From Geopolitical Risk to Financial Resilience

Geopolitical conflicts, trade restrictions, volatile energy prices, and international dependencies can significantly impact the economic stability of companies. But how can these risks be translated into financial impacts in a comprehensible way? And how can companies ensure that risk management, Business Impact Analysis, corporate governance, and financial reporting are based on consistent assumptions? This article describes a model that makes financial resilience assessable along a common impact chain and illustrates the time-dependent damage of a production outage in an interactive graphic.

Christian Horres

Expert in Business Continuity Management (BCM), risk management, and organisational resilience, particularly in the context of critical infrastructures. His focus is on Business Impact Analyses (BIA), risk analyses, and the development and enhancement of BCM and crisis management structures. Within the NOVELEDGE network, he supports organisations in the practical implementation of resilient structures, considering international standards such as ISO 22301, ISO 27001, and ISO 31000, as well as applicable regulations.

Initial Situation

Why geopolitical risks are moving into financial statements

The European Securities and Markets Authority (ESMA) has once again highlighted geopolitical risks and uncertainties as a key focus of European financial reporting. In its European Common Enforcement Priorities (ECEP) for the 2026 annual financial reports, published on 13 October 2026, it particularly emphasises the importance of transparent, company-specific reporting on geopolitically influenced financial risks.^[1]

The focus includes liquidity risks, financing options, contractual credit conditions, valuation uncertainties, as well as potential restructurings and divestments of business activities. This brings a fundamental question to the forefront:

How well do companies understand the financial consequences of their operational vulnerabilities – and how reliable is the information on which they base their risk assessments, prioritise resilience measures, and make financial decisions?

Answering this requires more than classic risk matrices or isolated liquidity forecasts. An integrated view of business processes, critical resources, risk scenarios, time-dependent impacts, and financial resilience is necessary. Such an approach connects Operational Risk Management with Business Impact Analysis (BIA), Business Continuity Management (BCM), corporate financing, and financial reporting.

The aim is not to replace existing methods. Rather, their results should be linked in such a way that a consistent picture of operational and financial resilience emerges.

Geopolitical Risks

From External Events to Economic Consequences

Geopolitical risks arise from political, economic, or security-related developments that can have cross-border impacts on companies and markets. Relevant risk areas include, for example, the war between Russia and Ukraine, conflicts in the Middle East, international sanctions, trade restrictions between major economic areas, and strategic dependencies on energy, raw materials, and critical technologies. The NOVELEDGE Resilience Radar continuously monitors how these situations develop.

In its 2025 enforcement priorities, ESMA explicitly referred to the Ukraine war, tensions in the Middle East, and increasing trade conflicts. It highlighted the connection to energy and raw material prices, supply chain disruptions, impairments, and financial valuation assumptions.^[2]

For companies, however, it is not just the geopolitical event itself that is decisive. What matters more is how the event impacts their business activities through dependencies. An internationally operating industrial company may be affected by a trade conflict even if it does not have a branch in the involved states. The reason could be that a European supplier sources critical electronic components from Asia. If these components are no longer delivered due to new export restrictions, a production line in Germany could be halted.

This creates a chain of effects:

Geopolitical Event → Supplier or Resource Impairment → Business Process Interruption → Economic Damage → Financial Strain

The consequences can affect different financial dimensions:

These impacts differ in terms of their likelihood, temporal development, and financial significance. A reliable risk assessment must therefore consider both the operational cause and the financial consequences.

ESMA Enforcement Priorities

Why Operational Risks Matter for Financial Reporting

ESMA is the European Securities and Markets Authority. Its tasks include promoting a consistent application of European capital market regulation. With the annually published European Common Enforcement Priorities, it identifies topics that European supervisory authorities should pay particular attention to when reviewing the financial reporting of listed issuers.

ESMA does not prescribe an independent method for Business Impact Analysis or Operational Risk Management. However, its priorities highlight which financial information companies must assess transparently and disclose if necessary, in the face of significant geopolitical risks.

Liquidity Risks and Liquidity Management

Liquidity risks describe the danger that a company may not be able to meet its financial obligations on time. It is important to distinguish between economic loss and liquidity strain. For example, a production outage might lead to a loss of two million euros in earnings, without this amount immediately resulting in a cash outflow. Conversely, the urgent procurement of replacement components can create a significant liquidity requirement, even though the additional costs only partially impact the annual result.

