Risk Identification and Exposure Mapping

Introduction and Context

Geopolitical risk becomes commercially significant when political developments alter the conditions under which an organisation obtains resources, moves goods, employs people, accesses finance, uses technology, serves customers or complies with law. A change in sanctions policy, a coup, maritime blockade, election dispute, export control, diplomatic rupture, civil conflict or cyber operation is not itself a business impact. It becomes an impact through identifiable exposure pathways.

Risk identification and exposure mapping therefore connect three analytical questions:

1. What may happen? — the geopolitical event or trigger.
2. Through what channel could it matter? — the transmission mechanism.
3. What is exposed, how severely, and for how long? — the organisational consequence.

The purpose is not to predict political events with certainty. It is to create a disciplined representation of dependencies so that managers can detect vulnerability, prioritise mitigation and make decisions under uncertainty. In international business, exposure is often indirect. A firm may have no subsidiary in a conflict country but may depend on a port there, a foreign-owned cloud provider, a sanctioned bank, a critical mineral, a supplier’s supplier, or a workforce whose mobility is restricted.

This chapter develops a practical framework based on stakeholder analysis, dependency analysis and transmission-channel analysis. It also introduces exposure registers, network mapping, scoring methods, scenario analysis and governance requirements.

Learning Objectives

By the end of this chapter, the reader should be able to:

• distinguish geopolitical events, exposures, vulnerabilities and impacts;
• identify stakeholders and critical dependencies across borders;
• map transmission channels from political triggers to business outcomes;
• construct an exposure register and prioritise risk concentrations;
• use qualitative and quantitative methods without creating false precision;
• analyse an applied supply-chain and sanctions scenario;
• evaluate ethical, legal, technological and governance implications; and
• translate exposure analysis into practical management actions.

1. Foundational Concepts

1.1 Event, exposure, vulnerability and impact

These terms should not be used interchangeably.

A useful causal chain is:

Event → transmission channel → exposed resource or stakeholder → vulnerability → impact → response.

For example, an interstate dispute may produce sanctions; sanctions may restrict payment through a bank; payment restrictions may interrupt a supplier; the interruption may stop production; production failure may cause revenue loss and reputational damage.

1.2 Direct and indirect exposure

Direct exposure exists when the firm, its assets, employees, contracts or legal entities are located in or directly connected to the affected jurisdiction. Indirect exposure arises through intermediaries or dependencies. Examples include:

• a tier-two supplier using a restricted raw material;
• a global bank whose correspondent network excludes a country;
• a logistics provider dependent on a threatened strait;
• a cloud platform operating through a data centre subject to local access rules; and
• a distributor whose licence is revoked after a diplomatic dispute.

Indirect exposure is frequently underestimated because conventional risk registers focus on first-tier suppliers and owned assets.

1.3 Exposure is multidimensional

A single event can affect several dimensions simultaneously:

• Markets: demand, pricing, market access and customer confidence.
• Assets: facilities, inventories, intellectual property and physical infrastructure.
• People: safety, mobility, labour rights, recruitment and wellbeing.
• Supply chains: materials, production, transport, warehousing and distribution.
• Finance: liquidity, foreign exchange, settlement, credit, insurance and capital access.
• Technology: networks, data, software, cloud infrastructure and dual-use technology.
• Reputation: perceptions among customers, investors, employees and civil society.
• Legal obligations: sanctions, export controls, anti-bribery rules, reporting, fiduciary duties and contractual commitments.

The mapping task must capture both primary and secondary effects. A blocked port can create freight delays, inventory shortages, contractual disputes, revenue losses, emergency procurement costs and customer dissatisfaction.

2. A Framework for Exposure Mapping

2.1 The stakeholder lens

Stakeholders are parties that can affect, or be affected by, the organisation’s response. Relevant categories include:

• governments, regulators and customs authorities;
• employees, contractors and local communities;
• customers, distributors and end users;
• suppliers, subcontractors and logistics providers;
• banks, insurers, investors and credit-rating agencies;
• technology vendors, telecommunications firms and data processors;
• civil-society organisations and the media; and
• alliance partners, competitors and state-owned enterprises.

Stakeholder analysis should ask four questions:

1. What does this stakeholder control or influence?
2. What does the organisation depend on from it?
3. How could geopolitical change alter its behaviour?
4. What obligations does the organisation owe it?

Power and legitimacy are not identical. A regulator may possess coercive power, while an affected community may have strong moral claims but limited formal authority. A robust assessment recognises both.

