Managing the risks and fallout from Russia’s invasion of Ukraine - by dr. Jay Grusin & Steve Lindo

managing the risks and fallout from Russia’s invasion of Ukraine

by dr. Jay Grusin & Steve Lindo

inter-connectedness magnifies uncertainty

Both the COVID-19 pandemic and climate change have demonstrated that major disruptions today produce far-reaching, unintended consequences, due to the increased interconnectedness of global commerce, communications, technology, and politics. It’s no surprise, therefore, that Russia’s invasion of Ukraine has introduced unprecedented uncertainty into the well-laid plans of organizations across every industry and geography.

The list of activities where organizations are exposed to direct or indirect loss as a result of Russia’s invasion of Ukraine is a long one. Table 1 below provides a non-exhaustive list of examples. Table 1

crisis decisions require a different process

Most organizations are ill-prepared to make high-stakes decisions in situations involving extreme uncertainty, such as the armed conflict in Central Europe, because of the relative infrequency and different dynamics of such decisions, as shown below in Table 2.

Decisions involving activities like the ones listed in Table 1 require a structured, methodical approach, which promotes slow and disciplined thinking, respect for uncertainty and complexity, and active participation by all key stakeholders. For over 30 years, the US intelligence services have been using such methods, known as Structured Analytic Techniques, which were adapted for business use in our 2021 book.1

The method we describe, called Intelligent Analysis, brings rigor to uncertainty, tests high-stakes decisions, and counters authority, group-think, cognitive biases, and emotions. It comprises a five-step process:

Table 2

1. Identify the audience, their priorities, and the Key Intelligence Question:

Who in the organization will make the decision, and what are their priorities?

The Key Intelligence Question (KIQ), meaning: what problem are they trying to solve?

2. Record the Working Assumptions: list all plausible assumptions—conditions that must persist—in order for the desired outcome to occur.

3. Select the Key Assumptions: the five or six assumptions most critical to the desired outcome.

4. Use the Key Assumptions Check to rate the level of certainty and quality of the data that supports each assumption, then use the ratings to select the Linchpin Assumption(s)--the one or two Key

Assumptions crucial to achieving the desired outcome.

5. Communicate your assessment and recommendations to the decision-makers.

1 / Grusin, J. & Lindo, S. (2021). Intelligent Analysis – How to Defeat Uncertainty in High-Stakes Decisions (available from Amazon KDP). Intelligent Risk Management Publications.

testing high-stakes decisions: Russia-Ukraine invasion example

Below we give a brief example of how a financial institution can use the five steps of Intelligent Analysis to manage its risks and the potential fallout from Russia’s invasion of Ukraine.

Bank Vanderbilt, a diversified bank with global reach, is required to comply with multi-jurisdictional laws that require the prevention and reporting of accounts and transactions involving entities who may be conducting organized crime, money-laundering, terrorism, or be owned or controlled by companies or individuals domiciled in sanctioned countries. Suddenly, the wave of sanctions imposed in 2022 by the US government, Canada, EU, UK, and other countries in response to Russia’s invasion of Ukraine, imposes a deluge of new requirements that mean hundreds of accounts and transactions may need to be reclassified as potentially unlawful.

The bank has to decide whether to wait for specific regulatory instructions on how to restrict its activities with newly-sanctioned accounts and transactions, or to pre-emptively apply restrictions limiting its business with Russian entities. The heads of commercial banking, wealth management, trade finance, compliance and legal counsel advise waiting for specific regulatory instructions. The Chief Risk Officer (CRO), however, decides to convene an interdisciplinary Task Force to analyze the situation and make an independent recommendation.

The Task Force’s first step is to craft the KIQ. The Task Force develops three possible KIQs that would meet the CRO’s requirement:

Alternatives a) and b) address only narrow perspectives of the bank’s business and would lead to an incomplete or biased response to the question. The Key Intelligence Question therefore is c) because it addresses the entire breadth of the bank’s business.

Background

Step 1: Identify the Key Intelligence Question (KIQ)

a. How many Russian accounts, loans and transactions does the bank handle and how much money is involved?

b. How much revenue could the bank lose by restricting its business with Russian entities?

c. To what extent could the bank be impacted by fines, reputational damage and/or loss of other business if it waits for specific instructions before implementing the new sanctions?

Step 2: Develop a list of Working Assumptions

Table 3 below provides a non-exhaustive list of plausible Working Assumptions in no particular order.

The Task Force selects the five Working Assumptions which it considers to be most critical to achievement of the bank’s desired outcome. Table 4 shows the ones which they select. Table 3

Step 3: Select Key Assumptions

Table 4

Step 4: Use the Key Assumptions Check and Determine the Linchpin Assumption(s)

The Task Force now assesses the validity of these five Key Assumptions, using the Key Assumptions Check (KAC), which rates the amount and reliability of supporting data, the interdependence of the assumptions, and their degree of criticality. An example of these ratings is shown below in Table 5. The KAC focuses on testing the validity of the estimated probability (highly likely) of the desired outcome stated at the top of the KAC table.

Table 5

What the columns mean:

- Ratings in columns 2 and 3 gauge the level of certainty and reliability in the available evidence. - Ratings in column 4 measure the assumptions’ interdependence. - Ratings in column 5 measure the impact of each assumption’s strength/weakness on the estimated probability of the desired outcome. It is a separate discussion, not an average of columns two, three, and four.

