Building a Real Geopolitical Risk Assessment: The Inputs Most Companies Skip

TL;DR: A credible geopolitical risk assessment runs on sector-specific data sources and a mapped consequence chain, not a single country rating. Sri Lanka held a CCC sovereign grade for months before its 2022 default, the same lag that catches any company treating one score as its full picture.

Key takeaways:

• Fitch cut Sri Lanka's sovereign rating to CC on December 18, 2021, and S&P held it at CCC on January 12, 2022, four months before the country missed a $1.25 billion bond payment and was cut to selective default on April 25, 2022.
• CFOs rated geopolitical risk 79 out of 100 in Deloitte's Q1 2026 CFO Survey, the highest score on record and the top external risk in 15 of 17 quarters since Russia's invasion of Ukraine.
• OFAC confirms its Specially Designated Nationals list carries no predetermined update schedule, so a periodic compliance review misses exposure a live check would catch.
• 84% of companies surveyed for WTW's Political Risk Survey Report 2026 are preparing for or considering structural independence of business regions, a response no single country score can inform.

Fitch downgraded Sri Lanka's sovereign rating to CC on December 18, 2021.[1] S&P held the country at CCC as late as January 12, 2022.[2] Four months later, after Sri Lanka missed a $1.25 billion bond coupon payment due April 18, S&P cut the rating again, to selective default, on April 25, 2022.[3] A company using that single letter grade as its geopolitical risk assessment had the same information as any bondholder and none of the operational detail: which contracts would stop clearing, which suppliers would run short of fuel, which shipments would sit at customs while the country's reserves ran out.

Geostrategic Risk Assessment, What Belongs in One

A country rating tells a treasury desk whether a government is likely to keep paying bondholders. It says nothing about whether a specific factory, port contract, or supplier relationship survives the same crisis. A credible assessment runs on four inputs most companies never assemble in one place.

• A named data source stack, not one feed. GDELT monitors global news media in more than 100 languages, updates daily, and holds more than a quarter-billion event records across 300-plus categories dating to 1979, a scale no single rating agency's country score approximates.[4] Compliance sources carry their own logic: OFAC's Specially Designated Nationals list, the EU Official Journal, the US Federal Register, and the Commerce Department's Entity List each update on their own legal timetable, and none substitutes for the others.
• A sector taxonomy, not a country label. The same country score covers a bank, a mine, and a logistics operator equally, though a currency crisis, a licence freeze, and a port closure hit each on a different clock.
• A quantification method finance can use. "High, medium, low" does not convert into a capital allocation decision. A usable assessment prices exposure the way a treasury team already prices any other risk: in dollars, against a timeframe.
• A mapped consequence chain. What changes at 30, 90, and 180 days after the triggering event, tied to the company's own contracts and suppliers, not the sovereign's bond schedule.

Geostrategic Assessment, Why Generic Frameworks Fail

Sri Lanka's own timeline shows why a rating alone cannot do this work. Fitch and S&P signaled distress for months before the April 2022 default, and both agencies were measuring the government's capacity to service its bonds, not the operational conditions a company on the ground already faced: fuel queues, rolling power cuts, and import restrictions that predated the formal default by weeks.[1][2][3] None of that showed up as a change in letter grade until the missed payment forced one. A single global feed built to answer sovereign creditworthiness ends up used to answer operational exposure, and the gap between the two is where the surprise lands.

The same pattern shows up in compliance. OFAC confirms there is no predetermined timetable for updating its Specially Designated Nationals list; names are added or removed "as necessary and appropriate."[5] A company that screens counterparties on a monthly or quarterly cycle is assuming the list moves on a calendar it does not follow.

Geostrategic Assessment, What to Demand

The demand side is already shifting. CFOs rated geopolitical risk 79 out of 100 in Deloitte's Q1 2026 CFO Survey, the highest score on record and the top external risk in 15 of the 17 quarters since Russia's invasion of Ukraine.[6] In WTW's Political Risk Survey Report 2026, drawn from 57 companies and 15 in-depth interviews, 61% named tariff impact the hardest exposure to manage and 84% said they are preparing for or considering structural independence across business regions.[7] Neither response comes from a country score. Both require sector-specific, consequence-mapped analysis of a company's own footprint.

A company deciding whether to build or buy that capability should require three things: named data inputs it can check against the primary list itself, a sector-specific taxonomy instead of a country-wide label, and a consequence chain stating what changes in its own operations at 30, 90, and 180 days. A single score without those three elements is a starting point, not a finished geopolitical risk assessment.

Fortius Intel note: Fortius Intel's Intelligence Brief runs on the same four inputs this piece describes: a named data source stack including GDELT, OFAC, the EU Official Journal, the Federal Register, and the BIS Entity List, a sector-native taxonomy, and a 30/90/180-day consequence chain tied to the client's own footprint, not a country letter grade.

Methodology: this article draws on rating actions from Fitch Ratings and S&P Global Ratings as reported by Business Standard, OFAC's published FAQ on Specially Designated Nationals list update frequency, the GDELT Project's public data specifications, Deloitte UK's Q1 2026 CFO Survey, and WTW's Political Risk Survey Report 2026.

---

Footnotes

1. "Fitch downgrades Sri Lanka's sovereign rating to 'CC' from 'CCC'," Business Standard, December 18, 2021. https://www.business-standard.com/article/international/fitch-downgrades-sri-lanka-s-sovereign-rating-to-cc-from-ccc-121121800232_1.html
2. "S&P lowers Sri Lanka rating to 'CCC' citing greater sovereign default risk," Business Standard, January 12, 2022. https://www.business-standard.com/amp/article/economy-policy/s-p-lowers-sri-lanka-rating-to-ccc-citing-greater-sovereign-default-risk-122011201226_1.html
3. "S&P lowers Sri Lanka's sovereign rating to 'Select Default' grade," Business Standard, April 25, 2022. https://www.business-standard.com/article/economy-policy/s-p-lowers-sri-lanka-s-sovereign-rating-to-select-default-grade-122042500975_1.html
4. "The GDELT Story: About the GDELT Project." https://www.gdeltproject.org/about.html
5. "FAQ 20: How often is the SDN list updated?" Office of Foreign Assets Control, US Department of the Treasury. https://ofac.treasury.gov/faqs/20
6. "UK finance leaders' confidence drops as geopolitical risk dominates agenda," Deloitte UK CFO Survey Q1 2026, April 2026. https://www.deloitte.com/uk/en/about/press-room/uk-finance-leaders-confidence-drops-as-geopolitical-risk-dominat-april-2026.html
7. "Despite Middle East tensions, tariffs remain top political risk concern, according to latest Willis Political Risk Survey," WTW, May 12, 2026. https://www.wtwco.com/en-us/news/2026/05/tariffs-remain-top-political-concern-according-to-latest-willis-political-risk-survey