Geopolitical Risk Management: Shifting to ERM Teams – Risk.net

The escalating complexity of geopolitical risks is prompting a significant shift in how companies manage these threats. Traditionally handled by risk teams focused on political analysis and often reliant on hiring experts with government or military backgrounds, responsibility is increasingly falling to enterprise risk management (ERM) departments, according to recent observations and industry reports.

This transition reflects a growing recognition that geopolitical risks are no longer isolated events but are deeply intertwined with operational, financial, and strategic vulnerabilities. The appointment of retired General Mark Milley by JP Morgan as a senior advisor, while not unusual in itself, underscores this trend – a move signaling the elevation of geopolitical considerations within the financial sector.

The change isn’t merely about adding geopolitical expertise to existing risk functions; it’s about integrating these risks into a holistic, enterprise-wide framework. WTW’s Political Risk Survey 2024 reveals that 60% of companies have already enhanced their corporate processes to better manage political risks, moving away from reactive responses towards proactive planning. This suggests a broader understanding that geopolitical instability, economic sanctions, and policy shifts can significantly impact a company’s bottom line.

The recent experience with tariffs provides a stark example of this shift. As highlighted by Credit Benchmark data from June 2025, the sudden imposition of tariffs by the Trump administration exposed vulnerabilities in global supply chains, causing rapid deterioration in the creditworthiness of companies involved in US-exporting businesses. The firm responded by increasing the frequency of its credit updates from monthly to weekly to track the rapidly changing situation. Sectors like forestry, auto parts, real estate, and industrial engineering experienced notable credit downgrades. Specifically, the proportion of Canadian oil and gas producers downgraded in April 2025 rose to 6%, compared to an average of 1% in prior months. EU consumer goods saw downgrades jump from 3% to 7%, and US food and drug retailers from 5% to 10%.

This experience demonstrated that a single point of failure within a supply chain – “one name in your supply chain” as David Carruthers of Credit Benchmark put it – can trigger significant problems. The increased volatility also highlighted the need for more frequent and granular risk assessments.

The current geopolitical landscape further reinforces the need for a robust ERM approach. Key risks identified in 2024, according to WTW, include the ongoing conflict in Ukraine and its potential for escalation, the uncertainty surrounding numerous global elections – including the critical US presidential election – and the escalating rivalry between the US and China. Fluctuations in climate policy also present a significant challenge for businesses attempting to align with evolving regulations and sustainability goals.

Beyond simply identifying these risks, companies are increasingly focused on assessing the resilience of their technology systems to geopolitical threats. EY’s guidance emphasizes the importance of collaboration between risk, operations, and compliance teams to determine vulnerabilities and develop mitigation strategies. This suggests a move towards a more integrated and proactive approach to cybersecurity and data protection in the face of potential state-sponsored attacks or disruptions.

The shift towards ERM-led geopolitical risk management isn’t without its challenges. Successfully integrating these risks requires a fundamental change in organizational culture, a willingness to invest in data analytics and modeling capabilities, and a commitment to cross-functional collaboration. However, as geopolitical risks continue to proliferate and intensify, the benefits of a proactive and comprehensive approach are becoming increasingly clear. Companies that fail to adapt risk falling behind, potentially facing significant financial and operational consequences.

The need to look inwards, as suggested by recent analysis, is paramount. Understanding internal vulnerabilities and dependencies is crucial for building resilience in an increasingly uncertain world. The days of simply hiring external advisors to navigate geopolitical complexities are waning; the responsibility now rests with organizations to build internal capabilities and integrate these risks into their core business strategies.