The global economic consequences of Russia's invasion of Ukraine provided a stark demonstration of how a new era of geopolitical risk affects business in a multitude of different ways. 

The immediate post-Cold War years were memorably described by Francis Fukuyama as 'the end of history'. This was taken to summarise a world of largely uncontested US unipolarity in which geopolitical friction ebbed away in favour of an era of economic globalisation that saw many firms globalise their market footprint, operational support networks and supply chains. 

But as the consequences of Ukraine have shown, globalised business models are now exposed to a sea-change in geopolitical environment. Deteriorating US-China relations represent perhaps the most significant aspect of this for firms, given the significance of both countries in the global economy. Trade wars, sanctions and financial restrictions in key industry sectors like technology, financial services and strategic commodities have all come to the fore in recent years. 

Despite hopes that the US-China relationship would stabilise under Biden, after the friction of the Trump years, if anything antagonism is worse than before. Underlying these measures are growing concerns in the US and other capitals about China’s role in Hong Kong, increasingly militarised disputes over Taiwan and maritime sovereignty in the South and East China Seas. 

Diplomacy, military force and intelligence used to be seen by policymakers as the primary means of response, with economic and trade policy purposefully kept separate. But this distinction holds no longer: governments increasingly use geo-economic policy levers in pursuit of national security goals. As Janet Yellen, US Treasury Secretary, noted in a speech in April 2023, the US would not compromise on its national security objectives, "even when they force trade-offs with our economic interests."

The global risk list also goes further. In the Middle East, new tensions drive the kind of volatility long associated with the region, while lack of diplomatic progress on Iran's nuclear programme raises systemic risk in the region. The politics and fiscal arrangements of the Eurozone remain unsettled, while concern has risen in recent years about the state of domestic politics in the US. Emerging markets elsewhere in Asia, Africa and Latin America remain characterised by political and socio-economic challenges. 

And while the war in eastern Ukraine goes on, Russia's military activity will continue to influence global commodity prices and macroeconomic performance. 

When I first got into political risk work in the private sector, it was generally viewed as a peripheral issue that applied to some emerging markets issue and where, if a firm didn't operate in the market in question, risk exposure was not a concern. That paradigm has fundamentally changed. Geopolitical risk is now a core challenge across the largest developed economies and the global economy as a whole, and one where 2nd and 3rd order impacts from geopolitical events are transmitted through globalised markets to affect businesses wherever they may operate.

The Complex ESG Nexus

Geopolitics increasingly cuts across the ESG landscape for corporates too. It is generally well known that climate change is likely to drive scarcity across national borders of key resources like water or to generate destabilising migration flows. 

Less well appreciated are the causal links in the other direction. Measures such as the EU's Carbon Border Adjustment Mechanism, or the Inflation Reduction Act in the US, are regarded as thinly veiled protectionism in other capitals. The long-term stability implications of Net Zero for oil-exporting states in the Middle East, Africa or Latin America, or the political risks inherent in their attempts to diversify economic models away from fossil fuel dependency, are also not well understood. 

In addition, access to the raw materials needed in green technology, such as rare earths, are already the subject of geopolitical friction. As demand for technological solutions to climate change grows, so demand for these sensitive raw materials will also grow. Those firms involved in their acquisition, markets, or the increasing reliance that may accompany attempts to decarbonise their own supply chains, will therefore find geopolitics presents an increasing challenge.

Increasing impacts and complexity - thinking holistically

How does this backdrop affect business more broadly? Observers tend to think primarily of impacts on supply chains or perhaps enhanced sanction or cyber risks, with the corresponding assumption that managing these risks is therefore primarily a job for procurement, legal or compliance teams in firms.  

While these are certainly pressure points for some firms, the impacts go much wider. 

For one, geopolitical volatility, and the associated use of geo-economic policy measures like tariffs and investment restrictions, degrade the macroeconomic conditions on which corporate strategies are based, or foster acute instability in commodities, FX and other financial markets that track straight through to a firm's balance sheet, financial operating model and investor perceptions. The global macroeconomic and market consequences of the Ukraine invasion provided a definitive example of this. 

Geopolitical volatility can also disrupt key consumer or client segments for firms, while longer term political uncertainty undermines investment strategies. The increasingly complex crossover with corporate ESG agendas also creates additional reputational pressure on firms with key external stakeholders such as investors, regulators and NGOs. 

Geopolitics therefore has consequences for balance sheets and financial performance, as well as for operational and non-financial risk and control functions. Strategy and reputation may also be affected. 

The Risk Management challenge – stuck in the 1.0 world?

