What Is Geopolitical Risk, and What Does Your Risk Register Call It Instead

TL;DR: Geopolitical risk has no fixed home in the enterprise risk management frameworks most companies already use. COSO's ERM guidance does not name it as a category, and a November 2025 governance survey found large-cap boards split oversight of it across multiple committees at once more often than any single committee claimed it outright. The result is not that companies ignore geopolitical events. It is that no category, and therefore no job description, is built to own them before they cross into a category that is.

Key takeaways:

• Deloitte's November 2025 Board Practices Quarterly found large-cap companies assign primary oversight of geopolitical risk to multiple board committees at once 38 percent of the time, more than any single committee captured alone.
• WTW's June 2026 Global Directors' and Officers' Survey placed geopolitical risk among directors' top seven concerns for the first time, at 59 percent overall and 77 percent among companies above five billion dollars in revenue.
• COSO's enterprise risk management framework materials do not name geopolitical risk as a category; when the term appears in guidance on the framework at all, it is folded in alongside environmental and market risk for specific sectors like energy.
• WTW's regional numbers swing from 55 percent in Europe to 81 percent in the Middle East, a 26-point gap in how urgently different regions rate a risk that no framework defines the same way twice.

A geopolitical risk register entry rarely says "geopolitical risk." It says supply chain risk, or regulatory risk, or country risk, or sometimes just "other," and the company holding it usually has a perfectly good reason: none of the standard enterprise risk categories has a slot with that name on it.

What Counts as Geopolitical Risk, and What Doesn't

Enterprise risk management, as most large companies practice it, runs on category systems built decades before geopolitical volatility became a board-level agenda item. COSO's ERM framework, the reference point for most public-company risk programs, structures its guidance around governance, strategy, performance and review, not around a fixed list of named risk types the way a claims adjuster might use one.[^1] Geopolitical risk does not appear as one of COSO's own categories. When third-party guidance on the framework brings the term up at all, it shows up folded into other language, grouped with "environmental" and "market-related" risk in a discussion of energy-sector operations rather than treated as its own line.[^2] A company applying COSO in good faith can build a complete risk register and never once write the words "geopolitical risk" on it, because the framework never told it to.

That absence has practical consequences, not just definitional ones. Without a named category, geopolitical exposure gets sorted by whichever department notices it first:

• A tariff change lands in trade compliance, filed as a regulatory matter even when the underlying driver is a bilateral dispute that trade compliance has no mandate to track upstream.
• A currency control lands in treasury, filed as market or financial risk even when the trigger is a sovereign policy decision with no financial-market signal ahead of it.
• A supplier disruption lands in procurement, filed as operational risk even when the cause is an export licence revoked for reasons that have nothing to do with the supplier's operating performance.
• An election outcome lands nowhere in particular, until it produces a tariff, a currency control or a licence change that then gets filed under one of the categories above, several steps removed from its actual cause.

Each of these filings is defensible on its own terms. None of them connects to the others, because the connecting thread, the fact that a state or inter-state action caused all four, is not a category any of the receiving departments was built to track.

Why Nobody Owns the Committee Either

The categorization gap shows up again, in numbers, at board level. Deloitte's Board Practices Quarterly surveyed 85 public companies and 21 private companies, members of the Society for Corporate Governance, on how they assign primary oversight of geopolitical risk.[^3] Among the 34 large-cap respondents who answered the question, the single largest response, at 38 percent, was not any one committee. It was "multiple committees at once," ahead of the risk committee alone at 31 percent, the audit committee alone at 18 percent, and the full board alone at 21 percent. Mid-cap companies split differently but no more decisively, favoring the audit committee at 31 percent with no single structure commanding a majority either.[^3]

That pattern is what an ownerless category looks like at the governance layer. A risk with an assigned category typically has an assigned committee to match it, the way credit risk sits with the audit committee and cyber risk increasingly sits with a dedicated technology or risk committee. Geopolitical risk, filed under whichever department's category caught it first, ends up reviewed by whichever committee happens to oversee that category, and different divisions of the same company can be filing the same underlying exposure under different categories at the same time. The WTW survey's regional spread reinforces the same point from the concern side rather than the governance side: 59 percent of directors overall rank geopolitical risk in their top seven concerns, but that ranges from 55 percent in Europe to 81 percent in the Middle East, and from 63 percent at mid-sized companies to 77 percent at very large ones.[^4] A single, stable category produces more consistent numbers than that. A category that different regions and company sizes are still negotiating the boundaries of produces exactly this spread.

Giving the Risk a Line of Its Own

The fix is not a new framework. COSO's structure has room for a named category; it simply has not been asked to add one, and most corporate risk registers copy whatever categories the framework or the company's auditors already use. Fortius Intel's working definition treats geopolitical risk as exposure arising from state or inter-state action, including elections, sanctions, conflict, trade measures and regulatory divergence, and treats it as its own category specifically because the transmission channels above (trade compliance, treasury, procurement, and the unassigned space before any of those three) need a shared upstream label before they can be read as one exposure rather than four unrelated ones.

Three changes follow from that definition. First, a risk register needs a geopolitical risk line that sits above trade, treasury and procurement categories, not inside any one of them, so an analyst reviewing the register can see all four transmission paths from a single cause in one place. Second, board oversight needs a named committee of record for that line, even if the committee's job is only to confirm the exposure is being tracked somewhere else, because "multiple committees at once" is what a governance structure looks like when no one has been asked to hold the line accountable. Third, the category needs a definition that travels with the company across regions, since a 26-point gap in how urgently different offices rate the same undefined risk is a sign the definition itself, not just the events behind it, is still being negotiated locally.

Fortius Intel note: If a risk register cannot point to a single line item labeled geopolitical risk, ask where each of trade compliance, treasury and procurement would file the same hypothetical sanctions event today. If the answer is three different categories, the register has a geopolitical risk problem before it has a geopolitical event.

Methodology: this analysis draws on COSO's published enterprise risk management framework materials and third-party explanatory guidance on that framework, Deloitte's Board Practices Quarterly survey on board oversight of geopolitical risk (November 2025, 85 public and 21 private company respondents), and WTW's Global Directors' and Officers' Survey Report 2026 (published June 2026), cross-checking the Deloitte committee-oversight figures against an independently hosted copy of the same survey document.

---

Footnotes