Resources for Executives and Their Teams Amid Russia’s Invasion of Ukraine

The Russian invasion of Ukraine continues to be a humanitarian catastrophe. Our responsibility as leaders is, and continues to be, to do everything we can to ensure the safety and well-being of our employees and their families. But also we must mitigate the risks of this ongoing crisis to our organizations.

Since the invasion began, our clients have found it helpful to access insights and tools for a suite of executives, who have had to work closely together to set immediate- and longer-term strategies to ensure their organization’s operational, financial and strategic resilience.

We don’t yet know how extensive or protracted the impacts of Russia’s invasion of Ukraine will be, but we’ve found that management of a range of risks over the next one to three years has come to the forefront. Some are stable for now; others are escalating. All need preparation.

Here we outline some of the major business risks facing business leaders in the medium-term. Most important is to break down silos of business information and decision making that could slow or even stop your enterprise’s response at critical moments. You must be able to detect rapid shifts in information and then act on it quickly. If need be, issue a board edict for the CEO to force information sharing across enterprise silos to enable you to sense and respond. 

(Gartner clients can log in as usual to read a range of extensive resources related to the geopolitical, economic and business impacts of Russia’s invasion of Ukraine.) 

We hope you will find these resources to be of practical help at this time.

Chris Howard
Chief of Research, Gartner

Russia’s invasion of Ukraine has created a humanitarian crisis; executive leaders are key to advocating and implementing policies to ensure employee safety and well-being. Lessons from the COVID-19 period are applicable to other crises, but in this case, many organizations have also scaled down, paused or closed operations in Russia. Enterprise responses range from providing humanitarian aid to relocating employees in impacted regions. 

Potential business impact:

• Uncertainty and anxiety among employees could continue for an extended period given changing international relations. Social instability and polarized discussions in the workplace may disquiet employees.

• Reputational risk is at stake for enterprises that take positions or voice opinions on geopolitical issues that are out of line with those of employees and stakeholders.

• You may need to redeploy talent whose jobs have been impacted in the region (an alternative to layoffs for roles that have become obsolete).

Risk management actions:

• Provide ongoing support for employees and those who manage them. Lean on what we’ve learned from the damaging effects of the pandemic on workforce health.

• Continue to talk openly about challenges, making sure that both employees and managers feel comfortable giving and receiving information. 

• Ensure corporate communications are timely, authentic and aligned with your organization’s overall business goals.

• Build a skills inventory for transitioning employees to determine how available skills can be most effectively matched to priority initiatives. Identify destinations for talent redeployment. (See below for more on labor risks.)

Cybersecurity risk relates to events that negatively impact your organization’s critical business information, infrastructure, processes and IT assets. Vulnerabilities and threats include loss of or damage to confidentiality, integrity, availability, safety and reliability. The cybersecurity implications of Russia’s invasion of Ukraine are significant, with attacks and risks growing for information, network, cyber-physical systems (CPS) and supply chain (SC) assets.

Potential business impact: 

• Visibility and stringent business cyber governance structures are needed for ecosystems built on CPS, assets and platforms. 

• Supply chain/third-party disruptions may cause loss of assets and information and legal and financial impact. 

• New/reprioritized investments and resources are necessary to counter, recover from and prevent cybersecurity attacks.

Risk management actions:

• Establish a governance process that includes the CEO and key operational staff in the event an incident occurs. 

• Update your asset inventory to improve visibility of critical assets. 

• Invoke crisis management, business continuity management (BCM) and third-party contingency plans for Ukraine- and Russia-based providers.

• Reevaluate risks of single points of failures such as end-user training.

• Rely on threat intelligence tailored for your organization. Watch for guidance from government agencies.

Expect significant supply chain issues, including:

• Shortages

• Cost increases

• Demand volatility

• Capacity constraints

• Cybersecurity breaches

Supply chains, already severely disrupted by the COVID-19 pandemic, are under additional and potentially severe pressure from Russia’s invasion of Ukraine. The conflict brings with it both localized supply chain challenges and global impacts, such as inflationary pressure and supply issues with raw materials and finished goods. Organizations will need to mitigate supply chain risk to combat market disruption.

