Why navigating corporate risk is more important than ever

By Nicholas Fitzroy, Risk Briefing Director, The Economist Intelligence Unit

All businesses face a range of potentially damaging political and economic risks but, due to the broad-based nature of risk analysis and the difficulty in defining its value, often devote insufficient resources to managing these risks. Yet political risk analysis is perhaps more important today than it has ever been. The combination of a series of major geopolitical disputes, like the US-China trade war, Brexit, or protests in Hong Kong, in an interconnected world, and the growing impact of reputational risk means that businesses find it harder now to avoid becoming collateral for political and economic risk events. Information is spread so quickly across social media by non-state actors that almost any event can become an issue for businesses if handled wrong.

The unrest currently afflicting Hong Kong perfectly encapsulates this. For firms operating in the territory there is clearly the risk of physical disruption, while an 8.6% drop in the Hang Seng Index in July-September also highlights the negative impact of the unrest on financial markets. Longer-term, should the protests intensify leading to greater violence, workers and businesses may look to shift to others Asian financial bus like Singapore or Tokyo.

However, another significant impact has come from how firms have responded to the protests on social media. The US’s National Basketball Association, for example, has taken significant losses following the Houston Rockets general manager, Daryl Morey, tweeting his support for protestors, which led to the withdrawal of Chinese sponsorship deals.

Apple and Google are among other companies to have been affected by the protests. In each case firms require an understanding of the geopolitical history of both China-Hong Kong ties and also China-US ties. With the trade war between China and the US ongoing, the value of clearly understanding geopolitical risks relating to the two countries could prove the difference between success and failure.

There is inevitably huge variation by country, industry, competition, or individual firms’ strategies as to which possible risk events matter more to which company. But there are four key areas that country-level risk analysis by The Economist Intelligence Unit can help.

First, it is vital to be able to identify risk events early and, to do this, experience and knowledge of a country, its market and geopolitical history is essential. A decent Hong Kong analyst would have known that there was a significant risk of major protests breaking out at some point, given long-standing tensions between the territory and Chinese authorities, and previous protests in 2014. But a step in aiding the process is for businesses to map financial exposure geographically (and that includes cyberspace). Which assets and operations are exposed in which countries? Is exposure bunched in particular countries?

Second, businesses need to evaluate each risk scenario. It is vital to understand what to look out for but inevitably resources need to be allocated and that means prioritizing some scenarios over others – a scale of some sort is required. We use an intensity scale made up of a probability and impact score. So currently the EIU rate the chances of the Hong Kong protests escalating into serious violence following involvement of China’s People’s Liberation Army as low probability (11%-20% likelihood of occurring in our view) but very high impact on businesses, if it did occur.

Third, those scenarios need to be monitored. The risk landscape is constantly evolving, and businesses need a system in place to stay on top of this. Regularly reassessing the probability and potential impact of scenarios is necessary. The risks at the top of the intensity scale should be changing over time. If they aren’t then it’s likely that the analysis is either not thorough enough or not regular enough. New scenarios should also be appearing on that intensity list.

In terms of the monitoring process, firms need to do two things well: obtain the right information and track the right triggers. There is a lot of noise out there and assessing too much information often leads to a clouding of the truth rather than illumination. Large swathes of news and data can give lots of signals telling us lots of opposing things. More effective is to monitor events with a few trusted but (importantly) varying sources—both external risk analysts and experts on the ground.

Then for each scenario, businesses should identify perhaps two or three triggers that could set a particular event in motion. The trigger for the Hong Kong protests was attempts by the local government to reform the territory’s extradition law but there are also some broad examples that reoccur with regularity. In more politically unstable countries, disputed elections and sharp food price spikes are examples of things that can lead to social unrest; currency devaluations often precede capital controls; major government infrastructure projects are always at risk of cancellation in countries that depend on a single commodity export for revenue during dips in commodity prices; and we’ve seen major geopolitical disputes and environmental protests increasingly act as useful triggers for successful cyber-attacks against government-linked entities. These are just top-level examples but would all act as a form of early warning system.

The last area that risk analysis can help firms, if it is done right, is in actually managing risk scenarios. Resources and strategies differ firm to firm, but understanding what will need to be managed is the same across industries. In other words, identifying precise areas of impact in each scenario allows businesses to make contingency plans. So, in the example of Hong Kong, for firms based in the territory, if things were to escalate, firms would need to consider relocating or at the very least form a new strategy around how they attract labour and investment. And, crucially, as the example of the NBA has shown, businesses would need to develop a clear strategy over how they communicate about any potential geopolitical event.

Risk analysis does not have all the answers, but it does certainly prove useful in the process of identifying, evaluating and monitoring the risks out there. And in the current climate, businesses cannot avoid country-level risks, so more than ever they need a system that helps manage them.