For financial reporting, the requirements of IFRS 7 are particularly relevant. The standard requires disclosures about the significance of financial instruments and the nature and extent of risks associated with them and their management. This includes liquidity risks.^[3]

For an integrated resilience assessment, this means: The BIA should not only determine the cumulative economic damage of an interruption but also provide information about its timing and cash flow impact.

Financing Flexibility and Covenants

Covenants are contractual conditions within financing agreements. A loan agreement might stipulate, for example, that the ratio between net financial debt and EBITDA must not exceed a certain threshold. EBITDA refers to earnings before interest, taxes, depreciation, and amortisation and is often used as a measure of operational profitability.

A simplified example: A company has net financial debt of 140 million euros and an EBITDA of 50 million euros. The ratio is:

140 million € / 50 million € = 2.8

The loan agreement allows a maximum value of 3.5. If geopolitical production interruptions and cost increases lead to a decline in EBITDA to 30 million euros, the ratio changes:

140 million € / 30 million € = 4.67

The agreed threshold would thus be exceeded if the contractual calculation rules lead to this result. Whether this results in an immediate repayment obligation depends on the specific contract terms. However, the example shows why an operational risk can become relevant for financing, even if the company initially still has sufficient liquidity.

ESMA emphasises the importance of transparent information about financing clauses and their impacts in its review priorities.^[1]

Valuation Uncertainties and Fair Value

The term Fair Value refers to the fair market value. According to IFRS 13, it is generally the price that would be received to sell an asset or paid to transfer a liability in an orderly transaction between market participants at the measurement date. The valuation is thus based on the assumptions of market participants under relevant market conditions.^[4]

Geopolitical developments can significantly influence these assumptions. A production site, for example, may lose economic value if important sales markets permanently disappear or necessary raw materials are no longer available.

For the assessment of possible impairments of non-financial assets, IAS 36 is particularly relevant. The standard stipulates that assets must not be carried at more than their recoverable amount. This is generally derived from the higher of the value in use and fair value less costs to sell.^[5]

A BIA can provide information about operational vulnerabilities and potential interruption consequences. These can, in turn, be relevant for reviewing financial plans and valuation assumptions. However, a hypothetical BIA damage calculation is not automatically equivalent to an accounting impairment.

Disposals and Discontinued Operations

Geopolitical developments may prompt companies to divest certain locations, subsidiaries, or business activities. IFRS 5 governs the classification and presentation of non-current assets held for sale and discontinued operations. The standard requires, among other things, a separate presentation of certain assets and liabilities when the respective conditions are met.^[6] The decision to potentially exit a market does not automatically suffice for this.

For integrated resilience assessment, however, an important connection arises: If risk scenarios indicate that certain business activities are no longer economically viable under changed geopolitical conditions, this information can support strategic decisions. The subsequent accounting treatment must be independently assessed based on the relevant IFRS regulations.

Isolated Analyses

Why Separate Risk Assessments Are Not Enough

In many companies, operational risks, process criticalities, and financial impacts are assessed by different departments:

• Risk management, particularly Operational Risk Management, uses probabilities of occurrence, damage classes, and risk scores.
• Business Continuity Management examines critical business processes and their recovery requirements.
• Controlling analyses impact on results and economic performance.
• Treasury considers liquidity, financing, and cash flows.
• Accounting assesses the accounting consequences.

These perspectives each pursue independent goals. It becomes problematic when the assessments are based on different assumptions and there is no comprehensible connection between them.

For example, a production process may be classified as highly critical in the BIA, while risk management assesses the associated risk as moderate. This need not be a contradiction. The BIA particularly examines the impacts of a disruption. Risk management additionally considers the probability of occurrence and any existing controls. A very unlikely failure can have significant impacts and yet have a comparatively low expected loss. Conversely, a frequently occurring event with limited individual damage can be economically significant.

The methodological challenge is to maintain these differences while simultaneously creating a common financial assessment basis. An integrated model must not mix different assessments into a single metric. It must make their interconnections comprehensible.

The Integrated Model

From Threat to Financial Resilience

A comprehensive assessment model connects the various disciplines along a common impact chain. The focus is not on the isolated assessment of a risk, but on the question of how an event affects operational performance, what financial consequences arise from it, and to what extent the company can manage these consequences.

