Who Owns Geopolitical Risk Management Inside the Company

TL;DR: Only 45 percent of companies clearly assign ownership of geopolitical risk to a specific person, function, or committee, and the gap is worse below the largest firms: 47 percent of mid-cap companies assign it to no one at all, against 18 percent of companies above 10 billion dollars in revenue. The usual result is not a single crisis. It is a string of small, avoidable delays that compound until one of them is not small.

Key takeaways:

• In 2021 most companies that had assigned geopolitical risk ownership gave it to a single function or business unit; by 2025 a cross-functional committee had become the dominant model, at 52 percent.[^1]
• Thirty-five percent of companies surveyed in late 2025 had not assigned geopolitical risk responsibility to any specific individual, rising to 47 percent among mid-cap firms between 2 and 10 billion dollars in revenue.[^2]
• In manufacturing, the security leader overseeing this exposure reports into the Chief Risk Officer or General Counsel roughly half the time, more than double the 20 percent cross-industry rate.[^3]
• Fewer than one in five companies operates a dedicated geopolitics or international affairs unit, even as board-level assignment of oversight has more than doubled since 2021.[^1][^4]

When Ford idled its Chicago Explorer plant in May 2025 after a China rare-earth magnet shortage, the company's own chief executive described the response as improvised: supply was "day to day," and the firm found itself lobbying two governments after the fact rather than acting on a plan drawn up before it.[^5] Ford is not unusual in that. What is unusual is a company that can name, in one sentence, whose job it was to see the shortage coming.

The Ownership Gap, By the Numbers

The gap is not a perception problem confined to one survey. It shows up consistently across independent research run by different firms, on different samples, in different years.

• Ownership, self-reported. EY-Parthenon's 2025 survey of 1,049 executives at companies with more than 500 million dollars in annual revenue found only 45 percent clearly assign geostrategy ownership to an individual, a dedicated function, or a cross-functional committee.[^1]
• Ownership, board-reported. A separate Deloitte and Society for Corporate Governance survey of 106 companies, fielded in late 2025, found 35 percent had not assigned responsibility to any specific individual, rising to 47 percent once the sample is narrowed to mid-cap companies between 2 and 10 billion dollars in revenue, against 18 percent for companies above 10 billion.[^2]
• Structure, independently confirmed. A January 2026 study by BCG, IMD Business School and the World Economic Forum, built on more than 55 executive interviews, found fewer than 20 percent of companies operate a dedicated geopolitics or international affairs unit at all. Most instead route the work through general corporate affairs, a department built for media and government relations rather than for tracking a licensing regime or a sanctions list.[^4]
• The trend is board attention outrunning management structure. Board-level assignment of geopolitical oversight to a specific committee rose from roughly one-third of boards in 2021 to about three-quarters in 2025, while committee-based governance overtook function-based governance as the dominant model over the same period, 52 percent against 39 percent.[^1]

Board attention is rising. Operational ownership is not keeping pace with it, and the distance between the two is where mid-market companies actually sit.

Why Geopolitical Risk Management Falls Between Four Desks

Four functions each hold a partial claim on this problem, and none holds the whole one.

The Chief Risk Officer owns the register but usually inherits geopolitical exposure as one line among many, filed next to interest-rate risk and cyber risk, without the standing or the calendar to track a fast-moving embargo or an export control amendment on its own terms. A risk register updated quarterly treats a licensing deadline the same way it treats a slow-moving actuarial trend, which is the wrong cadence for either one.

The security or chief security officer function tracks the physical and personnel side, and reports into a different chief depending on sector. In manufacturing specifically, the security leader reports into the Chief Risk Officer or General Counsel about half the time, more than double the roughly 20 percent rate across industries as a whole, which usually means geopolitical work is read through a legal lens built for compliance, not for anticipation.[^3]

Corporate strategy owns the long-range view and the market-entry and acquisition decisions where geopolitical exposure matters most, but strategy teams work in quarters and years, not the weeks a licensing deadline or a sanctions designation actually moves on.

Regional and business-unit leadership see the earliest signal, closest to the ground, and have the least formal channel to escalate it before it becomes someone else's emergency. A country manager who watches a customs office slow down for three straight weeks has no obvious desk to call before that slowdown shows up as a missed shipment on someone else's report.

What the record shows: each of the four functions above has a documented, partial claim on geopolitical risk, evidenced across the surveys already cited. What we infer, because no public post-mortem states it directly: mid-cap companies show the largest ownership gap because they are large enough to carry cross-border exposure, but not yet large enough to have built a fifth function whose whole job is sitting across the other four. Large-caps close more of that gap not because their four desks communicate better, but because they can afford to duplicate coverage across them; a mid-cap company usually cannot.

What a Named Owner Actually Has to Do

Naming an owner does not require a new department. Deloitte's data shows 52 percent of companies already run this oversight through multiple existing functions rather than one; the gap is not headcount, it is a defined handoff.¹

• A single point of intake. One person or committee that each of the four functions above reports developments to, even where that person does not own execution. Fortius Intel's own daily brief format is built around exactly that habit: one page, one cadence, one named reader.
• A calendar, not a dashboard. A short list of dated triggers, licensing deadlines, election dates, sanctions review windows, that forces a review whether or not anything looks urgent that week.
• A written escalation path. A one-line rule stating which of the four functions raises what, and to whom, so the answer does not depend on who happens to notice first.
• A review cadence tied to a real date, not a quarterly calendar entry that survives untouched because nothing forced anyone to open it.
• A record of what was decided, kept apart from meeting notes. A one-line log of the call made and the date it was made turns the intake point into something that can be checked later, which is the difference between a habit and a meeting.

Once that intake point exists, the harder problem is running it week to week. A companion piece covers the operating rhythm in more detail, and a separate note works through the build, retain, or subscribe decision for companies weighing whether that owner should be a hire.

Fortius Intel note: The 45 percent figure usually gets read as a warning about the 55 percent who fail. Read the mid-cap breakdown instead: 47 percent of mid-cap companies assign this to no one, against 18 percent of the largest companies, and the gap has little to do with resources. It is that nobody wrote the one-line memo naming who was responsible before the event that would have made it obvious.

Methodology: this analysis draws on the EY-Parthenon 2025 Geostrategy in Practice survey, the Deloitte Center for Board Effectiveness and Society for Corporate Governance's 2025 Board Practices Quarterly, the Security Magazine 2025 Security Benchmark Report, and the BCG/IMD/World Economic Forum January 2026 study on corporate geopolitical capability, cross-checked against direct reporting on Ford's 2025 rare-earth exposure.

---

Footnotes

1. Deloitte Center for Board Effectiveness and Society for Corporate Governance, "Board Practices Quarterly: Board oversight of geopolitical risk," November 2025, https://www.deloitte.com/content/dam/assets-zone3/us/en/docs/programs/2025/us-board-practices-quarterly-board-oversight-of-geopolitical-risk-120525.pdf (retrieved September 8, 2026). Source for: the 35 percent of companies with no individual assigned responsibility, the 47 percent versus 18 percent mid-cap-to-large-cap split, and the 52 percent multiple-function governance figure. ↩