How the 2026 energy crisis rewrites the value proposition of risk governance — and why the window to act is closing faster than most organizations realize.
This essay was written in the first days of March 2026, as the Strait of Hormuz fell effectively silent and the first true energy shock in nearly fifty years began to take shape. It is not a piece about oil prices. It is a piece about institutional memory, organizational value, and the recurring pattern by which risk governance functions spend years operating as invisible infrastructure — only to become the most consequential room in the building the moment the assumptions holding everything else up begin to crack.
The argument is simple but the implications are not. We are at the beginning of a regime change in how sophisticated organizations must think about risk. The professionals who understand this first — and act on it with urgency — will define the next era of the discipline. The ones who wait for consensus will be executing someone else's framework.
A long-form analytical piece directed at senior risk leadership across industries. Not a briefing memo. Not a market update. An argument — made carefully, with evidence, about what the current moment actually requires from the risk governance function.
There is a pattern so consistent across industries, geographies, and market cycles that it deserves to be treated as a structural law rather than an observation. Risk governance, in virtually every organizational context, is invisible when things are working and indispensable when they are not. The function exists, it is staffed, it has budget and reporting lines and a seat at the table. But in calm conditions, its actual influence over institutional decision-making is roughly proportional to the attention paid to smoke detectors — acknowledged, required, and almost entirely ignored until the moment they matter most.
The function is valued least in the conditions under which it was designed to operate, and most in the conditions for which its frameworks were never built.
This is not a critique of the professionals in the function. It is a critique of the structural incentives surrounding it. In a low-volatility environment with rising asset values and stable counterparty behavior, the path of least organizational resistance is to treat risk governance as a compliance exercise. Checklists get completed. Memos get filed. Sign-offs get obtained. The function processes reviews through frameworks built for a world that is, at the moment of their construction, working reasonably well.
The irony is precise and painful. The function is valued least in the conditions under which it was designed to operate, and valued most in the conditions for which most of its frameworks were never built.
COVID-19 in 2020 was the most recent illustration at scale. When global supply chains froze, force majeure clauses became relevant for the first time in decades, and organizations faced the prospect of zero revenue with fixed cost structures, the institutions that had invested in genuine intellectual depth navigated the crisis with material advantages in speed, clarity, and capital preservation. The ones that had optimized for procedural efficiency found themselves making billion-dollar decisions based on intuition in the absence of any functional framework for what was actually happening.
The lesson was taken seriously for approximately eighteen months. By late 2021, as markets recovered, the pressure to streamline, automate, and reduce the overhead footprint of the risk function reasserted itself with the same quiet inevitability it always does. The organizational memory of crisis is short. The structural incentives that produce the rubber stamp problem are permanent.
We are now, in March 2026, at the beginning of a new episode in this recurring pattern. The difference this time is that the triggering event is not a biological shock or a financial contagion. It is a structural disruption to the physical infrastructure of the global economy — one that, depending on its duration, has the capacity to invalidate assumptions embedded in risk frameworks across every industry simultaneously.
The distinction is not semantic. It is the most important analytical separation a risk professional can make in the current environment, and the failure to make it cleanly is already producing serious errors in how organizations are responding to what is happening.
A market correction, even a severe one, leaves the underlying architecture of the global economy intact. Risk frameworks built for the previous environment require recalibration — inputs change, thresholds move — but the fundamental logic of the models holds. A regime change is different in kind, not degree. It does not adjust the inputs to existing frameworks. It invalidates the assumptions on which the frameworks were built.
| Market Correction | Regime Change (Current) | |
|---|---|---|
| Nature | Prices adjust within a stable operating environment | The operating environment itself becomes structurally unreliable |
| Framework effect | Recalibration — same logic, different inputs | Reconstruction — different logic, different foundations |
| Time horizon | Cyclical — conditions normalize toward historical baseline | Structural — a new baseline is established, potentially permanently |
| Value of risk function | Procedural — execute existing frameworks efficiently under pressure | Strategic — architect the frameworks that do not yet exist |
The models do not need new inputs. They need to be rebuilt from different foundations — and the organizations that begin building before the commission arrives are the ones that get to shape what the new framework looks like.
