#1613 Enhancement of Risk Management (BURM) Skill to Incorporate Physical Climate Hazards, Infrastructure Interdependencies, and AI-Era Compute Risks change request pending

CR Raised in consultation with global GreenOps industry groups. This change request proposes a comprehensive revision of the SFIA Risk Management (BURM) skill for the upcoming SFIA 10 framework release. While SFIA 9 BURM adequately captures traditional operational, financial, compliance, and cybersecurity risks, it contains critical structural blind spots regarding emerging physical climate hazards and complex infrastructure interdependencies. As digital transformation accelerates alongside physical climate disruption, risk management professionals require explicit competencies to evaluate physical climate exposure, energy/cooling grid constraints, and multi-decadal asset vulnerability.

Problem Statement & Expert Industry Evidence

The SFIA 9 definition of BURM assumes a static background environment and facility-bounded risk perimeters. However, rigorous evidence from global research reports highlights five major structural gaps that necessitate an immediate skill update:

Structural Gap Analysis in SFIA 9 BURM

Risk Dimension	SFIA 9 BURM Baseline Focus	Emerging Industry Climate Reality
Historical Baselines	Focuses on static historical risk averages and routine compliance limits.	Escalating physical hazards across 8,800+ global data centres (flooding, extreme heat, storm surge, wildfire).
AI Risk Inversion	Prioritises Scope 2 carbon transition compliance & cybersecurity.	Physical climate hazards represent 93–94% of AI-era compute enterprise risk, while carbon transition drops to <10%.
Supply Chain & Utilities	Evaluates risks within internal operational/project boundaries.	x11 supply chain multiplier: 98–99% of business interruption risk operates upstream via power grid & utility failure.
Design vs Retrofit	Manages operational controls for existing active assets.	40–60% of 2035 compute built in 5 years; front-end adaptation preserves 30–39% value vs 2-3x retrofit costs.
Regional Dispersions	Generic risk categorisation across enterprise functions.	Extreme regional variation (e.g. Australia: Queensland 14.8% high-risk properties; NSW +347% damage risk by 2100).

Summary of Grounding Evidence from Key Industry Reports

1. 2025 Global Data Centre Climate Risk Report: Global Data Centre Physical Climate Risk and Adaptation Report: Evaluates nearly 9,000 data centres globally across eight physical hazards. Demonstrates severe insurance protection gap expansion and highlights that physical hazard impacts threaten immediate facility viability.

2. Economics of Climate Risk for AI-Era Capital: Converts physical and transition risks into quantifiable enterprise valuation impacts (ClimVaR). Highlights $388B in unpriced climate risk, an x11 supply chain interruption multiplier, and proves front-end adaptation restores 30–39% of exposed value at a positive net return.

3. Australia's National Climate Risk Assessment 2025: Demonstrates systemic infrastructure vulnerabilities, critical infrastructure interdependencies (energy, transport, communications), and localised risk surges (+478% nationwide data centre damage risk by 2100).

Proposed SFIA 10 Skill Definition & Guidance Notes

The following section provides the exact wording updates for the BURM overall definition and guidance notes for SFIA 10.

Updated Overall Definition

SFIA 10 Proposed BURM Definition:
Planning, implementing, and governing processes for managing enterprise risk, physical climate hazards, operational vulnerabilities, and infrastructure interdependencies, aligned with organisational strategy, multi-decadal asset horizons, and governance frameworks.

Updated Guidance Notes & Key Activities

The revised guidance notes expand the scope of risk management from internal operational/IT systems to physical assets, supply chain networks, and climate scenarios:

· Physical Hazard Classification: Identifying, classifying, and prioritizing operational, cyber, transition, and physical climate risks (e.g. extreme heat, riverine/surface flooding, coastal inundation, wildfire, water stress) using forward-looking CMIP6/RCP climate pathways.

· Infrastructure Interdependencies: Evaluating upstream supply chain, power grid stability, telecommunications resilience, and shared utility interdependencies (accounting for the x11 business interruption multiplier).

· Financial Risk Modeling: Quantifying direct physical asset damage and indirect operational downtime using financial valuation frameworks such as Climate Value at Risk (ClimVaR).

· Capital & Design Integration: Integrating physical hazard data into front-end capital allocation, facility siting, engineering design specifications, and multi-decadal asset horizons (15–25+ years).

· Insurability & Governance: Developing adaptive risk strategies to navigate shifting insurance market availability, policy exclusions, and expanding climate disclosure mandates.

