Thinking · Method

Your climate risk assessment found the flood. It did not find the patient.

Abhijith Magal · 14 September 2026 · 9 min read

The assessment was good. Site by site, it modelled floods, heat, drought and storms under three emissions scenarios and three horizons, and gave each location a rating. The board saw the map. The auditors saw the method. Nobody asked what happened to the people the company's health programmes were meant to reach when the flood came, because the assessment was never built to see them.

This page sets the two assessments side by side: the physical risk assessment most large companies have now run, and the access risk assessment almost none have. It is written for anyone who owns either one.

What does a physical climate risk assessment actually produce?

A ranked view of asset exposure. IFRS S2, the climate standard of the International Sustainability Standards Board, defines physical risks as risks resulting from climate change that can be event-driven, which it calls acute, or come from longer-term shifts in climatic patterns, which it calls chronic. Its examples of acute risk are storms, floods, drought and heatwaves. The standard also asks an entity to say how it defines its short, medium and long term.

A published 2025 climate risk report from one listed company shows what a well-built assessment of this kind looks like. It assessed acute hazards including heavy rainfall, cyclones, windstorms, river and coastal floods and wildfires, and chronic hazards including heat stress, cold stress and drought. It ran three IPCC scenarios, SSP1-2.6, SSP2-4.5 and SSP5-8.5, over horizons of roughly one, five and twenty-five years, and rated each site low, medium or high for each hazard. That is competent, conventional and useful work. It is also, by design, a map of buildings.

What does it miss?

Everything that happens after the building survives. A facility can stay open through a monsoon as the road to it floods, the staff who run it cannot get in, the medicine in its fridge loses power, and the patients who depend on it lose three weeks of wages and skip the visit. The asset rating stays green. The programme loses a cohort.

Heat is the clearest case. The Lancet Countdown's 2025 India data sheet puts potential labour hours lost to heat in 2024 at 247 billion. Heat does not flatten a warehouse. It removes the people who work in it and the patients who travel to it, and a physical risk assessment has no column for either.

This is not a flaw in the method. It is the edge of its question. A physical risk assessment asks what climate does to the company. It does not ask what climate does to the link between the company's commitments and the people they were for. That second question is the one a health programme, an access team or a funder actually needs answered.

How do the two assessments compare?

On every axis that matters, they point in different directions. The table sets them against each other. The left column describes conventional practice as reflected in IFRS S2 and published assessments. The right column describes an access risk assessment as this practice runs it.

Read the last row. Neither assessment replaces the other. They answer different questions, and a company that runs only the first knows where its buildings are at risk and nothing about whether its health commitments are working in a bad year.

Why does the gap stay open?

Because each assessment belongs to a different team. Climate risk sits with sustainability and finance. Access sits with programme, commercial or medical teams. The two rarely score the same geography with the same data, and neither owns the question in between. The climate-access page puts it plainly: the two teams rarely score the same asset.

The data to close it usually exists already. Programme records carry the dates and places of every visit, refill and outreach round. The hazard data from the physical assessment carries the dates and places of every flood, heatwave and poor-air week. Nobody has laid one on top of the other. The climate risk hiding in your access data shows what turns up when someone does.

What does closing the gap look like in practice?

Run the physical assessment's hazard data forward, from the site to the people it serves. Three steps do it, on data the company already holds.

• Borrow the hazardsTake the sites and hazards the physical assessment already rated high, and the seasons they peak in. That is the shortlist. Nothing new needs modelling.
• Lay access data on topFor each shortlisted site, pull visits, refills, field activity and lost workdays by week for the last two or three years. Mark the hazard weeks.
• Name the breakWhere access fell in hazard weeks, record which condition failed: stock not Available, cost not Affordable, route not Reachable, or care not Continuous. That record is the access risk assessment.

That is the logic the Climate Access Stress Test, CAST, runs across a full climate-health year and four scored dimensions, with an output built to be reported and assured. The free self-screen, CAVS-S, gives a directional read on the same dimensions in a few minutes, from the organisation's own judgement rather than its data. It is the fastest way to find out whether the fuller version is worth running.

The physical risk assessment was the right first step. It tells a company where climate will hit. The access risk assessment tells it who pays for that, and whether the health commitments on its website survive a bad year. The argument for why that second question matters is in climate change is a healthcare story, the four conditions are defined in what is climate-access, and the standard terms sit in the glossary.

Questions worth asking after this

What is the difference between physical climate risk and access risk?

Physical climate risk, as IFRS S2 defines it, is risk to an entity from acute events, floods and heatwaves among them, or from chronic shifts in climate patterns, usually assessed asset by asset. Access risk asks whether the people a health commitment was meant to reach received care once climate disruption is counted, and it is assessed on the organisation's own programme records.

Does a TCFD or ISSB-aligned climate risk assessment cover healthcare access?

Not by design. Its unit of analysis is the asset, so it can show a facility is exposed to flooding without showing whether patients reached it during the flood. A company would need to run its hazard data forward onto access records to see that.

Do we need to replace our physical risk assessment?

No. The physical assessment supplies the hazards, sites and seasons that make an access assessment fast. The access assessment reuses that shortlist and reads it against visits, refills, field activity and lost workdays.

Abhijith Magal

Founder, Syntropy Earth. Nine years across two global pharmaceutical multinationals in patient access and commercial roles, with health-equity work alongside the WHO-Foundation and UNICEF. He works on climate-access: where climate disruption breaks the link between patients and care. More about Abhijith →

This page compares assessment methods. It is not advice on any specific disclosure, and it describes conventional practice rather than any one company's assessment in full.

Last updated: 24 September 2026