Consider the assumptions quietly embedded in the standard risk frameworks currently in use across most organizations. Energy cost forecasts underpin every operational model for every company in every energy-intensive sector. Shipping cost assumptions are baked into supply chain resilience assessments. Geographic distribution of supply chains was designed around a world in which global transit was reliable and insurable. Each of these assumptions is now under simultaneous stress — not because of a single company's failure or a single market's correction, but because the physical infrastructure that the entire global economy assumes to be available has become unreliable in a matter of days.
There is an observation from the legal profession that translates directly to risk governance and is almost never made explicit. When regulatory environments become unstable — new administrations, changing compliance landscapes, novel legal risks with limited precedent — the instinctive reaction from clients and organizations is anxiety and retrenchment. The reaction from experienced counsel is structurally the opposite.
Uncertainty does not reduce the demand for expert navigation. It multiplies it, often nonlinearly. Every layer of the organization suddenly needs the kind of analysis that cannot be delegated to a junior associate with a checklist. The executives need to understand what is actually happening. The board needs to understand the exposure. The operating teams need to understand how their assumptions have changed.
Chaos is not the enemy of the expert adviser. It is the condition that makes the expert adviser irreplaceable.
All of that demand flows upward, to the most senior people in the function who can actually answer those questions with authority. The risk governance professional who has spent a career understanding how organizational risk frameworks are constructed is most valuable precisely when those frameworks need to be reconstructed.
This is not an argument for complacency about job security. The risk governance professionals who will benefit from this dynamic are specifically those who move — who see the window, understand its duration, and use it to demonstrate capabilities that were previously undemonstrated because there was no occasion to demonstrate them.
Regime changes produce a period of genuine uncertainty in which the value of intellectual leadership in risk is exceptionally high, followed by a gradual stabilization in which new frameworks become established and the function begins its slow drift back toward procedural invisibility. The organizations that act in the window emerge from the crisis with better frameworks, better-positioned risk leadership, and a more accurate organizational understanding of what the function is actually worth.
The practical question for senior risk professionals is specific: what, concretely, does it mean to use this window? What does the new framework actually look like, and how does one go about building it in an environment where the situation is still evolving?
The starting point is an honest audit of what the existing framework was assuming that may no longer be true. Identifying those assumptions is not an indictment of the people who built them. Every framework is built for the conditions that exist at the time of its construction. The professional value is in being the person who identifies the gap first.
The assumptions most likely to be materially impaired fall into four broad categories, each with cross-industry applicability:
Every operational model for every energy-intensive sector embeds a range assumption. Those ranges were calibrated to historical volatility — not to a scenario in which 20% of global supply becomes inaccessible. Rebuild under $90, $110, $130, $150/bbl scenarios. This work should be underway within days, not weeks.
Post-COVID resilience frameworks addressed concentration within supply chains. The current disruption adds transit route dependency. Organizations whose supply chains route through the Persian Gulf — directly or through downstream suppliers — face exposure that was not part of the post-COVID rethink because it was treated as a tail scenario.
Borrowers already navigating elevated rates and a maturity wall now face significant energy and logistics cost increases at exactly the moment when refinancing options are most constrained. The counterparty risk implications of this compounding are not captured in models that treat energy price risk and credit risk as separate assessments.
For decades, geopolitical risk has been treated as an overlay — added when a specific deal triggers explicit concern, not a baseline assumption. The organizations that build geopolitical exposure assessment into their standard governance process — as a required chapter in every material risk assessment — will be operating with a more accurate picture of their actual risk profile.
The sixty-to-ninety day estimate reflects the typical organizational lag between the onset of a disruptive event and the moment when leadership begins formally commissioning the new framework. The organizations that begin building before the commission arrives are the ones that get to shape what the new framework looks like. Those that wait for the commission are executing against a brief written by someone else.