Proposed SFIA 10 Level Descriptors (Levels 2 to 7)

To ensure complete coverage across all responsibility levels, the following table details the current SFIA 9 baseline against the proposed SFIA 10 enhanced descriptors:

Level	SFIA 9 Baseline Descriptor	Proposed SFIA 10 Enhanced Descriptor
Level 2 (Assist)	Assists in collecting and reporting data to support risk management activities under routine supervision.	Assists in collecting and reporting risk data, including operational metrics, environmental telemetry, localized climate hazard exposures, and physical asset logs, under routine supervision. Helps maintain baseline risk registers.
Level 3 (Apply)	Undertakes basic risk management activities; maintains documentation of risks, threats, vulnerabilities, and mitigation actions.	Undertakes basic risk management activities across operational areas. Maintains documentation of operational threats, physical climate hazards, environmental vulnerabilities, and mitigation controls using standard hazard maps and risk templates.
Level 4 (Enable)	Carries out risk management within a specific function, technical area, or project of medium complexity; assesses impact/probability and mitigation strategies.	Carries out risk management within a specific function, technical area, project, or facility. Identifies operational, technical, and physical climate risks (including extreme temperature, cooling stress, and local flood risks). Assesses probability/impact and engages domain specialists (hydrologists, energy experts) to formulate mitigation strategies.
Level 5 (Ensure / Advise)	Plans and implements complex risk management activities within a technical area, project, or programme; establishes reporting mechanisms aligned with governance.	Plans and implements comprehensive risk management activities within complex functions or infrastructure projects. Evaluates complex physical climate hazards, cooling/power grid interdependencies, and upstream supply chain vulnerabilities. Incorporates asset-level Climate Value at Risk (ClimVaR) into risk assessments and advises on climate-resilient siting and design trade-offs.
Level 6 (Initiate / Influence)	Plans and manages organisation-wide risk management processes; aligns with business risk appetite and governance frameworks.	Plans and manages organisation-wide risk governance. Integrates tools for stress-testing physical climate hazards, systemic supply chain disruptions, and financial exposure. Balances enterprise risk appetite against shifting climate baselines, insurance availability, and regional infrastructure fragility. Guides strategic capital allocation for climate resilience.
Level 7 (Set Strategy)	Establishes organisation-wide risk management strategy and risk appetite in alignment with strategic objectives; allocates resources.	Establishes the organisation's overarching risk management strategy and risk appetite, incorporating multi-decadal asset horizons (15–25+ years), systemic climate resilience, and macroeconomic exposure. Directs capital allocation to protect multi-billion-dollar infrastructure, ensure front-end climate adaptation, and satisfy global climate disclosure frameworks.

Business Rationale & Economic Impact Analysis

Updating the BURM skill delivers significant strategic, operational, and financial value across digital infrastructure ecosystems:

1. Quantifying Hidden Balance Sheet Risk: Unpriced climate risk currently threatens 38.3% of global data centre enterprise value ($388B). Equipping risk professionals to measure ClimVaR ensures accurate balance sheet representation and capital allocation.

2. Aligning Risk Management with AI Infrastructure: As compute shifts to high-density AI workloads, 93–94% of risk shifts to physical channels. Upgrading BURM prevents operators from relying solely on Scope 2 carbon offsets while physical cooling and power systems remain vulnerable.

3. Mitigating Supply Chain Interdependencies (x11 Multiplier): Because 98–99% of business interruption risk originates upstream in shared utilities and supply chains, the expanded BURM skill enforces cross-dependency audits beyond immediate facility walls.

4. Capturing High Net-ROI Front-End Adaptation: Proactive, front-end climate-informed siting and structural adaptation preserve 30–39% of exposed enterprise value at a fraction of the cost of post-hoc retrofits (which cost 2–3x more).

Cross-Skill Alignment within SFIA Framework

To maintain framework coherence, the enhanced BURM skill interfaces directly with several complementary SFIA capabilities:

· Sustainability (SUST): Provides physical asset climate risk inputs to inform corporate sustainability strategies, carbon reporting, and environmental compliance.

· Continuity Management (COPL): Integrates climate hazard scenario testing into disaster recovery, business continuity planning, and systemic grid outage response.

· Solution Architecture (ARCH): Feeds physical climate constraints (ambient cooling degradation, flood barriers, thermal limits) into high-density digital infrastructure designs.

· IT Contract Management & Supplier Management (ITCM / SUPP): Embeds climate resilience requirements, grid availability SLAs, and physical supply chain risk audits into vendor contracts.

Download: Assessment Brief- SFIA 9 Risk Management [BURM] vs. Emerging Climate Risks.pdf (122.0KB)

Proposed change applies to Risk management

Current status of this request: pending