2.2 The dependency lens

A dependency exists where the organisation requires a resource, capability, relationship or permission that cannot be replaced quickly or economically. Important dependency attributes are:

• Concentration: dependence on one supplier, country, route or platform.
• Substitutability: availability and qualification time of alternatives.
• Criticality: effect of failure on essential operations.
• Duration: expected time before disruption or recovery.
• Visibility: confidence in knowledge of the dependency, especially beyond tier one.
• Control: ability to influence or mitigate the dependency.

A dependency map should follow physical, financial, informational and legal flows. It should not be limited to the movement of products.

2.3 The transmission-channel lens

Political developments commonly transmit through the following channels:

The same event can travel through multiple channels. A conflict may close a port, cause an insurance exclusion, trigger sanctions and generate cyberattacks. Mapping only one channel creates a misleadingly narrow risk picture.

3. Building an Exposure Map

Step 1: Define scope and critical objectives

The organisation should first specify the decision horizon and the assets or objectives under review. A market-entry assessment may focus on legal and political access; a crisis assessment may focus on people, continuity and liquidity. Scope should identify:

• legal entities and operating countries;
• critical products and services;
• material suppliers and customers;
• essential systems and data;
• key contracts and obligations; and
• relevant time horizon.

Step 2: Establish a geopolitical event inventory

Events should be described in operational rather than vague language. “Regional instability” is less useful than “new export licence requirement for semiconductor equipment,” “closure of the northern border crossing,” or “designation of a logistics company under a sanctions regime.” Sources may include official government notices, regulatory publications, intelligence providers, industry bodies and verified local reporting. Source reliability and date should be recorded.

Step 3: Identify stakeholders and dependencies

For each critical activity, document who supplies, authorises, transports, finances, hosts, operates, regulates or consumes it. Trace dependencies beyond immediate contractual relationships. Supplier questionnaires, bills of material, enterprise-resource-planning data, customs records, payment data, contract repositories and interviews can be combined.

Step 4: Connect events to transmission channels

A useful mapping table contains at least the following fields:

Step 5: Assess severity, likelihood and velocity

Severity concerns the magnitude of consequence. Likelihood concerns the chance of occurrence within a specified period. Velocity concerns how rapidly the impact materialises. A lower-severity event with very high velocity may require faster action than a severe but gradual trend.

A simple qualitative scale can use five levels for each dimension. However, scores are decision aids, not objective measurements. Definitions must be anchored to organisational thresholds, such as revenue bands, production days lost, affected employees, regulatory penalties or recovery time.

Step 6: Identify concentration and cascading effects

A map should show single points of failure and shared dependencies. Two apparently independent suppliers may use the same port, bank, cloud region or raw-material processor. This is a common-cause dependency. Cascading effects occur when one failure creates another—for example, a payment interruption causes supplier default, which causes production delay, which causes customer breach.

Step 7: Validate and update

Exposure maps decay. Ownership changes, suppliers relocate, regulations evolve and geopolitical relationships shift. Critical maps should be reviewed after major events, acquisitions, market entries, regulatory changes and material supply-chain redesigns. Tabletop exercises can test whether the documented map matches operational reality.

4. Analytical Methods and Metrics

4.1 Weighted dependency exposure

A practical prioritisation measure is a weighted exposure score:

Here, E is the total exposure score; wᵢ is the importance weight of dependency i; cᵢ is the concentration factor; and vᵢ is the vulnerability factor. The sum is across identified dependencies. All factors must be defined on a common scale, such as 0 to 1, and weights should sum to 1 if the result is intended to remain within a comparable range.

This is a prioritisation heuristic, not a probability model. It assumes that the selected factors are sufficiently comparable and that additive aggregation is useful. It should not be interpreted as a forecast of loss.

For example, suppose three dependencies have weights 0.5, 0.3 and 0.2, concentration factors 0.8, 0.4 and 0.7, and vulnerability factors 0.9, 0.6 and 0.5. Then:

E = (0.5×0.8×0.9) + (0.3×0.4×0.6) + (0.2×0.7×0.5) = 0.36 + 0.072 + 0.07 = 0.502

The result indicates relative priority only. It does not mean that loss probability is 50.2%.

