Building a Geopolitical Risk Assessment Framework That Actually Runs Each Quarter

TL;DR: A geopolitical risk assessment framework only works if it survives a second and third run. Most companies built one heat map, presented it once, and never rescored it against what actually happened next. A runnable framework scores exposure once, rescores trajectory every quarter, and names in advance which score movement triggers which decision.

Key takeaways:

• A January 2026 study of 56 multinational executives found fewer than one in five companies had a dedicated geopolitics function, and most called their own posture reactive rather than structured.
• In 35 percent of companies surveyed by Deloitte in November 2025, no individual, group or function was assigned to manage the response once a geopolitical risk was identified.
• Political risk insurers already reprice country exposure with more granularity than most corporate risk registers, tightening capacity on specific countries while holding rates flat elsewhere.
• A framework that cannot name, before the quarter starts, which decision follows which score movement will be rebuilt from scratch next year instead of rerun.

On 12 January 2026, Boston Consulting Group, IMD and the World Economic Forum published a study built on 56 interviews with executives at multinational companies. Fewer than one in five had built a dedicated geopolitics function, and the report said plainly that routines connecting geopolitical developments to business metrics and actions "remain rare."[^1] A framework does not fix the staffing gap. It fixes the second problem, the one that leaves a risk assessment sitting in a slide deck nobody opens again until next year's version replaces it.

Why Annual Reviews Miss What Quarters Catch

Most enterprise risk processes still treat geopolitical exposure the way they treat a market-entry review: once a year, at budget season, filed next to forty other line items. That cadence assumes the risk moves at the pace of the corporate calendar. The evidence says otherwise.

• Board attention is split, not absent. Deloitte's November 2025 survey of 85 public and 21 private companies found 56 percent fold geopolitical risk into other board agenda items and 32 percent treat it as a standalone item.[^2] Neither figure says how often either format actually recurs, and that gap is the problem: a standalone agenda item reviewed once a year is still an annual process wearing a different label.
• Ownership is fragmented at the point that matters most. Of the companies that identified where formal oversight sits, 34 percent placed it with the audit committee, 25 percent said the full board alone, and 22 percent with a risk committee.[^2] More telling: in 35 percent of respondent companies, management responsibility for acting on a flagged risk was not assigned to any individual, group or function at all.[^2]
• The risk itself moved faster than most review cycles in 2025. The Allianz Risk Barometer 2026, drawn from 3,338 respondents across 97 countries, put political risk and violence in seventh place among all business risks, with war perils cited by 53 percent of respondents, up from 48 percent the year before, and business assets inside active conflict zones up 22 percent.[^3]

The Scoring Logic Behind a Runnable Geopolitical Risk Assessment Framework

A framework earns the name only if it survives being run twice. Most do not, because they are built as a one-time scoring exercise: list every market and supplier relationship, assign a probability and an impact number to each, plot the result on a heat map, present it, and move on. The heat map is accurate the day it ships and stale within a quarter, and nobody goes back to redraw it, because redrawing means repeating the entire exercise from a blank sheet.

The fix is to separate two things the heat-map method fuses into one number. The first is exposure: how much of revenue, headcount or supplier dependency actually sits inside a given market or relationship. Exposure does not move often, so it gets scored once, using inputs a separate assessment already has to gather. The second is trajectory: whether that exposure is worsening, stable or improving compared with the last scoring cycle. Trajectory is what moves quarter to quarter, and it is the only piece that needs to be rescored on a running basis. An ordinal scale from minus two to plus two, applied consistently, beats a fresh probability estimate invented from scratch each cycle, because the second question a working framework has to answer is not "what is the risk level" but "what changed since we last looked." Political risk insurers already price this distinction in practice: Willis Towers Watson's October 2025 market outlook found underwriters pushing 2026 renewal rates up by as much as 10 percent in specific countries, tightening capacity in China, Taiwan, Sudan and parts of West Africa, while holding other markets close to flat.[^4] That is a trajectory judgment made every renewal cycle, not a from-scratch model rebuilt each January.

Turning a Quarterly Score Into a Decision, Not a Report

None of this matters if a score movement does not lead anywhere. The Deloitte survey found the actions companies actually take once a geopolitical risk is flagged: 78 percent run scenario planning or update a crisis management plan, 72 percent adjust budget or expenses, and 56 percent each reevaluate strategy or diversify a supply chain.¹ Those are real responses, but the survey does not show which score movement triggered which action, or how long the gap ran between the two. That gap is where a framework either becomes operational or stays decorative.

A runnable version fixes the gap by assigning, in advance, a named decision-maker and a specific action to each threshold a trajectory score can cross: a two-step worsening pauses new capital commitment pending a named executive's sign-off; a one-step worsening on a single-source supplier triggers a requalification request, not a memo; an insurer-grade tightening signal, the kind Willis Towers Watson tracks by country, triggers a review of the company's own coverage limits before the renewal date arrives rather than after.² None of these thresholds require the framework's designer to guess correctly about the future. They require the organization to decide, while calm, what it will do when the number moves, so that decision does not get made for the first time under pressure.

A quarterly cycle built this way produces four things a year instead of one: a scored roster, a set of deltas against the last cycle, a list of thresholds that fired, and a record of what decision followed each one. That last piece, the record, is what lets someone check a year later whether the framework caught anything real, which how to measure geopolitical risk also treats as the test a scoring method has to pass. The inputs that feed the first scoring pass are their own separate discipline, closer to what building a real geopolitical risk assessment covers in detail. Fortius Intel's risk scan is built to shortcut that first pass rather than replace the quarterly discipline that has to follow it.

Fortius Intel note: A framework that cannot name, before the quarter starts, which score movement triggers which meeting is not a framework. It is a slide, and slides do not get rerun.

Methodology: this analysis draws on the BCG/IMD/World Economic Forum "Building Geopolitical Muscle" report (January 2026), Deloitte's US Board Practices Quarterly on board oversight of geopolitical risk (November 2025), the Allianz Risk Barometer 2026, and Willis Towers Watson's Insurance Marketplace Realities 2026 political risk outlook.

---

Footnotes

1. Deloitte, "US Board Practices Quarterly: Board Oversight of Geopolitical Risk," November 2025, https://www.deloitte.com/content/dam/assets-zone3/us/en/docs/programs/2025/us-board-practices-quarterly-board-oversight-of-geopolitical-risk-120525.pdf (retrieved 15 September 2026). Source for: the survey of 85 public and 21 private companies; the 56 percent versus 32 percent agenda-format split; the 34/25/22 percent committee-ownership breakdown; the finding that 35 percent of companies had not assigned management responsibility for a flagged risk to any individual, group or function; and the 78/72/56/56 percent breakdown of mitigation actions taken. ↩

2. Willis Towers Watson, "Insurance Marketplace Realities 2026: Political Risk," 2 October 2025, https://www.wtwco.com/en-us/insights/2025/10/insurance-marketplace-realities-2026-political-risk (retrieved 15 September 2026). Source for: the 0 to 10 percent projected 2026 renewal rate increase and the tightened capacity in China, Taiwan, Sudan and parts of West Africa against flatter rates in other markets. ↩