

Typical activities:

• Independent review
• Benchmarking or replication
• Data lineage assessment
• Sensitivity testing
• Formal validation reporting

Step 7 – Define review cadence and triggers

Set review frequencies based on criticality.

Common trigger events include:

• Portfolio changes
• New scenarios
• Vendor methodology updates
• Data source changes
• Expanded use of outputs
• Regulatory feedback
• Internal audit findings

More decision-critical methodologies should be reviewed more frequently.

Step 8 – Implement change control

All material changes should be formally assessed and approved.

Capture:

• Description of change
• Reason for change
• Impact assessment
• Outputs affected
• Validation requirements
• Approval status
• Implementation date
• Superseded version

This helps distinguish genuine risk changes from methodology changes.

Step 9 – Retain validation evidence

The evidence register should include:

• Model inventory entries
• Documentation packs
• Data quality assessments
• Assumptions logs
• Validation reports
• Issue trackers
• Approvals
• Committee papers
• Change logs
• Periodic review records

Reviewers should be able to trace governance conclusions back to the underlying methodology and validation performed.

Step 10 – Monitor issues and evolving use

Maintain an issues and remediation tracker recording:

• Issue description
• Severity
• Owner
• Required action
• Status
• Closure evidence

Firms should periodically reassess whether a tool's actual use remains consistent with its approved use. If a methodology becomes more embedded in decision-making, its validation requirements should be upgraded accordingly.

A proportionate framework may include:

• A simple climate model inventory
• Clear ownership
• Standardised documentation templates
• Assumptions and limitations logs
• Tiered validation standards
• Annual reviews with trigger events
• Structured evidence retention

The key question is: what decisions does the output influence, and what level of control is required to support that use?

Retain:

• Updated model inventory
• Documentation packs
• Intended-use classifications
• Decision criticality assessments
• Assumptions and limitations logs
• Data lineage evidence
• Validation plans and reports
• Issues trackers
• Governance approvals
• Change logs
• Review evidence
• Evidence register references

A practical model risk framework enables firms to demonstrate that climate-related methodologies are governed, understood, proportionately validated, and used appropriately within risk management and decision-making processes.

SS5/25 expects firms to move beyond one-off climate exercises and establish a repeatable process for Climate Scenario Analysis (CSA). The objective is to create a controlled runbook that enables consistent climate analysis, clear governance, and a robust evidence trail.

A practical runbook should explain:

• What is being analysed
• Why it is being analysed
• Which scenarios and horizons are being used
• How outputs should be interpreted
• Where evidence is stored
• How results are reviewed and escalated

The goal is not operational complexity. It is to demonstrate that climate analysis is embedded within risk management and supports decision-making across risk appetite, Internal Capital Adequacy Assessment Process (ICAAP) / Internal Capital Adequacy Assessment Process (ILAAP), strategic planning, and governance.

Owner: Chief Risk Officer (CRO)

Delivery lead: Climate Risk Lead

Key contributors:

• Data Governance (data quality and portfolio controls)
• Risk Governance or PMO (tracking, evidence, committee reporting)
• Credit Risk, Finance, Treasury and ICAAP/ILAAP teams (users of outputs)
• Model Risk and Validation (assumptions and methodology challenge)
• Internal Audit (independent review)

Before each analysis run, firms should maintain:

• Portfolio cut rules and segmentation guidance
• Approved scenario and horizon inventory
• Assumptions and limitations log
• Governance calendar
• Evidence register structure
• Standard management information (MI) templates
• Archive of prior runs and conclusions

Step 1 – Create a standard analysis run template

Every climate analysis run should use a standard template including:

• Portfolio snapshot date
• Portfolios in and out of scope
• Scenario selection
• Time horizons
• Key outputs required
• Preparers and reviewers
• Evidence location
• Links to assumptions and previous versions

Consistency is essential if results are to be compared over time.

Step 2 – Define portfolio scope and data controls

Document the portfolio population being analysed, including:

• Products and business lines in scope
• Exposure date
• Segmentation approach
• Data exclusions and rationale
• Required data fields
• Data quality checks

The runbook should clearly explain both what has been analysed and what has been excluded. This transparency helps avoid over-interpreting results based on incomplete data.

Step 3 – Maintain an approved scenario inventory

Create a controlled inventory showing:

• Scenario source and name
• Physical and transition risk coverage
• Time horizons
• Key climate variables
• Intended use
• Known limitations
• Approval owner

Firms should be able to explain why particular scenarios have been selected and how they relate to material risks and business activities.