4.2 Expected loss

Where credible probabilities and monetary impacts are available, expected loss can be estimated as:

EL is expected loss per defined period; pⱼ is the probability of scenario j during that period; and Lⱼ is the monetary loss if that scenario occurs. The scenarios should be mutually exclusive or otherwise structured to avoid double counting. Probabilities must refer to the same time horizon, and losses should use consistent currency and valuation assumptions.

Expected loss is useful for comparing options but can conceal extreme outcomes, uncertainty and distributional effects. Scenario ranges, stress tests and qualitative judgement remain essential.

4.3 Network centrality and criticality

Exposure mapping can be represented as a directed network of entities and dependencies. Nodes may represent suppliers, ports, banks, systems or jurisdictions; edges represent flows or relationships. A node with many connections may be structurally important, but degree alone is not sufficient. A small supplier may have few connections yet provide an irreplaceable component. Network analysis should therefore combine structural measures with operational criticality and substitutability.

4.4 Time-to-impact and time-to-recover

Two practical metrics are:

• Time-to-impact: time from trigger recognition to material business effect.
• Time-to-recover: time required to restore an acceptable level of service.

If time-to-impact is shorter than the organisation’s decision and response time, preventive controls deserve priority. If time-to-recover is long, inventory, alternative capacity, contractual flexibility or strategic redundancy may be justified.

5. Worked Application: Illustrative Rare-Earth Supply Scenario

Consider an illustrative multinational manufacturer of electric-drive systems. It purchases a refined rare-earth input from one country, uses a third-party processor in a neighbouring state, pays suppliers through two international banks and ships finished components through a strategically important port.

Background

A diplomatic dispute escalates. The producing country announces export licensing for selected minerals. The neighbouring state introduces enhanced customs inspections, while an international bank warns that certain transactions may require additional screening.

Problem

Management initially identifies only a procurement risk. A broader map reveals simultaneous exposure in supply, finance, logistics, legal compliance, customer delivery and reputation.

Analysis

The firm’s vulnerability is high because the input has a nine-month qualification period for alternatives. Its inventory covers six weeks, while the plausible delay may last twelve weeks. The organisation also discovers that its “second supplier” purchases the same refined material from the original country and is therefore not a genuine diversification option.

Approach and solution

The cross-functional team establishes a control tower including procurement, legal, treasury, logistics, security, operations, communications and sustainability. It takes five actions:

1. confirms the exact legal scope of licensing and screening requirements;
2. freezes unreviewed transactions rather than applying an indiscriminate country ban;
3. prioritises scarce inventory for contractual and safety-critical customers;
4. accelerates qualification of geographically independent alternative materials; and
5. communicates factually with customers and employees while protecting confidential information.

The firm also maps tier-two and tier-three dependencies, negotiates temporary allocation agreements, increases route flexibility and conducts a scenario exercise for port closure.

Outcome

The company avoids an unlawful transaction, maintains production for priority customers and reduces future concentration. Costs increase because of testing, expedited freight and alternative sourcing. The case demonstrates that compliance, continuity and reputation are interdependent rather than separate workstreams.

Learning points

• A second contractual supplier may not be a second geopolitical source.
• Legal review must occur before operational improvisation.
• Inventory is valuable only relative to time-to-impact and time-to-recover.
• Mapping payment and data dependencies can reveal risks absent from procurement records.
• Ethical allocation decisions require explicit criteria rather than informal influence.

6. Governance, Legal and Ethical Considerations

Exposure mapping may involve personal data, commercially sensitive supplier information, employee locations and politically sensitive judgements. Access should follow purpose limitation, data minimisation, role-based permissions and retention controls. Maps should distinguish verified facts, assumptions and analyst assessments.

Legal analysis must consider the laws of all relevant jurisdictions, not merely the headquarters country. Relevant regimes may include sanctions, export controls, foreign investment restrictions, anti-boycott rules, customs law, anti-bribery legislation, labour and human-rights requirements, data-protection rules and contractual force-majeure provisions. A risk map does not replace advice from qualified legal counsel.

Ethical issues arise when firms decide which customers receive scarce goods, whether to continue operating in a conflict-affected market, how to protect employees, and whether commercial benefits justify association with abusive actors. A narrow shareholder-value approach may overlook affected communities and human-rights responsibilities. Decisions should be documented, reviewable and consistent with stated values and applicable law.

7. Technology, Data and Artificial Intelligence

Digital tools can improve mapping by linking enterprise-resource-planning records, supplier databases, shipment data, sanctions lists, news, geospatial information and contract repositories. Graph databases are particularly useful for representing many-to-many relationships and tracing indirect dependencies.

