One Concern SEC Climate Risk Comments - FINAL

!

June 10, 2022

The Honorable Gary Gensler
Chairman
U.S. Securities and Exchange Commission
100 F Street, NE
Washington, DC 20549

BY ELECTRONIC SUBMISSION

RE: File No. S7-10-22

Proposed Rule, The Enhancement and Standardization of Climate-Related Disclosures
for Investors, Comments of One Concern, Inc.

Dear Chairman Gensler,

One Concern, Inc. praises the SEC’s leadership on climate-related risk disclosures, particularly physical risk, and we write in support of the proposed rule.

One Concern, a climate analytics technology company, enables organizations to focus on adaptation and resilience strategies by using newly developed resilience analytics for supporting risk selection, mitigation, pricing, scenario analysis, risk management and credit risk. Applying machine learning and state-of-the-art resilience modeling, One Concern helps organizations better understand and prepare for physical climate risks to make disasters less disastrous.

One Concern is responding to some, but not all, of the request for comments in the draft rule.

Introduction

Today, One Concern has mapped a total of 30 million properties, commercial and multifamily dwellings, to their dependencies (power, infrastructure and people) because the impact of weather and climate-related events will significantly affect dependencies, much more so than physical property damage. Weather and climate-related dependency risk is the future of risk. Taking a dependency risk-oriented approach encourages the development of a granular, comparable and consistent metric that translates direct costs caused by weather and climate-induced downtime.

By incorporating dependency risk into physical climate risk assessments, investors will have a consistent, measurable metric to assess weather and climate-related business disruption and translate its financial costs. For the first time, registrants will have a complete picture of climate risk and the financial risk exposure, helping them to reduce losses from climate impacts, as well as generate new revenue streams through innovative climate finance solutions.

Dependency risks take center stage

Storms, floods and other dangerous weather events are increasing in frequency and intensity, impacting business operations and increasing investors’ financial risk. According to Climate Central, “since 2003, 59 percent of weather-related outages were caused by storms and severe weather; nearly 19 percent by cold weather and ice storms; 18 percent by hurricanes and tropical storms; 3 percent by tornadoes, and 2 percent by a combination of extreme heat events and wildfires.”

Natural hazards damage buildings and disrupt lifelines, such as power grids, transportation networks, supply chains and people. Disrupted lifelines make up dependency risk. Dependency risk emanates from the growing infrastructure budget deficit, affecting operability, employees, customers and supply chains. Registrants are moderately or highly dependent on these dependencies to maintain operations and steady cash flow.

In 2001, the number of weather-related power outages was almost an order of magnitude less than in 2021. According to the Department of Energy, in 2001, the U.S. suffered one weather event, a flood, in Texas, causing 47 days of power downtime. Two decades later, the U.S. experienced 156 power outages associated with extreme weather events. The 2021 power outage crisis in Texas, which racked up $23 billion in losses due to a 13-day power blackout, demonstrates the vulnerabilities companies’ operations face due to dependency risk.

Over the years, due to limited investments in the U.S. infrastructure, climate change is rapidly exacerbating dependency risk for power, water and transportation networks relative to the direct structural risk to facilities. Moreover, data shows these risks will go up by another order of magnitude in the next decade, becoming a predominant business risk for most U.S. enterprises today. Dependency risk drives cash-flow impairment and business impact in most disaster scenarios.

Due to climate risk’s interconnected and systemic nature, investors should focus on climate scenarios, short-term weather events and long-term weather patterns, as well as weather and climate-induced dependency risk and the downtime it causes.

Downtime measures cash flow impairment

Today, catastrophe and climate modeling technology firms measure physical risk, focusing on the physical buildings, where the output is limited to measuring repair costs of the building. Then, on a bespoke basis, consulting firms consume that information and project financial impacts through a subjective analysis. However, there is no consistent methodology to link these metrics to actual business impact.

At One Concern, we have developed a new risk metric, One Concern Downtime Statistic (1CDS), for evaluating physical climate risk, measuring the degree of downtime a registrant faces due to perils – flooding, high wind, and earthquakes. For example, how long can a registrant’s operation be disrupted due to a direct hit to the facility or a power substation three miles out getting affected, or a supplier 100-miles out getting disrupted due to the port being down.

