External Risks Facing Businesses: From Event to Decision

At the same time, US trade policy continued its shift from temporary tariff measures towards a system in which tariffs are increasingly used as a standing instrument of negotiation, market access and pressure on supply chains. Yet for an individual company, a less visible change in the tariff regime or higher insurance premiums and freight rates may prove more consequential than the closure of one of the world's principal maritime routes.

This is why the occurrence of an event, in itself, tells us relatively little about the actual risk to a business. Companies today rarely suffer from a lack of information. Executives have access to news, economic statistics and industry data, as well as forecasts, sanctions lists, supplier reports and specialist monitoring from multiple providers. The Economist Intelligence Unit (EIU), however, points to a different problem: these signals come from disparate sources, may focus on isolated and unrelated issues, and do not by themselves explain what has changed for a particular market or decision. The central task therefore shifts towards determining the scale and timing of the impact, since not every global development calls for a response from a particular company.

The closure of the Strait of Hormuz illustrates why a general assessment of geopolitical risk is not enough. According to Oxford Economics estimates, substantial shares of global exports of several industrial commodities pass through the Persian Gulf, yet the consequences of disruption are distributed very unevenly. The limited ability to replace sulphur and sulphur-derived products at short notice raises costs for fertiliser producers and the metals industry, while the global helium market, despite facing a comparable external shock, benefits from substantial reserve stocks in the United States and Germany. In Northeast Asia, sulphuric acid prices more than doubled following the escalation, increasing the cost of processing nickel, cobalt and copper, as well as producing phosphate fertilisers. A single political crisis can therefore affect several industries through different channels, at different speeds and with different consequences.

Risk Depends on Business Vulnerability

For a company, what matters is not so much the scale of the external event itself as how that event interacts with the company's specific dependencies. A manufacturer may have almost no direct exposure to the Middle East, yet rely on a component whose cost depends on raw materials from the region. A logistics company may have an alternative route available but still face higher insurance premiums, freight rates or a shortage of vessels. Financial effects may emerge even faster through exchange-rate movements, pressure on equity markets and higher borrowing costs. In other cases, the impact appears later, working its way through energy prices, production costs or weaker demand in the end market. The same country or geopolitical risk therefore affects companies differently, and an average indicator for a country or sector may obscure precisely the differences on which the actual decision depends.

Against this background, US tariff policy provides an almost opposite example. There may be no single crisis event forcing management to convene an emergency team immediately. Yet S&P Global points to a deeper shift: trade restrictions are increasingly being used as an instrument of negotiation, with tariff levels linked to investment commitments, market-access conditions, production capacity and national-security considerations. Under this approach, an agreement on a lower tariff rate does not necessarily resolve the risk, because its terms may later be revised. As a result, companies are beginning to treat tariff changes as a normal operating factor, adjusting procurement and inventories before an outright ban or sudden increase in rates occurs.

This produces an apparently paradoxical situation. A high-profile event may barely change a company's position if its supply base is diversified, alternatives are available and it has sufficient resilience to absorb the shock. The gradual accumulation of regulatory changes, by contrast, can slowly alter the economics of an entire business line even though no individual decision appears critical. In maritime shipping, EU environmental regulation is already producing a similar effect, while persistent trade-policy risks create an additional layer of uncertainty. Compliance costs gradually become a permanent component of expenditure, with carriers passing some of them on to customers through surcharges and higher rates. For businesses, it is therefore more useful to track changes in the channels through which a risk affects them than to count alarming headlines.

This also raises the question of timing. If a company begins examining its own dependencies only after a route has closed, a supplier has been added to a sanctions list or a tariff has been imposed, some options may already have disappeared. But the opposite extreme can be equally costly, when every deterioration in the external environment leads to excess inventories, postponed investment or a switch of counterparty. Excessive caution creates costs of its own, just as underestimating risk does. Control Risks describes a similar problem in corporate security: a large number of warnings does not improve decision-making if employees do not understand which warnings relate to specific assets and operations, how reliable they are, and what level of response is proportionate to the threat.

Between Monitoring and Action

Assessing external risk often makes sense only when combined with an understanding of the acceptable level of risk and the conditions under which action is required. This does not necessarily mean setting a rigid numerical threshold. For one company, a sufficient reason to change a logistics route may be longer delivery times; for another, it may take a combination of worsening insurance conditions, the absence of a backup carrier and declining inventory levels. A political decision, a new tariff or a border closure is an input into such a system. The threshold itself depends on the company's own operating position. The greater the dependence on a single supplier, market or route, the smaller the external change required for it to become material.

