When Country Risk Said Monitor: Three Cases for Geostrategic Consequence-Chain Analysis

The IIA's 2026 APAC Risk in Focus report found that most organisations have not implemented leading practices for managing geopolitical risk, including retaining outside experts or establishing relationships with key government contacts.1 That structural gap is not unique to APAC, and it is not new. Three cases from 2022 to 2026 show the same failure appearing across different geographies, different risk categories, and different time horizons.

Three Geostrategic Events That Were Rated and Missed

Country risk analysis has a structural problem the industry rarely discusses directly: most commercial products are calibrated to protect the analyst from being wrong rather than to protect the client from being surprised. A rating of "elevated but manageable" is defensible from almost any outcome but tells a decision-maker nothing about when to act.

• Russia-Ukraine, February 2022. A significant number of corporate supply chain risk assessments for Eastern European operations described Russia-linked exposure as "elevated but manageable" or "subject to diplomatic resolution" as recently as November 2021. The structural failure was not the probability estimate. It was the absence of a decision chain connected to that estimate. Companies that had mapped the consequence chain from military mobilisation to border closure to logistics disruption to input material shortage had response options available in February 2022. Companies that had a country risk report had a document.
• Strait of Hormuz, March 2026. Mainstream corporate risk assessments had rated Hormuz closure as a tail risk, with probability estimates in the range of five to ten percent per twelve-month period. QatarEnergy declared force majeure on March 5, 2026. Within one week, natural gas prices had risen by approximately 50 percent2 and shipping insurance had reached five times pre-conflict levels.3 Companies with Gulf LNG supply contracts or energy input exposure had, in most cases, no pre-positioned response. The failure was not the probability estimate. A five to ten percent annual probability is not negligible for a catastrophic event. The failure was that the estimate never triggered a pre-positioned response plan.
• China rare earth controls, April 2025. Through 2024 and into early 2025, China's movement toward export controls was characterised in most corporate assessments as "trade tension requiring monitoring." When MOFCOM Announcement No. 18 took effect, European dysprosium prices reached six times Chinese domestic equivalent levels within weeks. The IEA's April 2026 analysis put up to $6.5 trillion in annual economic activity outside China at risk if the controls were fully enforced, with the automotive sector alone facing over $3 trillion in exposure.4 Response plans that should have been prepared against the scenario were, in most companies, absent.

What Each Case Has in Common

Three cases, three different geographies, three different risk categories: in each, the risk was documented, appeared in risk registers, and was still missed. The common failure was structural, not informational.

• No consequence chain. In each case, the risk was documented without a mapped pathway from the named event to a specific operational impact. The gap between "elevated but manageable" and "our logistics cost doubles and three input lines go dark" is the gap within which each disruption occurred. A qualitative risk rating answers the question of whether a risk exists. A consequence chain answers the question of what happens to the business when it moves.
• No watch indicators. None of these assessments included the observable signals that would tell a risk manager when the scenario was accelerating. In the rare earth case, MOFCOM regulatory filings and official media commentary were visible months before enforcement. A monitoring framework calibrated to those signals would have produced meaningful lead time. A risk rating does not.
• No decision timeline. Each scenario had a finite window in which pre-positioned responses remained viable. None of the assessments specified that window. Companies that had independently identified the decision point had options. Companies that had not were reacting in real time to a scenario they had nominally been tracking for months.

What Decision-Grade Geostrategic Intelligence Looks Like

The accountability standard implied by each of these three cases is not the current industry norm in commercial geopolitical intelligence. The standard that would have changed outcomes has four components, none of which appears in a conventional country risk rating.

• Named scenario with specific trigger. Not "interstate armed conflict" but the specific scenario, the named actors, and the defined conditions under which it materialises. Specificity is what makes the scenario testable at board level and the probability estimate challengeable rather than accepted.
• Calibrated probability with stated confidence. A probability estimate with a confidence level and the reasoning behind it. A five to ten percent annual probability for Hormuz closure is not a reason for inaction. It is a reason to have a pre-positioned response plan. The absence of that plan was the operational failure in March 2026, not the probability estimate itself.
• Observable watch indicators with escalation thresholds. The signals that confirm or disconfirm the scenario in real time, with defined thresholds that trigger an escalation review. In all three cases, these signals existed before the event. They were not formalised as monitoring inputs, and they did not produce the lead time they could have.
• Decision timeline. The point at which acting costs less than waiting. In each of the three cases, that point was identifiable in advance. It was not identified. The distinction between intelligence that describes geopolitical risk and intelligence that supports a specific decision is the distinction between risk awareness and risk management. The events of 2022 to 2026 have made that distinction consequential in ways boards are still working through.

Meridian Intell note: Country risk reports are written for no one in particular. They are calibrated to protect the analyst from being wrong, not to protect the client from being surprised. All three cases above have the same shape: documented, rated, and unactioned. Correcting that requires a different product, not a better reading of the same document.

Methodology: Analysis draws on IIA 2026 APAC Risk in Focus report, QatarEnergy force majeure declaration (March 5, 2026), MOFCOM Announcement No. 18 (April 2025), IEA rare earth supply chain analysis (April 2026), and DLA Piper and Reuters reporting on the March 2026 Hormuz events. All cited sources are publicly available.

Footnotes

1 Institute of Internal Auditors, 2026 Asia Pacific Risk in Focus Report, 2026. Available at theiia.org.

2 DLA Piper, Arbitration Matters Bulletin: June 2026, June 2, 2026. Natural gas prices rose by approximately 50 percent within one week of the QatarEnergy force majeure declaration of March 5, 2026. Available at dlapiper.com.

3 Reuters, Maritime Insurance Premiums Surge as Iran Conflict Widens, March 6, 2026. Shipping insurance reached five times pre-conflict levels within one week of the Hormuz disruption. Available at reuters.com.

4 International Energy Agency, Rare Earth Elements: Pathways to Secure and Diversified Supply Chains, April 2026. Finding: up to $6.5 trillion in annual economic activity outside China at risk if April 2025 MOFCOM controls were fully enforced; automotive sector faces over $3 trillion in potential exposure. Available at iea.org.

5 Yahoo Finance / The Daily Signal, The G7 Just Pledged to Break China's Rare Earth Grip, June 17, 2026. G7 pledged to cap China's share of global rare earth supply at 60 percent by 2030. Available at finance.yahoo.com.

About the author

Shekhar Attri, Co-Founder & CTO. An Indian Army Special Forces veteran with 21 years of service and a gallantry medal, Shekhar's corporate security advisory work spans Singapore, India, the Philippines, and the UAE, alongside PhD research on machine intelligence under incomplete information.