Step 4 – Maintain assumptions and limitations logs

Every run should be accompanied by an assumptions log covering:

• Data assumptions
• Portfolio segmentation assumptions
• Proxy methodologies
• Missing data treatment
• Scenario interpretation choices
• Model limitations
• Areas requiring expert judgement

The focus should be on transparency. Firms do not need perfect analysis, but they must understand and communicate its limitations.

Step 5 – Apply version control

Establish clear file naming and version control standards including:

• Run date
• Portfolio scope
• Scenario set
• Version number
• Prepared and reviewed by
• Governance destination

Strong version control helps demonstrate which outputs informed management decisions and prevents confusion during reviews or audits.

Step 6 – Produce a management summary

Each run should generate a concise management summary containing:

• Purpose of analysis
• Portfolio analysed
• Scenarios used
• Key findings
• Changes since previous run
• Main limitations
• Management interpretation
• Recommended actions

The summary should communicate conclusions without overstating precision.

Step 7 – Link outputs to governance

The runbook should specify where outputs are stored and how they are referenced within governance processes.

Evidence should include:

• Analysis outputs
• Charts and MI packs
• Assumptions logs
• Committee papers
• Decision logs
• Approvals and minutes

A reviewer should be able to trace a governance decision back to the underlying analysis.

Step 8 – Define cadence and triggers

Specify both planned and event-driven analysis cycles.

Potential triggers include:

• Annual refreshes
• Risk appetite reviews
• ICAAP/ILAAP updates
• Material portfolio changes
• New scenario methodologies
• Regulatory requests
• Emerging climate events

Escalation thresholds should also be defined where results indicate material changes in portfolio vulnerability or strategic risk.

Step 9 – Review and challenge outputs

Before outputs are used in governance, firms should perform:

• Technical review of assumptions and inputs
• Business review of interpretation
• Challenge of limitations
• Approval of management summaries
• Agreement on actions and escalation

The objective is not simply to verify calculations but to confirm that conclusions are reasonable and decision-useful.

Step 10 – Maintain a runbook change log

The runbook itself should be version controlled.

Record:

• Scenario changes
• Methodology updates
• Portfolio scope changes
• Template revisions
• Governance enhancements
• Approval dates

This demonstrates how the firm's climate risk framework is developing over time.

A proportionate approach may consist of:

• Limited portfolio coverage focused on material risks
• A small number of approved scenarios
• Simple management summaries
• Annual refreshes with defined trigger events
• A straightforward evidence register

The key test is whether the process is repeatable, explainable, and linked to decision-making.

Firms should retain:

• Standard run template
• Portfolio cut rules
• Scenario inventory
• Assumptions and limitations logs
• Archived outputs
• Management summaries
• MI references
• Committee papers and minutes
• Decision logs
• Run schedules and trigger records
• Version-controlled runbook and change log

A well-governed runbook provides evidence that climate analysis is being used consistently and integrated into the firm's risk management framework.

Define, document, and govern a practical and proportionate approach to assessing physical climate risk on mortgage collateral. The objective is to create an evidence-backed assessment pack that helps management understand where physical climate hazards may affect mortgage portfolios and how those insights should be used within risk management, underwriting, monitoring, and strategic decision-making.

Owner: Chief Risk Officer (CRO) – accountable for ensuring physical climate risks are appropriately considered within the firm's risk management framework.

Delivery lead: Credit Risk or Mortgage Risk function – responsible for preparing the assessment and management conclusions.

Contributors:

• Climate Risk Lead (hazard analysis and interpretation)
• Data Governance (portfolio and location data)
• Mortgage Underwriting teams
• Portfolio Management teams
• Risk Governance
• Internal Audit (independent review)

Before conducting the assessment, firms should assemble:

• Mortgage portfolio data
• Geographic exposure information
• Property and collateral characteristics
• Loan-to-value (LTV) information
• Product and maturity segmentation
• Existing collateral and underwriting policies
• Climate hazard assessment outputs
• Data governance and quality documentation

These inputs should be sufficient to identify where concentrations of physical climate vulnerability may exist and where additional management attention may be required.

Step 1 — Define the assessment scope

Begin by defining exactly which parts of the mortgage portfolio are being assessed.

This should include:

• Owner-occupied mortgages
• Buy-to-let portfolios
• Specialist lending books
• Geographic regions
• Property types
• New lending versus legacy exposures

The rationale for inclusions and exclusions should be documented.

A proportionate approach may initially focus on the portfolios that represent the greatest exposure or highest perceived vulnerability. The objective is to demonstrate a clear and defensible scope rather than attempting to analyse every exposure in equal detail.

Step 2 — Segment mortgage collateral exposures

Create a structured view of the mortgage portfolio using meaningful risk segments.