Many business and risk management leaders developed their careers in the period of growing globalisation ushered in by the end of the Cold War, a period essentially untroubled by geopolitical risk. But this can mean they lack the skills-set to respond to geopolitical instability and develop more sophisticated internal capacity. 

We find approaches within firms are characterised by some common challenges:

• Geopolitics is hard to measure, and 'what you can't measure, you can't manage'
• Firms can't control geopolitical risk at source. There is a corresponding tendency to say, 'we can't do anything about it, so there's no point considering it'
• Lack of skills-sets: very few in firms, whether C-Suite or in Risk functions, have any background or expertise in geopolitical issues
• Informal analytical approaches abound, often driven by the view of a chief executive or board chair, along the lines of, 'Putin would be mad to invade Ukraine because costs outweigh benefits for him, so we don't need to worry about this'
• A variation on this theme is 'I read the newspapers so I know enough about geopolitics'
• Despite the impacts of geopolitics being felt across business lines and control functions, a lack of internal coordination and holistic mitigation – often driven by functional silos in firms
• A lack of internal ownership of the issue, or a sense that 'this is something the board does' 
• Geopolitics often sits in a risk function's risk register or emerging risks framework, but little if any analytical work or active mitigation typically flows off these 
• National political sensitivities: geopolitical issues can be sensitive, especially within a multinational workforce or management team. This can lead to a reluctance to discuss geopolitical risk issues. Some national authorities, their regulators and other external stakeholders may also regard certain geopolitical issues as extremely sensitive, and this can inhibit internal risk management discussion as well. 

The net result is that geopolitical risk management for many firms is amateur-ish, fragmented, reactive and poorly thought through, often with substantial strategic and financial consequences – as illustrated by the multi-billion dollar losses many international firms experienced from their rapid Russia exits in 2022. 

How Can Internal Audit Help? 

In this context, how can internal audit teams provide boards with assurance that their organisation remains resilient to adverse external trends and shocks? This is not easy for IA teams to answer, partly because the issue is still relatively new and geopolitical risk management has neither been prioritised by risk management teams nor see as a traditional part of the corporate governance repertoire.

But given the escalation in geopolitical instability, with its many consequences, direct and indirect, for firms, providing assurance on these issues is increasingly important. The close links between geopolitical risks and environmental, social and governance issues also mean that ESG decision-making by firms may need a geopolitical risk lens and mean that integrated oversight and risk management are increasingly key.

Given the nature of the risk and its multifaceted, cross-functional corporate impacts, IA teams can start a process of building awareness by asking the following simple preliminary questions:

• Who in the organisation has responsibility for work on geopolitical risk, if anyone? 
• What specialist analytical resources do they draw on?
• How is this specialist expertise deployed in the organisation - towards what areas of decision-making and how?
• What remit does the risk function have on geopolitical risk and what activity and ongoing workflow runs off any mention of geopolitics in either risk registers or their emerging risks frameworks? 
• Do first line management teams routinely draw on specialist expertise in strategic decision-making where geopolitical risk may be a factor?
• Does our ESG decision-making take account of geopolitical factors?

IA teams can also seek out guidance from the board, and help shape board approaches and expectations on this topic. 

Going Further

This is a new area for IA teams and business teams more broadly, but further options and resources are available to help firms bring structure and method to their geopolitical risk approach. IA teams can consider deeper-dive training on scrutinising internal approaches on this issue, particularly in the run-up to any audit of their risk function.

They can also draw on our new board and risk function guidance on this area, ESG2, and consider exploring whether deployment of an internal geopolitical risk management framework may be a suitable recommendation to emerge from an audit. 

Conclusion – Not All Downside…

As the geopolitical environment becomes more 'competitive' - the euphemism used by diplomats and other political analysts to describe the trajectory of the geopolitical environment over the next two decades - business is increasingly affected. This is not all downside, however. Geopolitics can also generate commercial opportunities for agile firms with the necessary level of geopolitical 'nous' to identify and take opportunities with greater confidence. By recognising the changing political environment and asking new questions, IA teams can be critical enablers for adaptation in their firms on geopolitical risk. 

Find more details on ESG2 here. 

Derek Leatherdale is the Managing Director of GRI Strategies, leading work with companies across industry sectors to improve approaches to corporate governance and management of geopolitical risk exposures. He has developed the first geopolitical risk management framework of its kind for companies.  He is the co-author of 'The Extra G - ESG2', innovative leading practice guidance on geopolitical risk oversight and its integration with ESG issues for boards, their risk committees and risk functions, in association with The Risk Coalition