Crisis-management practice demonstrates why these conditions are best defined in advance. During the US-Iran conflict, Control Risks combined data on strikes, border crossings, road conditions and airspace status with cyber indicators and information from employees on the ground. These inputs were treated as components of an overall assessment rather than as independent reasons to change a decision every day. Predefined scenarios and triggers made it possible in some cases to keep personnel in place even as individual indicators pointed to a deterioration in conditions, and in others to organise the gradual relocation of staff as available options began to narrow. In practical terms, a trigger serves a fairly straightforward purpose: it marks the point at which the previous assessment is no longer sufficient to justify maintaining the existing course of action.

With tariffs, the mechanism develops more slowly, but the principle remains the same. If a company understands what proportion of its costs depends on imports from a particular country, how easily a supplier can be replaced and how quickly the supply chain can be reorganised, another change in trade policy becomes a reason to reassess the situation rather than immediately reconfigure the entire supply chain. As tariffs rise, the range of affected goods expands or market-access conditions tighten, the initial assessment may change. But action is required when the cumulative effect exceeds acceptable cost levels or creates an unacceptable dependence on a single supplier, route or market.

It is also useful to distinguish between the threshold for action and the threshold for reassessment. New sanctions initiatives, a change in regulatory rhetoric or rising insurance premiums may provide sufficient grounds for a fresh analysis even though changing supplier would probably still be premature. Analytical work therefore does not end with a conclusion that the risk is «high» or «moderate». It requires an understanding of which assumptions underpin the current assessment and what could change them. This approach reduces the likelihood of two common errors – reacting too late to accumulated changes and repeatedly revising strategy in response to information noise.

More Data Cannot Eliminate Uncertainty

The growing volume of available information does not solve this problem by itself. Automated tools and artificial-intelligence systems can process in minutes a body of information that once required an entire working day, but greater processing speed does not guarantee the quality of the underlying picture. The EIU specifically highlights the risk of making decisions on the basis of incomplete, outdated or weakly corroborated information. A plausible conclusion based on an assumption that has already changed may be more dangerous than an obvious error, because it can flow from an analytical note into a budget or investment decision. This problem is particularly acute in external-risk analysis because political events, sanctions and regulatory changes rarely form the kind of clean historical dataset from which a stable pattern can simply be inferred.

Where the cost of a decision is high, the provenance and timeliness of information, as well as the ability to verify the link between evidence and conclusion, become important. The same principle applies without any artificial intelligence at all: a supplier's report, an official statement, international trade data and media reporting carry different evidentiary weight and may describe different parts of the same situation. When sources diverge in their assessments and forecasts, the disagreement itself can sometimes become a meaningful signal, but it still needs to be explained. And the greater the potential loss from an error – when entering a new market, restructuring a major supply chain or investing in infrastructure, for example – the greater the need to verify the assumptions underlying the decision.

At the same time, even a well-founded forecast remains an assessment made under a particular set of conditions. This can be seen in BMI's logistics forecasts for 2026. At the end of 2025, a gradual return of shipping through the Red Sea was considered a likely trajectory as long as favourable security conditions persisted, but the subsequent escalation between the United States and Iran upended that part of the initial outlook. At the same time, the forecast increase in underlying shipping costs driven by EU environmental regulation was broadly borne out.

This is why corporate analysis of external risk is better understood as a recurring cycle than as the production of a single forecast. Events alter part of the original set of assumptions, new information strengthens or weakens the previous assessment, and a decision remains valid for as long as its key assumptions continue to withstand scrutiny. In one case this may lead to a change of route or supplier; in another, it may justify maintaining the existing course while increasing monitoring. Taking no action can itself be a rational decision if the impact of the risk on the company remains acceptable and there are clear conditions under which that position will be reconsidered.

Five Questions for Practical Assessment

For practical purposes, this logic can be reduced to five questions:

• What has actually changed in the situation under consideration?
• Through what mechanism could that change affect our business?
• What are our actual dependencies, and what alternatives are available?
• What further change would require a decision, and what would require only a reassessment?
• What new information would confirm or challenge what we currently consider the most likely outcome?

Companies cannot eliminate political, economic or industry uncertainty in advance. They can, however, determine which part of that uncertainty is actually relevant to their operations, through which channels an external shock could produce operational or financial consequences, and where the threshold lies beyond which the existing decision is no longer acceptable.

Under this approach, monitoring ceases to be the accumulation of information, forecasting ceases to be an attempt to predict a single future outcome, and external risk becomes something that can be managed as new evidence emerges. For a business, the distance between an external event and its own decision threshold is often more important than the scale of the event itself.