Artificial intelligence can classify documents, detect unusual trade patterns, summarise regulatory changes and suggest possible second-tier links. Its use requires controls. Models may reproduce source bias, confuse similarly named entities, miss local-language reporting, generate unsupported relationships or treat uncertain information as fact. Human review is essential for high-consequence decisions. Organisations should preserve source citations, confidence levels, model versions and an audit trail.

Automation should support, not replace, accountable judgement. A sanctions-screening alert, for example, is an investigative signal rather than proof that a transaction is unlawful. Excessive automation can create both false positives, which obstruct legitimate commerce, and false negatives, which create legal exposure.

8. Challenges and Limitations

Incomplete visibility

Suppliers may not disclose sub-tier relationships, and data may be commercially fragmented. Organisations should record confidence and unknowns rather than presenting incomplete maps as comprehensive.

Dynamic causality

Geopolitical events evolve through feedback loops. A restriction may provoke retaliation, which creates further restrictions. Static registers are inadequate for rapidly changing situations.

False precision

Numerical scores can imply accuracy unsupported by evidence. Scales should have written definitions, sensitivity testing and qualitative commentary.

Correlated risks

Common routes, banks, technologies and jurisdictions create correlation. Adding individual scores may understate systemic exposure.

Political and analytical bias

Analysts may overemphasise dramatic events or adopt the assumptions of headquarters. Diverse teams, challenge sessions and independent review improve judgement.

Unintended consequences

De-risking may shift business to less transparent suppliers, harm local workers or reduce access to essential goods. Mitigation should be assessed for second-order effects.

9. Best-Practice Operating Model

An effective exposure-mapping capability typically includes:

1. Clear ownership: a senior risk owner and accountable business owners for dependencies.
2. Common taxonomy: agreed definitions for events, channels, exposure and impact.
3. Integrated data: procurement, legal, treasury, logistics, HR, IT and security information.
4. Tiered analysis: detailed mapping for critical dependencies and proportionate review elsewhere.
5. Scenario testing: plausible, severe and rapidly developing scenarios.
6. Threshold-based escalation: predefined triggers for executive action.
7. Evidence discipline: sources, dates, assumptions and confidence levels.
8. Action linkage: every material exposure connected to an owner, control and deadline.
9. Continuous monitoring: indicators tied to specific decisions rather than undirected information collection.
10. Independent challenge: audit, compliance or external review of significant assessments.

The output should be usable in a decision meeting. A good map identifies what matters, why it matters, how quickly it may matter, what can be done and who must act.

Chapter Summary

Risk identification and exposure mapping translate geopolitical developments into organisational consequences. The central analytical chain is event, transmission channel, exposed element, vulnerability and impact. Stakeholder analysis identifies affected and influential parties; dependency analysis reveals concentrations, substitutability and common-cause failures; transmission-channel analysis explains how political change reaches markets, assets, people, supply chains, finance, technology, reputation and legal obligations.

Exposure maps should combine direct and indirect relationships, operational data and expert judgement. Weighted scores can prioritise attention, while expected-loss methods can support economic comparison when probabilities and impacts are credible. Neither method eliminates uncertainty. Scenario analysis, time-to-impact, time-to-recover and network thinking are necessary complements.

Effective practice is cross-functional, evidence-based, legally informed and ethically governed. Technology and AI can improve scale and visibility, but they require human validation, source traceability and accountability. The ultimate value of mapping lies not in producing a sophisticated diagram but in enabling timely, lawful and resilient decisions.

Key Terms

Geopolitical event: A political, security, regulatory or interstate development that may affect business conditions.

Exposure: A connection between an organisation and an affected actor, place, asset, resource or system.

Vulnerability: A characteristic that increases susceptibility to harm.

Impact: The consequence of a risk event for the organisation or its stakeholders.

Transmission channel: The mechanism through which a geopolitical event creates an effect.

Stakeholder: A party that can affect or is affected by organisational decisions.

Dependency: A resource, relationship, capability or permission required for operations.

Concentration risk: Risk arising from dependence on a limited number of sources or routes.

Substitutability: The availability and practicality of replacing a dependency.

Common-cause dependency: Apparently separate dependencies exposed to the same underlying factor.

Cascading effect: A secondary disruption caused by an initial disruption.

Time-to-impact: The time between trigger recognition and material business effect.

Time-to-recover: The time needed to restore acceptable operations.

