Quick Read
SPK CSMS1000:2026's IRO assessment is a five-step process that transforms stakeholder engagement and obligations analysis into a defined set of sustainability topics for governance and external reporting, with each step—from stakeholder analysis through materiality determination—audited separately. The assessment requires organisations to identify the full universe of actual and potential impacts, risks, and opportunities (not just those already being managed), trace stakeholder input through the process, and ensure that management and reporting priorities are approved by the governing body. Getting this assessment right determines whether a CSMS is substantively connected to the organisation's real sustainability footprint or merely manages the easiest-to-measure topics.
Executive Summary
The IRO assessment is the methodological heart of SPK CSMS1000:2026. It transforms the organisation's understanding of its obligations and context into a defined set of sustainability topics that the CSMS must govern, and a subset of those topics that must be externally reported. Getting this assessment right is the difference between a CSMS that is substantively connected to the organisation's real sustainability footprint and one that manages the topics that were easiest to measure.
This paper walks through all five clauses of the IRO assessment process — stakeholder analysis, IRO identification, IRO assessment, topic grouping, and importance and materiality determination — explaining what each requires, why it is structured the way it is, and what Speeki assessors examine in a certification engagement.
The IRO assessment is not a materiality survey. It is a systematic process of identifying what the organisation impacts, what it risks, and what it could gain — and then determining which of those things are significant enough to govern and report.
1. The Five-Step IRO Assessment Process
SPK CSMS1000:2026 Clauses 6.2 through 6.6 constitute a sequential process that builds from stakeholder engagement through to governing body-approved management and reporting priorities. Each step builds on the previous one, and each is audited separately.
Clause | Step and purpose |
|---|---|
6.2 | Stakeholder Analysis — identify who must be engaged and why, informed by the obligations register |
6.3 | IRO Identification — map the full universe of impacts, risks, and opportunities across operations and value chain |
6.4 | IRO Assessment — evaluate the significance of each IRO using documented criteria |
6.5 | Topic Grouping — cluster related IROs into coherent, manageable sustainability topics |
6.6 | Importance and Materiality Determination — determine what must be managed (important) and what must be reported (material); governing body approval |
2. Stakeholder Analysis — Clause 6.2
Stakeholder analysis in SPK CSMS1000:2026 is not a generic consultation exercise. It is a structured identification of which stakeholder groups must be engaged in the IRO assessment process, and for what purpose — informed by the obligations register.
The connection to obligations is direct. Impact-led frameworks (GRI, UNGP) require engagement with those most directly affected by the organisation's activities: communities, workers in the supply chain, people living near facilities. Financial materiality frameworks (ISSB) require engagement with capital providers: investors, lenders, analysts. Double materiality (ESRS) requires both. Supply chain due diligence obligations require engagement with supplier communities and affected people.
The stakeholder analysis must document: all material internal and external stakeholder groups; for each group, their sustainability-related interests and concerns; the nature of their relationship to the organisation's impacts and risks; the engagement mechanism and frequency; and how their views will be incorporated into the IRO assessment. The standard requires that stakeholder input is traceable through the assessment — assessors must be able to see how stakeholder views influenced the IRO identification and significance assessment.
3. IRO Identification — Clause 6.3
IRO identification is the process of mapping the full universe of the organisation's actual and potential impacts, risks, and opportunities. The key word is full. A common failure in sustainability assessments is to identify the impacts and risks the organisation is already managing and overlook the ones it is not. An honest IRO inventory should surface uncomfortable truths as well as comfortable ones.
3.1 The three IRO categories
Impacts are what the organisation does to people, society, and the environment. They can be negative (harm caused, directly or indirectly) or positive (benefit created). They can be actual (occurring now) or potential (could occur). They can be caused by the organisation's own operations, contributed to in combination with others, or indirectly linked through business relationships.
Risks are sustainability-related threats to the organisation's own financial performance, business model, or assets. Physical climate risk (asset damage, supply chain disruption), transition risk (stranded assets, carbon pricing exposure, regulatory change), nature-related risk, and social risks that could materialise as legal liability, reputational damage, or operational disruption.
Opportunities are sustainability-related prospects for value creation, cost reduction, or competitive advantage. Energy cost reduction from efficiency and renewables, new markets for sustainable products, preferential financing from ESG-linked capital, improved talent access, and reduced regulatory exposure.
3.2 Scope — operations and value chain
The IRO identification must cover own operations and the value chain. Value chain means upstream (raw material sourcing, component supply, logistics) and downstream (product use, end-of-life, distribution). For many organisations, the most significant impacts are in the value chain, not in their own operations. A company that sources from agricultural supply chains may have significant land use, water, and labour impacts that do not appear at all in its own operational footprint.
The standard requires explicit consideration of different time horizons: short, medium, and long term. Climate-related risks may not be significant in the short term but are highly significant over a 10-year or 20-year horizon. Biodiversity-related impacts may be diffuse and slow-moving but accumulate to significance over time.
4. IRO Assessment — Clause 6.4
The significance of each identified IRO must be assessed using documented criteria and thresholds. The assessment criteria differ by IRO type.
4.1 Assessment criteria by type
IRO type | Assessment dimensions |
|---|---|
Negative impacts | Scale: how severe is the harm? Scope: how many people or how much environment is affected? Remediability: how easily can the harm be reversed? Likelihood: for potential impacts, how probable? |
Positive impacts | Scale of benefit and scope of people or environment positively affected. Likelihood for potential positive impacts. |
Financial risks | Magnitude of potential financial effect (cash flows, revenues, costs, asset values). Likelihood of materialisation. Time horizon. |
Financial opportunities | Magnitude of potential financial benefit. Likelihood of realisation. Time horizon. |
The standard explicitly requires stakeholder relevance to be incorporated as an assessment dimension. For each IRO, the assessor must document the significance attributed to it by the stakeholder groups most directly affected, based on the engagement conducted under Clause 6.2. Where stakeholder views differ materially from the organisation's own assessment, both perspectives must be documented with a reasoned conclusion.