One Concern’s downtime statistic estimates the time a commercial property may not support normal business operations. It can be a function of direct physical damage to property and/or indirect impairment arising from damage to supporting lifeline networks (e.g., power, transportation, and communities). The statistic estimates a registrant’s financial losses due to operational downtime.

The downtime statistics measure resilience to increasingly frequent and severe weather and climate-change-driven catastrophic events. The statistic can also create benchmarks for analyses, disclosure, monitoring, and assessment of mitigation and adaptation efforts. A downtime metric can provide a reliable return-on-investment estimate for proposed mitigation.

The best way to project a cash-flow impairment to business operations is to quantify and disclose the impact of operational downtime emanating from lifeline networks.

Moreover, identifying lifeline downtime allows registrants to mitigate risk while achieving their sustainability goals. For example, suppose power downtime is four days, and a registrant only has backup power for a partial amount of time. In that case, a registrant can decide to backfill the remainder of the downtime with solar panels not to be solely reliant upon the grid.

Case study: Impact of business downtime on default probabilities

After converting cash-flow impairment to resilience adjusted valuation (RAV), loan-to-value (LTV) ratio was calculated. By using an off-the-shelf “probability of default” model on the LTV computed, the following plots for “probability of default” were generated for actual data on 5,000 commercial properties in the Miami region:

1. (Direct): Flood & wind risk considered for the direct property damage only.
2. (Direct RCP 4.5): Flood and wind risk considered only for the direct property (including the impacts of RCP 4.5).
3. (Integrated base): Flood and wind risk considered for the direct property & includes downtime from power & transportation dependencies.
4. (Integrated RCP 4.5): Flood and wind risk considered for the direct property & includes downtime from power & transportation dependencies (+RCP 4.5).

The results clearly outline that physical risk to commercial properties is driven by business downtime emanating from infrastructure network dependencies like power and transportation, which are the weak link in most regions in the U.S. (Note that the actual results may slightly vary if one were to customize the “threshold downtime” and “loss transformation function” based on occupancy / industry type.)

It is also clear that (for a high hazard geography like Miami) even a short planning horizon (three-year) requires one to consider the impact of dependencies on physical risk of commercial properties.

Note: The above conclusion shouldn’t come as a surprise since the number of weather related power outages in the U.S. has increased by almost an order of magnitude in the last two decades, and has increased by almost 70-90 fold in the last four decades. Similar trends can be found in transportation, and supply chain risk, making “dependency risk” a major driver for physical risk for commercial properties in the U.S.

Digital twin technology sets the foundation to measure downtime

At One Concern, we transform risk analysis with a digital twin of the underlying networks of lifelines. The digital twin facilitates visualization of the impacts of lifeline failure. Moreover, we forecast future events through forward-looking, predictive models rather than relying only on historical data to map a changing world.

We built a U.S. digital twin because prior to us building it; there was no visual representation of U.S. infrastructure – every electric pole, substation, crane, port, airport, road, highway and bridge. Combining real data with machine intelligence we generated a synthetic digital twin of U.S. infrastructure.

The digital twin, called One Concern Domino, is the foundational technology that makes downtime statistics possible. The digital twin maps lifelines within a 30-mile radius of a building. As a result, we can model physical, dependency and financial risks.

Data availability, advancements in machine learning, and catastrophe and climate modeling now make it possible to consistently, comparably and reliably assess climate risk at the property level; previously, this was inconceivable.

!

Caption: One Concern Domino™ models a climate-exacerbated 500-year flood of a single property asset and maps dependency downtime.

One Concern has synthesized trillions of data points to power our analysis, from the network level all the way down to the individual building. We have calculated 57 billion recovery curves, 7 trillion downtime data points, and 14 trillion damage recovery data points to understand the U.S.’ weather and climate-related dependency risks associated with extreme wind, flooding and earthquakes.

To ensure the insights are correct, our work is reviewed by a technical working group comprised of leading academic and scientific advisors from the U.S. and Japan. They present recommendations for our model updates, data approaches and validations.