Beyond general efforts to counteract instability in your supply chain, continue to commit to and secure product supply volumes for the most fragile supply chains, and increase resilience by deploying strategic redundancies.

In the longer term, there are also geopolitical risks resulting from Russia’s invasion of Ukraine, in particular, that may accelerate the transition to a multipolar world with competing political and economic blocs. Nations may renationalize supply chains to reduce dependencies and increase self-sufficiency, potentially creating competition and conflict over natural resources. Critical supply chains for key infrastructure and products could be pushed near, on-shore or into “friendly” countries.

Potential business impact: 

• Competition for critical resources prompts regulatory interventions.

• Government purchasing causes resource costs to rise.

• Access to materials is tied to national security; restrictions on exports impact global refinement and manufacturing operations.

• Indiscriminate, episodic impact on global supply chain operations affects service quality to customers.

Risk management actions:

• Seek opportunities to diversify supplies of raw materials and components across multiple markets and suppliers in different regions.

• Hedge against forward price increases using financial derivatives or long-term contractual commitments.

• For highly concentrated supply chains, increase inventory to cover short-term breaks in supply. 

• Analyze existing supply chains to identify risks, and work with suppliers to implement corresponding controls and mitigations.

• Develop an appropriate cadence to manage and communicate service impacts.

Migration of both skilled and unskilled labor from impacted conflict zones to other countries requires cultural, political and societal integration and adjustments. This creates new labor risks (and opportunities). 

Potential business impact:

• Increase in availability of labor due to inflows of migrants to host countries, but a lack of certainty about the duration and permanence of this migration

• Labor shortages resulting in rising costs of key items imported from Ukraine (e.g., wheat) and other impacted areas

• Increase in key skilled labor confined to impacted areas due to polarization

Risk management actions:

• Support migration of desk-based labor by adopting work-from-anywhere policies and on-site labor by issuing visas and partnering with regulatory authorities to facilitate legal work for migrants.

• Build cultural diversity into business operations, facilities, work hours and engagement.

• Include migration risk in local site analysis.

Beyond the risk of nationalized supply chains, the major political risk following Russia’s invasion of Ukraine is the potential for the conflict to escalate or expand. New conflicts could occur due to: 

• Diminished norms regarding the use of military force

• Increased perception of international threats 

• Arms racing through increased military spending

• Heightened nationalism

• Other ideological fractures

Potential business impact:

• Ruptured value chains in affected regions and sanctioned countries 

• Higher commodity and energy costs, stemming from affected production and transit areas and government and military demand

• Negative effects on employee safety, well-being and workforce health coupled with employee demands for organizational response

• High borrowing costs from conflict-related inflation and interest rates

Risk management actions:

• Account for various conflict scenarios in crisis planning and develop resilient organizational, business unit and functional strategies.

• Pressure-test business continuity management processes through regular tabletop exercises.

• Target your focus on agility in business more than on operational excellence and efficiency.

• Assess whether to cease or reduce commercial operations in areas affected by conflict (or high probability of conflict) and sanctioned countries.

Increased international economic sanctions, export controls and technology transfer restrictions imposed on and by Russia will result in higher compliance costs for cross-border operations or lead to further exclusion from certain markets and geographies/jurisdictions.

Executive leaders who make defensible, risk-informed choices are, from response through recovery, more likely to create resilience for their organizations. Geopolitical risks often move quickly and unpredictably while imposing an extensive impact on business performance. Leverage location-specific risk management strategies to equip your organization to manage these urgent threats.

Potential business impact:

• Increasing numbers and breadth of sanctions by and on regimes will require formal, structured processes to track and assess impacts.

• A variety of jurisdictional requirements will make compliance increasingly complex and onerous.

• Failure to adequately meet regimes' economic, financial, trade or other sanctions can result in significant fines.

Risk management actions:

• Educate stakeholders on what is required under the sanctions approaches of different jurisdictions. Explain the need to look at who controls sanctioned businesses.

• Subscribe to government sanctions alerts for the jurisdictions in which you operate or otherwise transact business.

• Prepare assessment checklists to support rapid decision making.

• Protect against future issues by including contractual protections in new contracts and explaining sanctions risks to business partners