Geopolitical threats race up the risk agenda

What to know:

Understand the nuances between mainline risks and risk drivers. Cybersecurity breaches are clear, direct risks, for example. But geopolitical risks can have significant indirect effects. The Russia-Ukraine War may not directly affect the security of, say, a US-based financial services company. But it has created myriad indirect macro risks in areas ranging from market access to sanctions-driven compliance concerns.

What to do:

Look for potential risk drivers in “megatrends”: large, often slower-developing risk arenas with broad reach, intricate interconnections, and the potential to create multiple new risk drivers across economic, political, and social spheres. Two megatrends with particular importance for the finance sector are:

• Global fragmentation: Nations are increasingly reducing economic ties, forming new alliances, and embracing protectionism. This shift has created a cascade of new risk drivers.
• Disruptive technologies: The rise of digital technologies like artificial intelligence and social media is upending societies, with the tech being used as political and economic weapons.

Key actions:

Effectively forecasting geopolitical risks won’t happen overnight. Start with a few relevant risk drivers, perform an initial analysis, and then optimize your framework based on those initial test cases. 

What to know:

While geopolitical threats have a different rhythm than the more quantifiable risks that financial institutions manage today, you don’t need a new framework to manage them. Existing risk framework methods can provide a strong foundation for geopolitical risks as well. But the focus will be less on predicting specific events and more on fostering adaptive thinking to handle the unexpected.

What to do:

Enhance existing risk management frameworks to include geopolitical factors by leveraging lessons learned from similar efforts around environmental, social, and governance—another risk monitoring arena with complex, indirect risk drivers. This expanded view can categorize risks based on exposure across multiple business areas. Key components of an enhanced framework include:

• A detailed list of risk drivers to support scenario analyses
• Risk profiles with standardized scoring methodologies
• Impact analyses that help prioritize risk mitigation efforts
• Assessments and recommended actions.

Key actions:

Expanding existing risk frameworks will require a collaborative cross-functional team and strong executive sponsorship.

What to know:

Updating your risk management strategy to incorporate geopolitical considerations is the starting point. But risks will continue to emerge and evolve in unexpected ways, and organizations need to adapt accordingly. For example, a company might start with purely defensive tactics to shield itself from geopolitical exposure, but then shift to offense to capitalize on newly opened windows of opportunity.

What to do:

Steps 1 and 2 above identify a company’s geopolitical risk drivers and establish a framework to analyze them. This overall strategy step integrates those insights into business planning and execution. Key steps for ongoing strategy optimization include:

• Craft geopolitical playbooks that move beyond conventional response mechanisms.
• Model risk impact analyses across multiple time horizons to understand short- and long-term implications. 
• Get guidance from both internal and external partners to expand expertise and reduce bias.

Key actions:

Developing a robust geopolitical risk strategy is an iterative process. Effective strategies are regularly reviewed, stress-tested, and optimized.