Critically, the assessment criteria and the thresholds applied must be documented. An assessment that concludes 'this impact is significant' without defining what significant means is not auditable. The thresholds determine what passes the significance hurdle — and the organisation must be able to demonstrate that those thresholds were applied consistently across all topics.
5. Topic Grouping — Clause 6.5
IROs are granular. A single sustainability topic — climate change, for example — may generate dozens of individual IROs: Scope 1 emissions from operations, Scope 2 emissions from purchased energy, Scope 3 emissions across fifteen value chain categories, physical climate risk to assets, transition risk from carbon pricing, climate-related regulatory risk, and so on. Managing and reporting at this level of granularity is impractical.
Topic grouping converts the IRO inventory into a manageable set of sustainability topics by clustering related IROs that: address the same underlying sustainability issue; affect similar stakeholders; or require similar management responses. The grouping methodology must be documented and the assignment of each IRO to its topic must be explicit.
The standard suggests using established topic taxonomies as reference starting points — the ESRS list of sustainability matters, the GRI material topics taxonomy, sector-specific frameworks — while adapting them to reflect the specific IROs identified for the organisation. The resulting topic list must be agreed by senior leadership before the importance determination proceeds.
6. Importance and Materiality Determination — Clause 6.6
The importance and materiality determination is the culmination of the IRO assessment process. It applies the significance assessment from Clause 6.4 to each sustainability topic to produce two distinct lists.
6.1 The importance determination
An important topic is one where the significance of the associated IROs is sufficient to warrant the organisation's sustained management attention, controls, and performance monitoring — regardless of whether the topic requires external reporting. Importance is the management threshold. It defines the scope of the CSMS.
Important topics must be addressed within the management system. This means: objectives are set for them (Clause 8.1); controls are established for them (Clause 10.4); they appear in the monitoring system (Clause 12.1); they are covered in the internal audit programme (Clause 12.5). An important topic that is not managed within the CSMS is a non-conformity.
6.2 The materiality determination
A material topic is one that crosses the disclosure threshold required by the applicable reporting framework identified in the obligations register. Materiality is the reporting threshold. It defines what the organisation must report.
All material topics are important. The reverse is not true. An organisation may manage 20 important topics — because managing them is the right thing to do given their significance — but only report externally on 12 that cross the relevant disclosure threshold. The remaining 8 are still actively governed by the CSMS. They are simply not individually disclosed in the sustainability report.
6.3 Governing body approval
The governing body must formally approve both the importance list and the materiality list before they are used as the basis for the CSMS scope, objectives, and controls. This is a mandatory requirement — the absence of documented governing body approval is a major non-conformity regardless of how well the assessment itself was conducted.
The approval requirement reflects the governance intent of the standard: the organisation's management priorities are a governance decision, not a technical determination made by the sustainability function alone. The governing body, in approving the lists, is accepting accountability for the management decisions that follow.
Speeki Meridian™ — Auditor Expectations
The IRO assessment is one of the most intensively examined areas in a Speeki Meridian™ Stage 2 assessment. Assessors examine multiple dimensions: Completeness: does the IRO universe reflect the organisation's actual footprint? Assessors will look for evidence that the identification process was not limited to what the organisation is already managing. High-risk sectors receive particular scrutiny — a mining company whose IRO assessment does not prominently feature community and biodiversity impacts is likely incomplete. Stakeholder traceability: assessors will select specific IROs and ask to see the stakeholder input that informed their identification and significance assessment. Input that cannot be traced to documented engagement is not credible evidence. Threshold consistency: assessors will test whether the significance thresholds were applied consistently. If two similar topics received different significance assessments, there must be a documented rationale. Governing body approval: assessors will request the governing body meeting minutes or equivalent documentation confirming formal approval of both lists. A verbal confirmation from the CSO that 'the board saw this' is not sufficient. Connectivity: assessors will check whether the importance list is reflected in the CSMS — are there objectives, controls, and monitoring mechanisms for every important topic? Topics on the importance list that have no corresponding management system elements are a finding.
Implementation Guidance
Run the IRO identification as a structured process, not a workshop. Begin with a desk-based inventory: what does the business do, what does it buy, what does it produce, where does it operate? Map each activity to potential impacts, risks, and opportunities using established reference frameworks (ESRS sustainability matters, GRI topics, sector-specific materials). Bring in stakeholders before the significance assessment, not after. The stakeholder engagement should inform what IROs are on the list, not just validate a list already prepared by the sustainability team. Document the significance criteria and thresholds before you start applying them — do not calibrate them to reach a desired outcome. The thresholds should reflect the standard's criteria and be approved by the sustainability function head before application. For the topic grouping, use a reference taxonomy (ESRS is the most comprehensive) as a starting point. Adjust to reflect your specific IROs — the taxonomy is a reference, not a constraint. Schedule the governing body approval as a substantive agenda item, not a reporting point. The governing body should discuss the importance and materiality lists, ask questions, and record its approval in the minutes. This is a governance decision, not a notification.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries. Speeki certifies organisations against SPK CSMS1000:2026 through the Speeki Meridian™ certification programme. Speeki is a certification body — it does not provide sustainability consulting or advisory services of any kind.
For current details of Speeki's accreditations, scope of certification, and service offerings, visit speeki.com. You can also ask Nicole AI on the Speeki website to find the information you need.
speeki.com | © Speeki Pte Ltd 2026