There is a view, increasingly prevalent in certain corners of the financial and technology industries, that the current energy disruption is a temporary inconvenience in the context of a longer-term transition to AI-driven and renewable-energy-powered economic growth. This argument contains a fundamental conflation that risk professionals should not allow to stand unchallenged in their organizations.
Energy transitions do not happen in parallel with supply crises. They happen after them, at enormous cost, over timescales measured in decades rather than quarters. The global energy system is a physical infrastructure of extraordinary scale and complexity — pipelines, refineries, tanker fleets, storage facilities, distribution networks — built over a century to run on hydrocarbons. The capacity to replace meaningful portions of that infrastructure does not exist at a scale that is relevant to the near and medium-term economic consequences of a Hormuz closure.
AI is not an energy-light technology. The data center buildout that makes large-scale AI possible is among the most energy-intensive construction programs in human history. A Hormuz disruption does not run on a separate track from the AI investment thesis. It is a direct cost input and infrastructure dependency that sits underneath it.
The broader point is about analytical clarity in the face of convenient narratives. The most dangerous moment for a risk governance function is not when everyone agrees that a risk is serious. It is when a compelling alternative narrative provides organizational permission to discount a risk that is, on the evidence, material. The professional obligation of senior risk leadership is to ensure that organizational decision-making is not distorted by narrative convenience — that the actual exposure is understood regardless of whether that understanding is comfortable.
The COVID-19 pandemic produced a genuine and lasting change in how sophisticated organizations think about resilience. The post-COVID response — reshoring initiatives, supplier diversification mandates, force majeure clause rewrites — was the organizational world's attempt to rebuild its risk frameworks around resilience rather than efficiency. It was the largest single revision of corporate risk architecture since the 2008 financial crisis rewrote assumptions about counterparty and liquidity risk.
The current moment has the potential to require a second, larger revision — one that builds on the COVID lessons but extends them into a domain that post-COVID frameworks did not adequately address. COVID established that supply chains can break. The current disruption is establishing that the geopolitical architecture underwriting the stability of global trade for the past several decades cannot be assumed to be permanent.
| Post-COVID Framework (2021–2025) | The Framework Now Required | |
|---|---|---|
| Core lesson | Supply chains can break; concentration is dangerous; resilience requires redundancy | Geopolitical stability cannot be assumed; multipolarity is a planning input, not a tail scenario |
| Energy assumption | Model price risk; assume availability | Model availability risk alongside price risk; chokepoint closure as base-case scenario |
| Role of risk governance | Execute enhanced frameworks faster; improve scenario breadth | Architect new frameworks from first principles; provide strategic intelligence to executive leadership |
The opportunity — and the obligation — for senior risk leadership now is to undertake the genuine reassessment rather than the recalibration. To ask not what needs to change in the existing model, but what the existing model was assuming that the current world has revealed to be wrong. To build the framework for a world that is multipolar, energy-constrained, geopolitically contested, and structurally less stable than the one in which current risk architecture was designed.
That is not a comfortable assignment. It requires acknowledging imperfection in existing work, uncertainty about the future that cannot be quantified precisely, and the willingness to present conclusions that cannot be fully supported by historical data because the historical data is no longer a reliable guide to the present. It requires, in short, exactly the kind of judgment that distinguishes a senior risk professional from a senior risk administrator.
A physician in peacetime and a physician in wartime hold the same credential and carry the same training. The difference is not in their capabilities. It is in the stakes attached to those capabilities, the visibility of their decisions, and the organizational dependence on their judgment. Risk governance is exactly this. The function does not become more capable during a crisis. It becomes more consequential.
The current moment is, by most serious assessments, the most significant test of global risk management architecture since the 2008 financial crisis. The frameworks for navigating it do not yet exist in finished form anywhere. They are being written right now, by organizations and individuals with the clarity and urgency to understand what is actually required. The window is open. It will not remain open indefinitely.
The smoke detector has been going off for several days.
The question is what you do next.
Restricted distribution · Senior risk professionals only · No advertising