The Seven Levels of the Integrated Model

These levels do not form a rigid chronological sequence. Rather, there are feedback loops: Insights from the BIA can lead to adjustments in risk scenarios. New financial forecasts can alter the economic evaluation of a business process. New geopolitical developments can, in turn, challenge existing dependency analyses.

From Resource Risk to Corporate Risk

An essential component of the model is the structured consideration of resources, processes, locations, and the overall organisation. The starting point is critical resources, for example:

• Production facilities and technical infrastructure
• IT systems and digital services
• Energy and water supply
• Qualified personnel
• External service providers and suppliers

These resources enable certain business processes. A failure can affect a single process or impair multiple processes simultaneously. The risks can therefore be assessed at different organisational levels:

Resource Risk → Process Risk → Location Risk → Corporate Risk

The aggregation can be carried out using a company-specific scoring model. For example, a model can be used that gives greater consideration to particularly high individual risks than to average risks. This is intended to prevent a single critical vulnerability from being statistically obscured by numerous low-rated risks. A possible aggregation logic is:

R_aggregated = 0.7 · R_max + 0.3 · R_{weighted average}

Here, R_max describes the highest relevant individual risk score and R_{weighted average} the dependency-weighted average of the considered risks. This weighting is also used by the NOVELEDGE Risk Calculator; how resource risks are condensed step by step into process and corporate risk is described in the article on risk aggregation.

This weighting is a company-specific methodological approach, not a requirement of ESMA or an ISO standard. It must be validated in terms of its significance, scaling, and aggregation properties. In particular, such a model must not be confused with a financial loss calculation: A risk score of 80 points does not mean a probability of occurrence of 80 percent or a financial loss of 80 percent of a certain reference value. Therefore, an independent monetary impact level is required for financial evaluation.

The Financial Impact Level

This level connects the operational assessments with the economic situation of the company. It answers four different questions:

• What is the potential damage? This concerns the specific financial impacts of an event, such as additional costs, lost contribution margins, or contractual penalties.
• When does the damage occur? This focuses on the temporal development. Damage can occur immediately, with delay, or only after a prolonged interruption.
• How likely is the damage? This question is answered through risk assessment and the modelling of possible scenarios.
• How resilient is the company? This considers financial risk-bearing capacity, liquidity reserves, earnings resilience, and financing leeway.

Only the combination of these four perspectives enables a well-founded financial resilience assessment.

Business Impact Analysis

The Methodical Link

The Business Impact Analysis plays a central role within the integrated model. It examines the effects of a disruption to business activities and their progression over time. The international standard ISO/TS 22317:2021 describes the BIA as a component of a Business Continuity Management System and provides guidance on its systematic execution. Its results include, in particular, the assessment of time-dependent impacts, the identification of critical activities and dependencies, and the derivation of recovery requirements.^[7]

Why the Temporal Dimension is Crucial

A process failure does not necessarily cause significant economic damage from the outset. A manufacturing company can, for example, initially use existing stock. However, as the duration of the disruption increases, delivery obligations may be breached, replacement procurements may become necessary, or customer orders may be cancelled. The financial impacts therefore change over time.

A BIA should therefore not only capture a potential total loss but also examine its progression over defined disruption periods. Typical assessment points might be four hours, eight hours, 24 hours, 48 hours, 72 hours, and seven days. The appropriate time intervals depend on the respective business processes.

Financial and Non-Financial Impacts

The financial assessment is just one of several impact dimensions. Other impacts may include:

These dimensions should not be indiscriminately converted into a single financial figure. In particular, safety and compliance requirements may necessitate mandatory actions regardless of their monetary valuation.

MTPD and RTO

Two important outcomes of the BIA are the Maximum Tolerable Period of Disruption (MTPD) and the Recovery Time Objective (RTO). The MTPD describes the period after which the negative impacts of a disruption become unacceptable for the company. The RTO refers to the targeted period within which an activity or service should be restored following a disruption.

The RTO should fall within the tolerable disruption duration and allow sufficient leeway for the restoration of required services. ISO/TS 22317 explicitly considers the time-dependent assessment of impacts as a basis for setting corresponding requirements.^[7] How the time objectives interrelate is explained in the article on RTO, RPO, RTA and SLA. A financial damage function can make an important contribution to this.