The ratings shown in Table 5 demonstrate the following:

1. (Column 2) Vanderbilt’s reporting systems are not sufficiently accurate or complete in order to identify all of its business activities with entities owned or controlled by Russian corporations or individuals, who often conceal their identity behind shell companies or proxies. 2. (Column 2) In spite of international condemnation of Russia’s invasion of Ukraine, there is little hard evidence predicting how shareholders, regulators or customers will react if they learn the scale of Vanderbilt’s business with entities owned and controlled by Russian corporations or individuals. 3. (Column 4) Public disclosure of Vanderbilt’s business with entities owned or controlled by Russian corporations or individuals is the only assumption which is highly likely to cause the desired outcome to fail, and therefore is the Linchpin Assumption. 4. (Column 5) If any of the five Key Assumptions proves incorrect, Vanderbilt’s desired outcome will fail.

Step 5: Assessment and Recommendations

Based on the above Key Assumption ratings, the Task Force assesses the probability that Vanderbilt will be impacted by fines, reputational damage or loss of other business if it waits for specific instructions before implementing the new Russia sanctions as being likely, which contradicts the earlier recommendation of the heads of commercial banking, wealth management, trade finance, compliance and legal counsel. The Task Force therefore submits the following assessment and recommendations to the Chief Risk Officer:

Before making any decision, the bank should:

- Investigate: Conduct a thorough internal investigation in order to accurately identify all its business activities with entities owned or controlled by Russian corporations or individuals. - Evaluate: The profitability of all its business activities with entities owned or controlled by Russian corporations or individuals. - Assess Materiality: If the resulting scale of the bank’s business activities with entities owned or controlled by Russian corporations or individuals is significant, the bank could suffer significant negative consequences if this were to be publicly disclosed, such as by a politically-motivated employee or a phishing attack. - Terminate: If the profitability of the bank’s business activities with entities owned or controlled by Russian corporations or individuals is only marginal, the bank should immediately take steps to terminate or reduce these activities, in order to mitigate the potential negative impact of disclosure.

- Prevent: The bank should strictly prohibit new activity with entities owned or controlled by Russian corporations or individuals, and ensure that watertight controls are in place to prevent any from occurring. - Re-evaluate: While Russia’s invasion of Ukraine is ongoing, the bank should update this Key Assumptions Check at least monthly, or sooner, in the event of any significant developments.

conclusion

While the above example shows the application of Intelligent Analysis only in the area of sanctions, its use is equally valid for testing decisions in all the other activities listed in Table 1. Regardless of what industry sector they’re in, risk managers can use this, or any other suitable method, to rigorously test their organization’s decisions when the stakes and level of uncertainty are as high as currently caused by Russia’s invasion of Ukraine.

authors

Dr. Jay Grusin

Dr. Jay Grusin is a highly-regarded expert on intelligence analysis. After a career of 29plus years with the Central Intelligence Agency, in 2008 Dr. Grusin joined Leidos (then part of SAIC) and then, in 2012, established the Analytic Edge, to bring intelligence training to public and private sector organizations outside the US Intelligence Community. Since 2019 he is also Co-Principal of Intelligent Risk Management LLC.

He and Steve Lindo are co-authors of “Intelligent Analysis – How to Defeat Uncertainty in High-Stakes Decisions,” published by Amazon KDP. During his tenure at the CIA, Dr. Grusin was a member of the Senior Intelligence Service, was instrumental in creating and delivering a training course which redefined how analytic tradecraft would be taught and became the foundation of the Directorate of Analysis tradecraft training curriculum. He also led the development and delivery of the first sequenced management/ leadership curriculum. He is a Central Intelligence Agency University certified instructor, with over 20,000 hours of classroom experience instructing analysts and their managers, and received the Distinguished Career Intelligence Medal in recognition of his contributions to the Agency. Dr. Grusin has a BA from Bradley University and an MA and PhD from the University of Arizona.

Steve Lindo

Steve Lindo is a financial risk manager with over 30 years’ experience managing risks in banking, asset management and insurance. He currently is Lecturer and Course Designer in Columbia University’s MS in Enterprise Risk Management program, as well as Principal of SRL Advisory Services, an independent consulting firm specializing in risk governance, strategy, modeling, data and regulation.

He is also Co-Principal of Intelligent Risk Management LLC, an executive education and advisory partnership which uses analytical methods pioneered by the US intelligence services to enhance decision-making by organizations across all industries.

He and Dr. Jay Grusin are co-authors of “Intelligent Analysis – How to Defeat Uncertainty in High-Stakes Decisions,” published by Amazon KDP. His earlier career includes executive positions with Fifth Third Bancorp, GMAC Financial Services (now Ally Financial), Cargill Financial Services, First National Bank of Chicago (now part of JPMorgan Chase) and Lloyds Bank, in the US, UK, Spain and Brazil.

In 2010, he completed a two-year engagement as PRMIA’s Executive Director. He is a regular presenter at conferences, webinar host and author of risk management articles and case studies. He has a BA and MA from Oxford University and speaks fluent French, German, Spanish and Portuguese.