In conclusion, we encourage the SEC to expand its definition of physical climate risk to reflect business disruption caused by physical damage and lifeline dependencies that power a registrant's operations. Investors will only know the actual value of a registrant's financial assets if companies disclose the potential implications of climate and weather catastrophes across properties and dependencies. Otherwise, extreme weather and climate change threaten and exploit financial risk for investors and registrants.

Sincerely,

Ahmad Wani,
CEO and Co-Founder, One Concern

Request for Comments

8. Should we require a registrant to disclose any climate-related risks that are reasonably likely to have a material impact on the registrant, including on its business or consolidated financial statements, which may manifest over the short, medium, and long term, as proposed?

If so, should we specify a particular time period, or minimum or maximum range of years, for “short,” “medium,” and “long term?” For example, should we define short term as 1 year, 1-3 years, or 1-5 years? Should we define medium term as 5-10 years, 5-15 years, or 5-20 years? Should we define long-term as 10-20 years, 20-30 years, or 30-50 years? Are there other possible years or ranges of years that we should consider as the definitions of short, medium, and long term? What, if any, are the benefits to leaving those terms undefined? What, if any, are the concerns to leaving those terms undefined? Would the proposed provision requiring a registrant to specify what it means by the short, medium, and long term mitigate any such concerns?

There is no one-size-fits-all planning horizon. We have been interacting with the Japanese government, and they believe different industries will require different planning horizons. Therefore, we recommend the SEC leave the term undefined for several years until it has enough data to establish planning horizon thresholds. Allow investors to set the bar during the early years of the rule. If the terms are left undefined, registrants should be required to indicate what timeframe they are using in their short, medium, long term disclosures to enable comparability.

9. Should we define “climate-related risks” to mean the actual or potential negative impacts of climate-related conditions and events on a registrant’s consolidated financial statements, business operations, or value chains, as proposed? Should we define climate-related risks to include both physical and transition risks, as proposed? Should we define physical risks to include both acute and chronic risks and define each of those risks, as proposed? Should we define transition risks, as proposed? Are there any aspects of the definitions of climate-related risks, physical risks, acute risks, chronic risks, and transition risks that we should revise? Are there other distinctions among types of climate-related risks that we should use in our definitions? Are there any risks that we should add to the definition of transition risk? How should we address risks that may involve both physical and transition risks?

The SEC should define climate-related risks as being linked to actual or potential negative impacts on a registrant's consolidated financial statements, business operations, or value chains. These climate-related risks include both physical and transition risks. Definitions should first identify the specific climate-related risks that increase the intensity of hazards, like hurricanes, earthquakes or wildfires, and then identify the perils (e.g., flood, wind, etc.) that generate physical risk for a registrant. Other linked risks, such as chronic risk, should also be identified. Risks specific to a registrant should be modeled and reported in a context where the cause (i.e., peril) of a downside event should be explicitly linked to all dependencies (e.g., physical infrastructure, power grids, transportation networks, supply chains, etc.) that facilitate normal business operations for a registrant. Other natural disaster risks, like pandemics, should be included in the definition of physical risk. Consistent, comparable quantification, which enables benchmarking of these risks, is now possible and should be required as part of these risk disclosures.

11. Some chronic risks might give rise to acute risks, e.g., drought (a chronic risk) that increases acute risks, such as wildfires, or increased temperatures (a chronic risk) that increases acute risks, such as severe storms. Should we require a registrant to discuss how the acute and chronic risks they face may affect one another?

Required registrant risk disclosures should include chronic risks that might arise from acute risks. These linkages should be integrated into the overall risk disclosures framed by climate-scenario-driven resilience models, which are increasingly becoming available to evaluate physical and transition risks.

13. If a registrant determines that the flooding of its buildings, plants, or properties is a material risk, should we require it to disclose the percentage of those assets that are in flood hazard areas in addition to their location, as proposed? Would such disclosure help investors evaluate the registrant’s exposure to physical risks related to floods? Should we require this disclosure from all registrants, including those that do not currently consider exposure to flooding to be a material physical risk? Should we require this disclosure from all registrants operating in certain industrial sectors and, if so, which sectors? Should we define “flood hazard area” or provide examples of such areas? If we should define the term, should we define it similar to a related definition by the Federal Emergency Management Agency (“FEMA”) as an area having flood, mudflow or flood-related erosion hazards, as depicted on a flood hazard boundary map or a flood insurance rate map? Should we require a registrant to disclose how it has defined “flood hazard area” or whether it has used particular maps or software tools when determining whether its buildings, plants, or properties are located in flood hazard areas? Should we recommend that certain maps be used to promote comparability? Should we require disclosure of whether a registrant’s assets are located in zones that are subject to other physical risks, such as in locations subject to wildfire risk?