Financial Metrics

Which Metric Carries the Financial Impact

One of the most important methodological decisions concerns the determination of financial impact thresholds. These are often defined using fixed euro amounts. A company might, for example, determine that a financial loss up to 100,000 euros is considered minor, while a loss exceeding one million euros is deemed severe. Such thresholds allow for straightforward assessment. However, without a comprehensible economic rationale, it remains unclear why these particular amounts are deemed relevant.

A loss of one million euros can be existentially threatening for one company, while it represents a relatively minor burden for an international corporation. The question, therefore, is: Which financial metric should the assessment be based on – and which metrics are explicitly unsuitable as the sole benchmark?

Revenue

Suitable for describing exposure, not as a sole measure of damage

Revenue describes the value of services provided and sold within a specific period. It is readily available and suitable for describing the economic scale of a company or business unit. However, when assessing a production outage, it should be noted that lost revenue does not automatically equate to financial damage. A company unable to fulfil an order may lose revenue, but variable production costs may also be avoided. It may also be possible to fulfil the order at a later date.

For the actual damage calculation, the lost contribution margin is often more suitable. It is simplified as:

Contribution Margin = Revenue − Variable Costs

The actual lost contribution margin must be determined based on non-recoverable services and the respective cost structure.

Assessment: Revenue is a meaningful metric for economic exposure, but not a sufficient sole measure for financial BIA impact.

EBITDA

Suitable for assessing operational profitability

For financial BIA assessment, EBITDA can be particularly relevant if operational disruptions significantly impact results or if financing agreements use such metrics. However, EBITDA is not a liquidity metric. It does not directly account for changes in working capital, investment payouts, or all financing effects. Companies with relatively high EBITDA may also develop short-term liquidity issues.

Assessment: EBITDA is a suitable supplementary reference for assessing result resilience and certain financing clauses, but should not be used alone to determine financial impact thresholds.

EBIT

Significant for assessing operational result impact

EBIT describes earnings before interest and taxes. Unlike EBITDA, it also considers depreciation. This can be relevant for assessing operational profitability, especially in capital-intensive companies. However, depreciation can affect the metric without directly triggering a cash outflow. Additionally, different depreciation structures can impair comparability between business units.

Assessment: EBIT can be a meaningful reference for assessing result impact, but it does not replace monetary damage calculation or liquidity analysis.

Operating Cash Flow

Particularly relevant for liquidity

Operating cash flow describes cash flows from ongoing business activities. It can be influenced by factors such as delayed customer payments, additional procurement costs, or increased capital commitment. It is particularly relevant for assessing financial resilience. However, historical operating cash flow alone should not be considered. What is crucial is how future cash flows develop under different disruption scenarios. Time-dependent liquidity forecasts and liquidity stress tests are suitable for this purpose.

Assessment: The cash flow perspective is indispensable for assessing short-term financial resilience. However, it is not sufficient as a sole impact metric.

Liquidity Reserve

Crucial for short-term crisis resilience

The liquidity reserve includes available cash and potentially usable financing options. It indicates which short-term financial burdens a company can absorb. Existing payment obligations, minimum liquidity requirements, and possible restrictions on the availability of funds must be considered. A company may, for example, have substantial bank balances that cannot be freely transferred within the group due to regulatory or contractual restrictions.

Assessment: Liquidity reserves are particularly important for assessing crisis resilience and liquidity. However, they are not synonymous with economic damage or overall risk-bearing capacity.

Equity and Risk-Bearing Capacity

Balance sheet equity simply describes the difference between recorded assets and liabilities. It can provide insights into economic loss absorption capacity. However, equity is not synonymous with available liquidity. A company can still encounter payment difficulties despite having positive equity.

For determining financial impact thresholds, a more comprehensive consideration of financial risk-bearing capacity is advisable. This can be understood as the financial leeway within which a company can absorb losses or burdens without jeopardising defined existence, financing, or management goals. This risk-bearing capacity must be determined individually for each company. It can be based, for example, on earnings resilience, available financial resources, capital structure, and defined minimum financial requirements.