Exposure register: A structured record of events, channels, exposures, impacts, controls and owners.

Scenario analysis: Examination of consequences under specified plausible conditions.

Expected loss: Probability-weighted loss across defined scenarios.

Sanctions: Legal restrictions imposed on specified countries, entities, persons or activities.

Export control: Regulation restricting the transfer of goods, technology or services.

Resilience: The ability to absorb, adapt to and recover from disruption.

False precision: An unjustified appearance of accuracy created by numerical scoring.

Review Questions

5 Short Answer Questions

1. Distinguish a geopolitical event from a business exposure.
2. What is the difference between direct and indirect exposure?
3. Name four transmission channels through which geopolitical risk can affect a firm.
4. Why can a second supplier fail to provide genuine diversification?
5. What information should an exposure register contain?

5 Long Answer Questions

1. Explain how stakeholder, dependency and transmission-channel analysis complement one another.
2. Discuss the strengths and limitations of weighted exposure scoring and expected-loss analysis.
3. Explain why time-to-impact and time-to-recover are important for mitigation decisions.
4. Analyse the legal and ethical challenges of operating in a conflict-affected market.
5. Evaluate the role of artificial intelligence in geopolitical exposure mapping.

3 Analytical / Application Questions

1. A manufacturer depends on three suppliers, two of which use the same port and raw-material processor. Construct an exposure map identifying direct, indirect and common-cause dependencies.
2. A bank designation threatens supplier payments while a border closure threatens deliveries. Develop a coordinated response across legal, treasury, procurement, logistics and communications.
3. Design a set of indicators and escalation thresholds for monitoring a potential export-control crisis. Justify how each indicator connects to a management decision.

Multiple Choice Questions with Answers

Question 1

Which sequence best represents the causal logic of exposure mapping?

A. Impact → event → stakeholder → probability

B. Event → transmission channel → exposure → vulnerability → impact

C. Stakeholder → reputation → event → inventory

D. Probability → control → event → jurisdiction

Correct Answer: B. Event → transmission channel → exposure → vulnerability → impact

Question 2

A firm has no operations in a country but relies on a tier-two supplier located there. This is best described as:

A. Direct exposure

B. No exposure

C. Indirect exposure

D. Reputational exposure only

Correct Answer: C. Indirect exposure

Question 3

Which factor most directly measures the difficulty of replacing a dependency?

A. Substitutability

B. Velocity

C. Legitimacy

D. Visibility

Correct Answer: A. Substitutability

Question 4

In the weighted exposure heuristic E = ∑ᵢ wᵢ cᵢ vᵢ, what does cᵢ represent?

A. Currency loss

B. Concentration factor

C. Compliance cost

D. Contract duration

Correct Answer: B. Concentration factor

Question 5

If a geopolitical event affects a port, an insurer and a bank simultaneously, the assessment should primarily recognise:

A. A single isolated channel

B. A common-cause or multi-channel exposure

C. Only a reputational risk

D. A zero-sum market effect

Correct Answer: B. A common-cause or multi-channel exposure

Question 6

Which statement about expected loss is correct?

A. It is always the maximum possible loss

B. It equals the sum of scenario probabilities without impacts

C. It is the probability-weighted sum of defined scenario losses

D. It proves that a scenario will occur

Correct Answer: C. It is the probability-weighted sum of defined scenario losses

Question 7

Why should sanctions-screening alerts normally receive human review?

A. Alerts are legally irrelevant

B. Automated systems can produce false positives and false negatives

C. Technology cannot store records

D. Human review eliminates all uncertainty

Correct Answer: B. Automated systems can produce false positives and false negatives

Question 8

Which combination most strongly indicates a high-priority dependency?

A. Low criticality, many alternatives and long time-to-impact

B. High criticality, low substitutability and short time-to-impact

C. Low criticality, high visibility and strong control

D. Many suppliers, low concentration and rapid recovery

Correct Answer: B. High criticality, low substitutability and short time-to-impact

Question 9

A second supplier purchases the same restricted input from the same country as the first supplier. What risk does this reveal?

A. False diversification

B. Currency appreciation

C. Reduced legal exposure

D. Independent redundancy

Correct Answer: A. False diversification

Question 10

Which practice best supports accountable AI-assisted exposure mapping?

A. Removing source citations to speed decisions

B. Treating model output as proof

C. Recording sources, confidence levels and human review

D. Using only data from headquarters

Correct Answer: C. Recording sources, confidence levels and human review