Geopolitical Risk: A Framework for Finance and Risk Teams

Geopolitical risk has moved from a topic finance teams occasionally referenced in board papers to one that shows up directly in margin forecasts, supplier contracts, and treasury decisions. Tariff shifts, sanctions regimes, and shifting trade alliances no longer sit purely in the domain of economists and news cycles, they're operational risks that finance and risk functions are increasingly expected to quantify, monitor, and plan around.

Why geopolitical risk is now a finance function issue

For years, geopolitical risk was treated mostly as a macro backdrop, something that shaped the broader economic environment but rarely required a specific line item in a risk register. That's changed. Trade policy shifts and tariff changes can move directly into cost of goods sold within a single reporting period, sanctions regimes can freeze counterparties and payment corridors overnight, and supplier concentration in politically sensitive regions can turn into a genuine cash flow problem with very little warning. Finance and risk teams that treat geopolitical developments as background noise rather than a quantifiable exposure are increasingly caught flat-footed when conditions shift.

The main categories of geopolitical exposure

A useful way to break geopolitical risk down for practical risk management is across five categories.

• Revenue risk. What percentage of sales depends on geographies or cross-border payment corridors that could become restricted or disrupted?
• Cost exposure. How much of cost of goods sold comes from imported inputs, and how concentrated is the business in single-source suppliers that are vulnerable to tariffs or trade restrictions?
• Treasury risk. Currency mismatches, liquidity availability in affected regions, and the stability of banking relationships that could be disrupted by sanctions or capital controls.
• Legal and contractual risk. Whether existing contracts have adequate force majeure clauses and pricing adjustment mechanisms to handle sudden geopolitical shocks.
• Technology and vendor dependency. Whether critical systems or data are hosted in jurisdictions vulnerable to cross-border restrictions, and how concentrated vendor relationships are by jurisdiction.

A practical operating model

Moving from awareness to genuine risk management means building a few concrete capabilities rather than just monitoring the news. Exposure mapping means documenting revenue by geography, supplier dependencies, and payment rail vulnerabilities so the business actually knows where it's exposed. Risk appetite thresholds set explicit limits, such as a maximum acceptable single-source supplier dependency or a minimum liquidity buffer. Stress testing models how margins would respond to specific shocks: a tariff increase, a freight cost spike, or a currency devaluation. Operational playbooks pre-develop alternative suppliers, shipping routes, and contract templates so the business isn't improvising under pressure. And governance and board reporting track key risk indicators tied to specific triggers, so escalation happens before a risk becomes a crisis rather than after.

Turning uncertainty into a managed capability

The point of this kind of framework isn't to predict geopolitical events, which is genuinely difficult even for specialists. It's to convert uncertainty into engineered capability: a business that has already mapped its exposure, tested its resilience to plausible shocks, and pre-built its response playbooks reacts faster and loses less value than one that starts from scratch once a disruption hits. This mirrors the broader pattern in our coverage of the "China plus one" supply chain strategy, where businesses that diversified supplier bases ahead of disruption were far better positioned than those that hadn't. It's also a recurring exam theme, covered in our guide to current issues in financial markets for FRM Part 2.

FAQ

Is geopolitical risk the same as country risk? They overlap but aren't identical. Country risk typically focuses on a single jurisdiction's stability; geopolitical risk is broader, covering cross-border dynamics like trade policy, sanctions, and shifting alliances that can affect multiple markets at once.

Can geopolitical risk actually be quantified? Not with precision, but exposure can be mapped and stress-tested. The goal is understanding sensitivity (how much a tariff or FX shock would affect margins) rather than predicting specific events.

Who should own geopolitical risk monitoring within a finance function? It typically sits across treasury, procurement, and enterprise risk, with board-level reporting to ensure escalation triggers are acted on quickly rather than getting stuck in a single department.

Geopolitical risk isn't going away as a theme, and finance teams that build the muscle to map, quantify, and stress-test their exposure are in a materially stronger position than those still treating it as background news.

Early warning signals worth tracking

A practical geopolitical risk programme doesn't try to monitor everything, it tracks a focused set of leading indicators tied to the business's actual exposure. For a business with significant cross-border trade, that might mean tracking proposed tariff legislation and trade negotiations in key markets, shipping and freight cost indices as an early proxy for supply chain strain, currency volatility in markets where the business holds material exposure, and sanctions list updates relevant to its counterparties and banking relationships. The goal isn't to react to every headline, but to have a short, well-defined watchlist that's reviewed on a regular cadence, so a genuine shift gets flagged quickly rather than getting lost among routine news noise.

Building resilience without overreacting

There's a real risk of swinging too far in the other direction, treating every geopolitical headline as an immediate call to action. The businesses that manage this well tend to separate genuine structural shifts, a new sanctions regime, a material tariff change, a breakdown in a key trade relationship, from short-term volatility that doesn't warrant a change in strategy. That distinction is exactly what a pre-built stress-testing framework is for: when a real shock does hit, the business already knows roughly how sensitive its margins and cash flow are to that type of event, rather than scrambling to model the impact from scratch while the situation is still unfolding.