The Metrics in Comparison

Methodological Conclusion

For an integrated financial BIA assessment, a combination of three perspectives appears particularly sensible:

1. Monetary Damage Amount: What additional costs, lost contribution margins, and other economic losses arise?
2. Relative Economic Significance: How significant is this damage in relation to the defined financial resilience or risk-bearing capacity?
3. Time-dependent Liquidity and Financing Impact: When do payment burdens arise, and could critical liquidity or financing thresholds be breached as a result?

These three perspectives should be calculated separately and then assessed together. This prevents a single metric from inappropriately mixing different economic circumstances.

Damage Progression

How the BIA becomes a financial decision-making basis

A key strength of the Business Impact Analysis is that it considers the effects of a business interruption not only in terms of their severity but also in terms of their temporal development. A production outage of four hours may cause only limited additional costs. After 24 hours, initial delivery commitments may be breached. After several days, contract penalties, additional procurement costs, or permanent customer losses may occur. Therefore, the financial damage progression is often not linear. Classic temporal evaluation stages of the BIA can thus be expanded into a dynamic financial damage function.

Example: Failure of a Critical Production Process

An industrial company operates a production facility required for supplying several major customers. Due to a geopolitically induced supply chain disruption, a critical spare part is unavailable. The facility fails. Initially, the company can use existing inventory. After a few hours, additional personnel costs and expenses for troubleshooting arise. With increasing interruption duration, customer deliveries must be postponed. Later, contract penalties, additional transport costs, and irrecoverable order losses may occur.

The following cumulative damage progression is assumed for the scenario:

The figures are fictitious and serve solely for methodological illustration. The damages can consist, for example, of lost contribution margins, additional personnel and procurement costs, contract penalties, and recovery expenses. Possible catch-up effects and avoided costs must be considered to avoid overestimating the actual economic damage.

The values indicate that damage does not necessarily increase proportionally with the duration of the interruption. Certain costs can arise immediately, while others occur only when contractual or operational limits are exceeded. The following graphic illustrates this: Select the recovery point and the financial reference size. The damage curve remains the same, but the impact thresholds shift. Additionally, a resilience measure can be displayed, ensuring recovery within 48 hours at the latest.

The graphic demonstrates that the financial criticality of a business process results from both the damage progression and the economic resilience of the company. The same failure is significant with a buffer of four million euros after three days, but already severe with half that buffer.

Connection to MTPD and RTO

From the damage curve, points in time can be derived when defined financial impact thresholds are exceeded. This can support the determination of the MTPD. However, the MTPD should not be derived solely from financial criteria. Regulatory, security-related, or other non-financial impacts can also mean that an interruption becomes intolerable at an earlier point.

The RTO describes the targeted recovery period and should lie within the tolerable disruption duration. The financial damage curve thus supports the economic justification of recovery requirements.

Impact Thresholds

How financial limits are systematically defined

One of the central challenges is to define the financial assessment classes of the BIA in an economically comprehensible manner. Many companies, for example, use four or five impact categories. However, the crucial question is not just how many categories exist, but what their boundaries are based on.

Why Flat Euro Amounts Are Problematic

A loss of one million euros does not have the same significance for every company. A company with a high liquidity reserve, stable results, and low debt levels may be able to absorb such a loss without difficulty. Another company might lose its financing flexibility due to the same loss. Flat thresholds are therefore only meaningful if they are justified based on the actual economic conditions.

Financial Risk-Bearing Capacity as a Reference Size

An appropriate starting point can be the financial risk-bearing capacity. This involves determining the financial buffer a company has without endangering defined minimum requirements. The risk-bearing capacity can result from factors such as result resilience, liquidity reserves, financing flexibility, and capital structure. It is important not to equate it simply with equity or EBITDA. Both metrics can provide information on financial performance but do not capture all aspects of resilience.

Example of a Financial Impact Scale

Suppose a company defines a financial buffer of four million euros after a corresponding analysis. For a four-level impact scale, the following hypothetical boundaries could be used:

These values are purely illustrative and do not represent normative requirements or generally suitable thresholds. In particular, it must be clarified whether a financial tolerance has been defined as an annual loss budget, a short-term liquidity reserve, or as another risk coverage measure. Different reference sizes must not be compared without methodological adjustment.

Supplementary Financial Thresholds

An assessment based solely on the extent of damage can overlook important risks. Therefore, additional financial escalation criteria should be considered. For instance, even a relatively minor damage can be critical if it results in

• a minimum liquidity threshold is breached,
• a significant covenant is violated,
• the solvency of a subsidiary is at risk, or
• necessary refinancing is no longer possible.