We agree with the SEC’s recommendation to:

● Require disclosure from all registrants, including those that do not currently consider exposure to flooding to be a material physical risk; ● Require disclosure from telecommunications, electrical utilities, chemical plants, distribution centers and for-profit health care; ● Require disclosure of flood hazard area definition and the tools/solutions used to identify flood risk; ● Provide a list of maps to ensure comparability; ● Require disclosure of at-risk assets that are located in flood, earthquake and wildfire areas;

However, we discourage the usage of FEMA flood risk maps as they understate the risk. Today, many areas in the United States are susceptible to flooding; however, they don’t appear on flood maps because they are outside the 100-year floodplain. This is mainly because FEMA flood maps are antiquated, as found by the Department of Homeland Security’s Inspector General report. Moreover, the FEMA Flood Insurance Rate Maps undervalue flood risk due to climate change. For example, a 2022 report found, “84.5% of the damage reports were not within the agency’s high-risk flood areas. The majority, at 68.3%, were located outside of the high-risk floodplain, while 16.2% were in locations unmapped by FEMA.”

Another reason for discouraging FEMA maps is their limited exposure visibility on lifelines.

Instead, we recommend the SEC allow machine learning (ML)-enabled flood models. Unlike traditional GIS-based modeling software, which is 2-D, One Concern’s digital twin maps a multi-dimensional view of risk – direct building damage and the infrastructure a registrant depends on. Moreover, machine learning can account for more attributes that lead to flooding, such as land proximity to a river or stream, type of land cover, soil type, and precipitation. As a result, this approach will allow registrants to have a more accurate picture of the present and future flood risk.

The SEC should define a flood hazard area as any location where a building will face inundation and/or a location where lifelines are in jeopardy and, therefore, will paralyze a registrant’s operations. Commercial buildings are rarely in a flood zone, but electrical substations are located in places usually impacted by inland flooding.

15. Are there other specific metrics that would provide investors with a better understanding of the physical and transition risks facing registrants? How would investors benefit from the disclosure of any additional metrics that would not necessarily be disclosed or disclosed in a consistent manner by the proposed climate risk disclosures? What, if any, additional burdens would registrants face if they were required to disclose additional climate risk metrics?

The understanding of future physical risk is currently limited to locating buildings in certain hazard areas (e.g., flood zones). As a result, there is little to no knowledge of the vulnerable externalities on which registrants rely. Investors' limited visibility impacts their understanding of a registrant's financial risk. As climate change exacerbates how natural hazards adversely affect business resilience, there is increasing pressure to add downtime as a reporting metric. A downtime metric allows investors to quantify and benchmark risk and resilience.

One Concern defines downtime as the combination damage ratio of a property at a specified location and downtime of a property at a specified location arising from direct property damage and from damage to power networks, transportation infrastructure, and/or communities who use the property.

One Concern has developed One Concern Downtime Statistic (1CDS), which relies on curated data at the property level (ranging from commercial to community/residential data), which are used to characterize components of infrastructure lifeline networks (e.g., power, transportation) to reflect these networks' interconnectivity at a hyperlocal level and ‘at scale’ (to achieve global deployment) to ensure robustness, comparability, and commercial usefulness.

Historically, the inability to calculate climate risk exposure and its impact on future cash flow has caused widespread inaccuracies in asset valuation. However, requiring a downtime metric of both operational downtime and the downtime of dependencies would improve investors' holistic understanding of which property locations will be jeopardized by natural hazards – whether it be structural damage, disruptions to dependencies or both.

A downtime metric should be flexible — across multiple hazards and return periods and different climate scenarios, current and future — allowing each company and industry to determine their downtime threshold. Moreover, this downtime metric should consider that dependent lifeline networks (e.g., power, water, transportation) may fail or be disrupted in a natural disaster.

