Designing Geopolitical Risk Monitoring: Cadence, Sources, Handoff

TL;DR: Most corporate geopolitical risk monitoring is built around one review cadence, usually quarterly, while the sources feeding it move on at least three different clocks: continuous, event-driven and periodic. The fix is not more sources. It is naming which clock each source runs on and which person is authorised to escalate outside the calendar when one of them moves.

Key takeaways:

• GDELT's Event Database and Global Knowledge Graph refresh every 15 minutes, a genuinely continuous source with no scheduled pause.[^1]
• OFAC updates its Specially Designated Nationals list on no fixed timetable; a single 24 August 2026 release delisted Syria as a state sponsor of terrorism, delisted HTS, added new Iran-related designations and suspended two general licenses the same day.[^2][^3]
• In the 2026 What Directors Think survey of more than 200 public company directors, only 29 percent had incorporated geopolitical conflict into a crisis planning exercise.[^4]
• Just 9 percent of directors in that survey said they always receive real-time operational data between board meetings; 53 percent said sometimes, rarely or never.[^4]

Most geopolitical risk monitoring is built to catch what a board can review once a quarter. The sources feeding it were never built to wait that long. On the afternoon of 24 August 2026, the US Treasury's Office of Foreign Assets Control removed Syria's designation as a state sponsor of terrorism, delisted Hay'at Tahrir al-Sham from the Specially Designated Nationals list, added a fresh set of Iran-related designations, and suspended two general licenses, all in one release.[^2][^3] None of that was scheduled, and a compliance team running only a quarterly sanctions review would have learned about all four changes roughly two months late, after the affected general licenses had already lapsed.

Geopolitical Risk Monitoring Runs on Three Different Clocks

Treat every input as if it updates on the same rhythm and the monitoring system inherits whichever rhythm is slowest to notice. In practice, the inputs split into three groups, and each group needs a different owner and a different trigger for escalation.

• Continuous feeds move in minutes, not days. GDELT's Event and Global Knowledge Graph databases update every 15 minutes, translating and categorising breaking coverage close to real time.[^1] News wires and conflict-specific feeds run on a similar rhythm. A system that only checks these sources at a weekly stand-up is throwing away most of what they are built to do.
• Event-driven regulatory sources move on no calendar at all. OFAC has explicitly declined to commit to a fixed update schedule for the SDN list, adding or removing names "as necessary and appropriate."[^2] The 24 August bundle shows what that looks like in practice: a terrorism designation, a delisting and two license suspensions landing together, with immediate effect.[^3]
• Periodic synthesis moves on the calendar the company chooses. Quarterly board packs, annual risk registers and scheduled country reviews are genuinely useful for connecting dots across months, but they were never built to catch something that happened nine days ago. Forty-seven percent of directors in the 2026 What Directors Think survey named more frequent, structured risk discussion at the full-board level as the change they want most. That is a request to speed the clock up, not to add a bigger one.[^4]
• The mismatch is structural, not a failure of effort. Analysts are not missing signals because they are inattentive. They are missing them because the system routes a 15-minute source and a no-schedule source through the same quarterly gate.

The Cost Is Decision Latency, Not Missing Data

The US intelligence community solved a version of this problem decades ago by separating cadence from synthesis. The President's Daily Brief is produced daily, a continuous product built for a narrow set of recipients, distinct from the periodic, comprehensive assessments the same community also produces.[^5] Neither product tries to replace the other. The daily brief flags what changed; the periodic assessment explains why it matters over a longer horizon. Corporate risk monitoring rarely makes that separation. The quarterly deck is asked to do both jobs at once: flag what moved yesterday and explain what it means over the next two years.

What the record shows: in the 2026 What Directors Think survey, only 9 percent of directors said they always receive real-time operational data between meetings, and 53 percent said sometimes, rarely or never. Only 29 percent had built geopolitical conflict into a crisis planning exercise at all.[^4]

What we infer: boards are not under-informed about geopolitics in the abstract. They are informed on the calendar's schedule, not the event's, because the daily and the periodic product have never been separated into two workflows.

What we recommend: build the continuous product first, keep it short, route it to a named reader daily, and let the quarterly deck do the job it is actually good at, which is explaining pattern and trend rather than catching the next release.

This is a decision-latency problem before it is a geopolitical risk data problem. Adding another feed to an already-full quarterly review does not shorten the gap between event and decision. Changing who reads what, and how often, does.

What a Working Handoff Actually Looks Like

A monitoring system that never resolves into a decision is filing, not intelligence. Three choices matter more than which vendor supplies the feed.

Assign the continuous layer to a named role, not a shared inbox. That is the same practice we describe in what geopolitical watch indicators actually do inside a live risk process: a defined set of indicators, read by one person daily, with standing authority to escalate outside the quarterly calendar when a threshold is crossed.

Separate what is genuinely countable from what is judgment before either reaches the board pack, the same discipline covered in how to measure geopolitical risk. A monitoring system that reports everything as a number invites false confidence. One that reports everything as narrative invites the board to skip it.

Write the escalation threshold down before the first alert arrives, not while triaging one. The 24 August OFAC bundle is a reasonable test case. A company with Syria- or Iran-adjacent exposure that waited for its next scheduled review would have carried a suspended general license for weeks, not because anyone was careless, but because nobody had written down what should trigger a call outside the calendar.¹

Log the gap between event and decision, then check it. A short after-action note, timestamping an OFAC release or a GDELT alert against the moment someone actually decided something, turns "we felt slow" into a number worth managing down.

None of this requires a bigger source list. Fortius Intel's own briefs are structured around the same separation, a continuous layer and a periodic one, built as two different products rather than one document trying to be both.

Fortius Intel note: Before the next disruption, write down, in one line per source, whether it updates continuously, on no fixed schedule, or only because someone convened a meeting. If you cannot answer that in one sentence per source, the gap in your monitoring is not information. It is design.

This piece draws on GDELT Project technical documentation, US Treasury OFAC's Specially Designated Nationals list guidance and 24 August 2026 sanctions action, ODNI's public description of the President's Daily Brief, and the 2026 What Directors Think survey from the Diligent Institute and Corporate Board Member.

---

Footnotes

1. Office of Foreign Assets Control, "Removal of Syria's designation as a State Sponsor of Terrorism and Associated Sanctions List Updates; Iran-related Designations; Updates to Iran-related General Licenses," recent actions release, 24 August 2026, https://ofac.treasury.gov/recent-actions/20260824 (retrieved 3 September 2026). Source for: the 24 August 2026 bundle removing Syria's state sponsor of terrorism designation, delisting HTS from the SDN list, adding new Iran-related designations and suspending Iran General Licenses F and G effective the same day. ↩