These events can trigger additional measures regardless of the general damage class.

Comparability within the Group and Local Resilience

Particularly for international corporate groups, the question arises as to which organisational level financial impact thresholds should be established. A purely group-wide assessment can result in existential risks for smaller subsidiaries appearing insignificant within the overall group. Conversely, entirely individual thresholds can complicate comparability. Therefore, an appropriate solution may consist of two levels:

• Company-wide uniform assessment methodology: The financial impacts are determined and evaluated according to the same principles.
• Supplementary company-specific stress limits: Local liquidity, earnings, and financing risks are additionally considered.

This ensures that assessments remain comparable without overlooking significant local vulnerabilities. The detailed derivation, calibration, and governance of such thresholds are described in the article Financial Impact in Business Impact Analysis.

Operational Risk Management

From Potential Damage to Expected Loss

The Business Impact Analysis particularly describes the effects of a disruption over time. Operational Risk Management complements this consideration by examining the causes, probabilities of occurrence, and the effectiveness of existing controls. A geopolitically induced failure of a critical supplier can, for example, cause various durations of disruption. The BIA provides the financial impacts for these periods. Operational Risk Management assesses how likely the different scenarios are.

From Potential Damage to Expected Loss

In a simple scenario model, the expected loss can be represented as follows:

EL = p × L

Here, EL stands for the expected loss (Expected Loss), p for the probability of occurrence, and L for the financial magnitude of damage. Suppose a specific production outage causes damage of 2.7 million euros and has a probability of occurrence of 5 percent within a defined year. Then it results in:

EL = 0.05 × €2,700,000 = €135,000

The calculated expected loss amounts to 135,000 euros per year, provided the model describes a single binary annual scenario with these assumptions. However, this value should not be equated with the potential actual damage. If the event occurs, the impact can still amount to 2.7 million euros.

Why Expected Loss Alone Is Not Enough

An expected loss can provide an incomplete picture, especially in the case of rare events with very high impacts. A company might, for example, have a risk with an expected annual loss of 100,000 euros, which would cause damage amounting to 20 million euros if it occurred. If this damage threatens financial viability, the risk is of high significance for resilience management despite its low expected value.

Therefore, alongside the expected loss, extreme and stress scenarios should also be considered. For more complex models, Monte Carlo simulations or other quantitative methods can be employed. It is particularly important to pay attention to common causes and dependencies between risks.

Avoid Double Counting

A central challenge arises when multiple business processes depend on the same resource. For example, if a central IT platform fails, production, logistics, and sales can be simultaneously affected. The financial impacts should not be added unchecked. A loss of revenue may already be included in several process evaluations. Therefore, a consistent damage logic is required for corporate aggregation, which considers common causes, overlaps, and interactions.

Collaboration of Departments

Who provides which information

An integrated financial resilience model requires the collaboration of various corporate functions. The challenge is not to involve as many departments as possible in every assessment. Rather, it is crucial that the right information is brought together in a coordinated methodology. Data collection, technical assessment, methodological responsibility, and management decision should be clearly separated.

Roles and Responsibilities

The organisational structure depends on the size, business model, and governance structure of the company. In smaller companies, several tasks can be combined within one function. Larger corporations often require additional coordination mechanisms between central and local units.

The Special Role of Controlling and Treasury

Controlling and Treasury are of particular importance for the financial BIA assessment. Controlling can, for example, determine which contribution margin is actually lost due to a production interruption. Treasury, on the other hand, examines how the same interruption affects available cash. These two perspectives can differ significantly.

A production outage can, for example, cause a result damage of two million euros. At the same time, the short-term liquidity burden can amount to three million euros because replacement material must be procured and additional inventory built up. The additional inventory does not automatically represent an expense of the same amount. However, it ties up cash. This is precisely why economic damage, result impact, and liquidity impact should be determined separately.

Common Data Base Instead of Parallel Assessments

For an integrated model, the participating departments should rely on common information. This includes in particular:

• uniformly defined risk scenarios
• documented resource and process dependencies
• agreed interruption periods
• transparent financial calculation assumptions
• consistent assessment dates and observation horizons
• established responsibilities for data updates

Such an approach reduces the risk of contradictory assessments. Additionally, it allows new insights from one department to systematically inform other evaluations.

