Corporate water risk reporting: the case of the CDP Water Security Questionnaire

Abstract

Purpose: This paper aims to investigate the foundations of corporate water risk reporting boundaries from an enterprise risk management perspective. To be more precise, the authors take the case of the CDP Water Security Questionnaire (WSQ) and explore the evolution of questionnaire itself as well as current corporate water risk reporting practices.

Design/methodology/approach: This paper draws upon enterprise risk management theory to explore the evolution of reporting boundaries contained in the design of the WSQ. This paper also performs an empirical study using the content analysis of a homogeneous sample of 470 companies comprising 1,880 responses to the WSQ for the period 2018–2021.

Findings: The analysis shows that despite the tendency for the questionnaire’s design to focus on risk reporting and to align with other water reporting initiatives, both questions and responses remain severely limited. More precisely, evidence suggests that corporate water risk reporting is still strongly focused on direct impacts. Furthermore, the majority of water risk direct impacts are only recognized and are not subsequently assessed in the reports. Thus, the reports fail to provide the full picture of corporate water risk across global supply chains along with, arguably, a lack of discharge of corporate responsibility.

Practical implications: Policymakers, corporations and academics may use these results to set out a future agenda for enhanced corporate water risk reporting.

Social implications: The effective use of water resources is vital to human survival, but only a limited number of studies have addressed this problem. This paper focuses on this highly important issue and concludes that the definition of corporate water risk reporting boundaries is relevant to improvements in water security.

Originality/value: To the best of the authors’ knowledge, this paper provides the first comprehensive assessment of corporate water risk reporting boundaries.