Training insights – auditing geopolitical risk
Geopolitical risk is back and rising fast up the agenda. Indeed, it had already moved up the list of chief audit executives’ concerns highlighted in the Chartered IIA’s Risk in Focus 2022 – and that was before Russia invaded Ukraine. This is why the institute has launched a new one-day course to help internal auditors refresh and update their knowledge of the main issues and consider the key ways in which they can provide assurance to their boards and stakeholders that the organisation is anticipating and managing its impacts.
While large multinational organisations should always have one eye on potential disruption from shifting geopolitics, smaller enterprises and public-sector bodies may be less used to doing this and unaware of some of their vulnerabilities, explains John Chesshire who leads the “Geopolitical Risk and the Role of the Internal Auditor” course together with Derek Leatherdale.
“In the past couple of years, we’ve seen how rapidly changing events on the other side of the world can disrupt, for example, supply chains and outsourced services such as overseas call centres in ways that affect all kinds of organisations,” he says. “The pandemic made more people think about the issues seriously, but the war in Ukraine has highlighted ongoing issues for private-sector and public-sector organisations, financial services firms, international charities and governments.”
Whether you’re affected by lockdowns in Chinese manufacturing towns, a worldwide shortage of cooking oil and wheat normally sourced from Ukraine, loss of business because of sanctions on Russian millionaires, pressure to close Russian stores, or soaring oil and commodity prices, geopolitical risk is putting your business under stress. Similarly, everyone – consumers, retailers, manufacturers and governments along with anyone else who uses energy – is affected by the macroeconomic effects of geopolitics, such as higher inflation and reduced GDP.
“When things are done quickly in response to a regional or national event, mistakes can happen,” Chesshire adds. “How do we ensure that, for example, closing retail outlets in Russia is done well and does not lead to further legal or reputational problems?”
The subject is, by its nature, vast and wide-ranging and attendees on the course are likely to have many and varied concerns relevant to their own organisations. This is one reason why the course is being run by two leaders, rather than the normal one.
“Derek’s expertise is in managing geopolitical risk, first in financial services firms and, now, from his own business, so he approaches the subject from a risk perspective – the ways it affects organisations and the barriers to managing risk effectively,” Chesshire explains. “I then lead the afternoon session and focus on the internal audit perspective. I will look at how to create meaningful terms of reference and turn these into audit work programmes, and also at ways in which internal audit can provide advice and guidance in rapidly changing circumstances.”
Who will benefit?
The two leaders are expecting attendees to bring a variety of levels of knowledge and experience with them. Some may be new to internal audit, but more experienced in managing geopolitical risks, while others may have an internal audit background, but be less familiar with this area of risk or in need of an update.
“I have a background in defence and I have been working in Ukraine over the past few years, as well as in other challenging overseas regions,” Chesshire says. “I’m therefore used to working with very few constants. Large multinationals may have the resources to keep up to date with events worldwide, but organisations that lack these resources, or which have expanded into new areas recently tend not to know what they don’t know, which makes them more likely to miss things.”
Importantly, this course is also aimed at internal auditors working in the UK and Ireland who may only recently have recognised their organisation’s exposure to geopolitical disruption elsewhere. They need to consider fundamental issues such as governance and whether board members are fully aware of the risks and factor these into their decision-making, how they provide independent assurance in unfamiliar regions and how they work with risk colleagues to provide integrated assurance over geopolitical risks.
This new course may only take up a day, but it aims to raise issues that delegates can think about and develop once they return to work. Geopolitical risk never went away, but its current resurgence as a source of disruption for businesses that may have considered themselves far removed from its source is unlikely to abate soon. We are all going to have to learn to live with its consequences and now is a good time to start.
This article was first published in July 2022.