This dependency risk often represents a more significant physical risk for a registrant's business operations than the direct-damage risk to buildings, plants, or properties. Now that granular resilience metrics have become available — incorporating both direct damage probabilities and dependent lifeline network disruption probabilities — resilience risk can become part of a consistent, comparable risk disclosure for registrants and provide helpful information to relevant stakeholders.

Requiring a downtime statistic allows registrants to view impairment on cash flows and address valuation gaps and credit risks from misunderstood exposure to disasters, extreme weather, and climate change.

16. Are there other areas that should be included as examples in the definitions of acute or chronic risks? If so, for each example, please explain how the particular climate-related risk could materially impact a registrant’s operations or financial condition.

Acute risks should include wind and earthquakes.

21. Should we require a registrant to specify the time horizon applied when assessing its climate-related impacts (i.e., in the short, medium, or long term), as proposed?

The registrant should identify the time horizon to assess climate-related impacts. Otherwise, comparing disclosed risks over time and across registrants will be more challenging, leading to confusion when interpreting risk disclosures. Therefore, the time horizons identified by the registrant should also be specific (e.g., years into the future).

22. Should we require a registrant to discuss whether and how it considers any of the described impacts as part of its business strategy, financial planning, and capital allocation, as proposed? Should we require a registrant to provide both current and forward-looking disclosures to facilitate an understanding of whether the implications of the identified climate-related risks have been integrated into the registrant’s business model or strategy, as proposed? Would any of the proposed disclosures present competitive concerns for registrants? If so, how can we mitigate such concerns?

Similar to other material risk disclosures required of registrants, weather or climate-related impacts should be described in the context of downtime. A downtime metric enables quantified, consistent and comparable metrics that can be used to assess other risks, such as credit risk.

30. Should we require a registrant to disclose analytical tools, such as scenario analysis, that it uses to assess the impact of climate-related risks on its business and consolidated financial statements, and to support the resilience of its strategy and business model, as proposed? What other analytical tools do registrants use for these purposes, and should we require disclosure of these other tools? Are there other situations in which some registrants should be required to conduct and provide disclosure of scenario analysis? Alternatively, should we require all registrants to provide scenario analysis disclosure? If a registrant does provide scenario analysis disclosure, should we require it to follow certain publicly available scenario models, such as those published by the IPCC, the IEA, or NGFS and, if so, which scenarios? Should we require a registrant providing scenario analysis disclosure to include the scenarios considered (e.g., an increase of global temperature of no greater than 3 °C, 2 °C, or 1.5 °C above pre-industrial levels), the parameters, assumptions, and analytical choices, and the projected principal financial impacts on the registrant’s business strategy under each scenario, as proposed? Are there any other aspects of scenario analysis that we should require registrants to disclose? For example, should we require a registrant using scenario analysis to consider a scenario that assumes a disorderly transition? Is there a need for us to provide additional guidance regarding scenario analysis? Are there any aspects of scenario analysis in our proposed required disclosure that we should exclude? Should we also require a registrant that does not use scenario analysis to disclose that it has not used this analytical tool? Should we also require a registrant to disclose its reasons for not using scenario analysis? Will requiring disclosure of scenario analysis if and when a registrant performs scenario analysis discourage registrants from conducting scenario analysis? If so, and to the extent scenario analysis is a useful tool for building strategic resilience, how could our regulations prevent such consequences?

In general, scenario analysis should be required in this context. The framework and available scenario models should be disclosed. If a registrant does not use scenario analysis, the reasons should be disclosed. Given that granular metrics are now available, the difficulties that arise from subjective analyses are less relevant. The key point would be that the registrant transparently explains the methodologies used for scenario analyses. Pre-approved scenarios and methodologies could be identified. If pre-approved tools and approaches are not used, then specific methodology disclosure and validation criteria should be required. We recommend an approach to scenario analyses like the one employed in the banking industry. That is, define several scenarios that are required for disclosure. The registrant can run several non-disclosed scenarios on the same internal platform for use in decision-making. In this way, a targeted group of scenarios can become standard for registrant reporting and be used by stakeholders for physical-risk comparisons. Non-quantitative approaches should be considered out-of-compliance in this context.