Resilience Decision

From Financial Assessment to Action

The integrated assessment not only provides transparency over existing risks. It also enables an economically sound prioritisation of resilience measures.

Example: Establishing an Alternative Supplier Network

A company relies on a single international supplier for a critical production process. The BIA indicates that a seven-day interruption could cause financial damage of 4.5 million euros. The company is considering establishing a second supplier network. This could reduce the interruption duration to 48 hours in certain scenarios. Using the previously presented example data, the following results:

The measure could reduce the damage in this scenario by 2.9 million euros. This can be seen in the graphic above: When the resilience measure is displayed and recovery occurs after seven days, it shows exactly this difference. However, this amount initially only describes the potential damage reduction if the considered event occurs.

For an economic evaluation of measures, probability of occurrence, effectiveness, investment costs, ongoing costs, and remaining residual risks must also be considered. A measure with high costs can be economically justified if it reduces a life-threatening risk. Conversely, not every technically possible redundancy is economically sensible.

Resilience is More Than Damage Minimisation

An exclusively monetary perspective would still be too narrow. Companies must also consider legal obligations, security requirements, contractual minimum services, and strategic objectives. This is particularly evident for operators of critical infrastructures. Here, certain requirements for maintaining services may exist independently of whether the corresponding measure appears economically viable from a purely financial perspective.

Resilience management must therefore combine financial and non-financial requirements. The international standard ISO 22301 describes requirements for a Business Continuity Management System that supports companies in being prepared for disruptions, responding to them, and restoring their business operations.^[8]

Conclusion

A Unified Picture Instead of Parallel Assessments

Geopolitical risks become manageable for companies only when it is visible how dependencies affect business processes and what financial consequences arise over time. The ESMA’s examination priorities for 2026 make it clear that these consequences affect not only risk management but also liquidity, financing, valuation, and reporting.

An integrated assessment model therefore connects Operational Risk Management, Business Impact Analysis, Controlling, Treasury, and Accounting along a common impact chain. The BIA provides the time-dependent damage progression, risk management the probabilities of occurrence, and the financial functions the company’s resilience. It is crucial to calculate and jointly assess the three financial perspectives – damage amount, relative economic significance, and liquidity and financing impact – separately.

Aligning impact thresholds with one’s own risk-bearing capacity, avoiding double counting, and equally considering non-financial requirements provide a robust foundation for prioritising resilience measures and strategically strengthening the organisation’s resilience.

Frequently Asked Questions

Brief Answers for Practical Application

Further Reading

In-depth on BIA and Risk Aggregation

• Financial Impact in Business Impact Analysis
• Business Impact Analysis: Basics and Approach
• Risk Aggregation: From Resource Risk to Corporate Risk
• NOVELEDGE Risk Calculator
• RTO, RPO, RTA and SLA in Business Continuity Management
• BIA Template 2.0 – Excel Template for Business Impact Analysis
• Training on Business Impact Analysis

Sources

The information in this article is based on the following sources. Paid standards are not quoted verbatim; their contents are summarised. All numerical examples are fictitious.

1. European Securities and Markets Authority (ESMA): European common enforcement priorities for 2026 corporate reporting, Public Statement dated 13.10.2026, ESMA32-2064178921-9738. esma.europa.eu ↑ ↑
2. European Securities and Markets Authority (ESMA): European common enforcement priorities for 2025 corporate reporting, Public Statement dated 14.10.2025, ESMA32-2064178921-9254. esma.europa.eu ↑
3. IFRS Foundation: IFRS 7 Financial Instruments: Disclosures. ifrs.org ↑
4. IFRS Foundation: IFRS 13 Fair Value Measurement. ifrs.org ↑
5. IFRS Foundation: IAS 36 Impairment of Assets. ifrs.org ↑
6. IFRS Foundation: IFRS 5 Non-current Assets Held for Sale and Discontinued Operations. ifrs.org ↑
7. ISO/TS 22317:2021 – Security and resilience – Business continuity management systems – Guidelines for business impact analysis. Available for purchase through standards trade. iso.org ↑ ↑
8. ISO 22301:2019 – Security and resilience – Business continuity management systems – Requirements. Available for purchase through standards trade. iso.org ↑