and scope (own vs. supply chain sites

Another data point is needed to process and aggregate the analysis of supply chain sites (see Step 3C). Conceptually speaking, the biodiversity-related supply chain risk score per risk type, r, of a Firm, A, is the sum of the first-order risk scores per risk type (physical or reputational) of all n suppliers, weighted by a weighting factor, w, per supplier, i, which denotes the importance of the supplier-customer relationship: 5

Supply Chain Risk ScoreA,r =

n ∑

i=1 wi x 1st order risk score r,i

Aggregating the supply chain dimension, requires the following additional data point per (portfolio) company’s supplier next to location-specific supplier data (i.e., location of supply chain sites, industry classification and business importance of site): • Supplier-customer relationship: To distinguish between important and less important suppliers for the company of interest, information on the supplier-customer relationship is needed. This could be, for example, the revenue dependent on the supplier-customer pair.

This results in different data requirements subject to the user group and scope of the assessment (see Figure 8).

Figure 8: Required input data per user group (company vs. financial institution) and scope (own vs. supply chain sites)

COMPANIES OWN OPERATIONS

PER SUPPLIER FINANCIAL INSTITUTIONS PER PORTFOLIO COMPANY’S OPERATIONS

LOCATION OF COMPANY SITES INDUSTRY SECTOR PER SITE BUSINESS IMPORTANCE PER SITE

WEIGHT PER PORTFOLIO COMPANY PER PORTFOLIO COMPANY’S SUPPLIER

WEIGHT OF THE SUPPLIER-CUSTOMER RELATIONSHIP SAME DATA POINTS AS ABOVE PER SUPPLIER

Availability of required input data

For individual companies, most of the required input data typically exist in their data infrastructure and collection process. Thus, individual companies should collect and prepare the required location-specific data for their operational sites themselves instead of relying on proxy data (since companies are data issuers, compared to data users (TNFD, 2022c)). This data should be relatively quick for companies to collect and prepare in a format acceptable to the WWF Risk Filter Suite tools. However, location-specific data on the company’s suppliers are often not yet part of companies’ data infrastructure and collection processes and must therefore be collected additionally. Guidance B illustrates how input-output (IO) models can be of use in collecting these data. However, we strongly suggest that companies engage their key suppliers on the location-specific data required before relying on IO models, as data received directly from the supplier increases the accuracy of the assessment.

For financial institutions, the required location-specific data for a broad range of portfolio companies’ operational sites and supply chain sites is typically not part of their data infrastructure and collection process and must therefore be collected additionally. As the required data are often not reported by companies, Guidance A explains how location-specific information on companies’ operational sites can be collected at scale using existing data solutions and proxies (e.g., asset-level data sets; corporate structure data sets; etc.). However, we strongly suggest that financial institutions collect the required location-specific data directly from their portfolio companies to increase the accuracy of the assessment. As for companies, Guidance B provides support in assessing the supply chains of the portfolio companies. Given the above mentioned difficulties in the data collection and preparation process, WWF and Climate & Company developed additional methodological guidance for companies and financial institutions which are presented in the following subchapters:

• Guidance A: Collecting location-specific proxy data on portfolio companies’ operational sites • Guidance B: Collecting location-specific proxy supply chain data

GUIDANCE A: COLLECTING LOCATION-SPECIFIC PROXY DATA ON PORTFOLIO COMPANIES’ OPERATIONAL SITES

Guidance A explains which available data sources can be used by financial institutions as proxies for the required location-specific information on portfolio companies’ operational sites (i.e., location of company sites, industry classification and business importance of the site). In total, four potential data sources were identified and analysed that could serve as proxies in the absence of corporate disclosure: • Corporate disclosure data refers to location-specific information reported by companies directly to the financial institution or publicly. Ideally, financial institutions obtain the required location-specific company data from corporate disclosures, as these have the highest quality and accuracy. However, these data points still need to be systematically disclosed.6 • Asset-level data refers to data about physical assets, including attributes such as coordinates, asset type, production capacity, productivity and age, tied to ownership information. Commercial and open-source data providers typically offer this data (such as Asset Resolution or the

Spatial Finance Initiative (SFI)). • Corporate structure data, also referred to as corporate hierarchy or corporate ownership structure data, is typically a by-product of commercial data providers (e.g., Bloomberg or FactSet). It links the ultimate parent company to its subsidiaries, affiliates and assets, including information on their industry classification and location.

• City of headquarters data refers to location-specific information on a company’s headquarters (i.e., location and industry classification) and are available in commercial data sets. This implies that each company is assessed on only one location. • Disaggregated revenue data refers to revenue reporting by country (e.g., Firm A generates 20 per cent of its revenue in country X) and by industry (e.g., Firm A generates 10 per cent of its revenue in industry

Y). This data is provided by commercial data providers (such as Refinitiv, Bloomberg or FactSet).

Next to the individual data sources, also a hybrid approach was investigated: • Hybrid approach refers to a combination of different data sources that have been identified as potential proxies for company-reported location-specific information. As all data sources identified have different advantages and disadvantages, combining them in a hybrid approach offers the possibility to use the strengths and reduce or avoid the disadvantages of the individual data sources.