Examples include:

• Region and postcode area
• Property type
• Loan-to-value band
• Origination vintage
• Remaining term
• Product type
• Borrower segment

Segmentation allows management to identify concentrations of exposure and understand whether certain groups of properties may be more vulnerable than others.

For many building societies, geographic segmentation will be the most important starting point because physical climate vulnerability is often location dependent.

Step 3 — Define relevant physical hazards

Not all hazards will be equally relevant to every lender.

Firms should define a proportionate hazard universe based on their geographic footprint and portfolio characteristics.

Potential hazards may include:

• River flooding
• Surface water flooding
• Coastal flooding
• Subsidence
• Heat stress
• Wildfire
• Storm severity

The rationale for selecting specific hazards should be recorded and approved.

A focused, well-justified assessment is generally more valuable than attempting to assess every possible climate hazard without sufficient evidence.

Step 4 — Define assessment horizons

Physical climate risk evolves over time, therefore firms should assess exposures across multiple horizons.

Typical horizons may include:

• Current risk profile
• Short-term horizon
• Medium-term horizon
• Longer-term horizon

The selected horizons should align with the firm's broader climate risk framework, strategic planning processes, and scenario analysis approach.

Documenting horizon selection also helps management understand that vulnerabilities may emerge gradually rather than immediately.

Step 5 — Assess concentrations and vulnerabilities

The next step is to identify where material concentrations may exist within the mortgage portfolio.

The assessment should consider:

• Geographic concentrations
• Exposure volumes
• LTV concentrations
• Property-type clusters
• Vulnerable regions
• Potential accumulation risks

The objective is not to estimate exact future losses but to identify where physical climate risks could plausibly influence collateral quality, borrower resilience, portfolio performance, or strategic risk.

Results should be presented in a way that is understandable to senior management and Board committees.

Step 6 — Document assumptions and limitations

All physical risk assessments contain uncertainty.

Firms should clearly document:

• Data gaps
• Use of proxies
• Hazard model limitations
• Geographic granularity constraints
• Assumptions used in interpretation
• Areas requiring expert judgement

Management should understand both the strengths and limitations of the assessment.

Transparency regarding uncertainty often provides stronger governance evidence than presenting outputs with excessive precision.

Step 7 — Produce a management information summary

Create a concise management information (MI) pack summarising key findings.

The summary should include:

• Portfolio scope
• Hazard coverage
• Geographic concentration analysis
• Key vulnerabilities
• Material limitations
• Emerging trends
• Recommended actions

The focus should be on decision-useful insights rather than technical detail.

Management teams should be able to understand what has been identified, why it matters, and what actions may be required.

Step 8 — Define management actions

A physical risk assessment should lead to consideration of management responses.

Potential actions may include:

• Enhanced portfolio monitoring
• Changes to underwriting guidance
• Additional due diligence requirements
• Updated collateral policies
• New concentration monitoring metrics
• Risk appetite discussions
• Strategic portfolio reviews

The assessment should clearly distinguish between findings and management decisions.

Documenting the rationale for actions—or decisions not to act—is an important governance outcome.

Step 9 — Integrate findings into governance

Physical risk findings should be embedded within existing governance forums.

This may include:

• Risk Committees
• Board reporting
• Climate Risk Committees
• Mortgage Portfolio Reviews
• Internal Capital Adequacy Assessment Process (ICAAP) governance processes

Committee discussions should evidence:

• Review of findings
• Challenge and debate
• Understanding of limitations
• Agreed actions
• Ownership of follow-up activities

This demonstrates that climate analysis is supporting decision-making rather than being performed solely for compliance purposes.

A proportionate approach does not require highly sophisticated modelling or property-level analysis across every exposure.

For many building societies and mortgage lenders, a credible approach may consist of:

• Geographic portfolio segmentation
• A small number of relevant hazards
• High-level concentration analysis
• Clear documentation of limitations
• Defined monitoring activities
• Governance review and challenge

The objective is to demonstrate that physical climate risk on mortgage collateral is understood, assessed, and incorporated into risk management processes in a manner appropriate to the firm's business model and risk profile.

Core evidence artefacts should include:

• Physical risk assessment pack
• Portfolio segmentation methodology
• Scope and materiality rationale
• Hazard selection rationale
• Assumptions and limitations log
• Management information summary
• Recommended management actions
• Governance approvals
• Committee minutes
• Evidence register references

Together, these artefacts provide a documented and defensible approach to understanding physical climate risks within mortgage collateral portfolios and demonstrate progress towards meeting SS5/25 expectations.