Use supply-chain mapping and risk-modeling to find the weakest links, and redesign your operations for a more fractured world.
Russia’s invasion of Ukraine, apart from being a humanitarian crisis, has revealed a hard truth: today’s operations are exposed to systemic geopolitical disruptions on a scale that many companies and governments are unprepared for. The war has driven up the price of energy and food worldwide. And with planting seasons interrupted, production facilities damaged or destroyed and key ports blockaded, it is unlikely that supplies of vital commodities on which much of the developing world depends will resume anytime soon.

In this unstable and difficult-to-model environment, leaders need to get to grips with the PLUTO environment. This IESE-coined term stands for Polarized, Liquid, Unilateral, Tense and Omnirelational. Underestimating low-probability but high-impact scenarios is poor management, warns Eduard Calvo. He urges executives to plan for supply-chain shocks rather than simply calculating their likelihood of occurring.

It’s not about avoiding the storm; it’s about being ready to endure it. Resilience, not just efficiency, is the new imperative.

Resilience costs — but no resilience costs more
Mike Rosenberg uses this metaphor: In 2018, a hurricane devastated Mexico Beach, Florida. Amid the destruction, one house remained standing. It had been deliberately built to withstand such force, with reinforced foundations, impact-resistant windows and a design meant to absorb damage without collapse. “That’s the essence of business resilience,” he says, “not preventing impact but absorbing it and continuing to operate.”

Resilience cannot be improvised, says Jordi Canals, but takes foresight, investment and discipline. And yes, it’s expensive, he concedes, but the cost of not building resilience is far greater. He advises boards and executives to rethink resilience across five interdependent fronts, backed not only by financial buffers but by structural readiness and strategic agility.

5 key dimensions of organizational resilience

Case Study: TSMC
Many companies’ operations have relied on supply chains that ran smoothly in a world without any macroeconomic or geopolitical frictions — but that’s not the world we live in today. Taiwan Semiconductor Manufacturing Company (TSMC) is a case in point. This one company produces over 90% of the advanced microchips on which entire industry sectors depend. The COVID-19 pandemic was a wake-up call to the dangers of overly concentrating manufacturing capacity in certain geographic locations. U.S.-China tensions have accelerated the reshoring or nearshoring of components considered critical for national security. This has forced TSMC to expand beyond its island base in the contested South China Sea.

All companies must grapple with the same key questions: Which operational efficiencies are we prepared to give up and what costs are we prepared to assume in order to hedge risks in today’s tumultuous environment?
Read the full story

Despite the 2020 pandemic being a wake-up call, Calvo finds that necessary structural changes to global supply chains have, for the most part, not been made in the five years since. But betting against the recurrence of another black swan event is a losing game, he says, as evidenced by the massive blackout in Spain and Portugal that took everyone by surprise on April 28, 2025.

And the vulnerabilities are not just physical but digital. Cyberattacks, though ruled out for causing the blackout, are growing in scale and impact. In 2024 alone, over 183,000 companies were compromised through supply chain breaches, according to WatchGuard. And the malicious use of AI to attack entire chains is the most feared risk for 2025.

“Supply chains have become the weakest link,” warned Jaime Calvo Alfonsin of Banco Santander at the 20th Banking Industry Meeting in Madrid. Internal firewalls are not enough; your defense must extend across the chain.

This is reflected in tough new EU regulations like the Digital Operational Resilience Act (DORA) and the Network & Information Systems Directive 2 (NIS2), which impose strict accountability for digital risk not just within companies but across their entire supplier and technology networks.

With cyberattacks increasingly another form of warfare between nations, companies must do all they can to limit their exposure in certain markets, putting appropriate protocols, contingency plans and security measures in place.

Get the board on board

Resilience is not something to be delegated to the operations team only. “It’s the fiduciary responsibility of the CEO and the board of directors to plan ahead and insulate the company from catastrophic disruptions caused by civil unrest, war and other geopolitical calamities,” states Rosenberg. “The problem is that CEOs and board members often don’t have the time, background or knowledge to dig deep into the issues affecting all the disparate countries and regions in which the company operates.”

To inform the board’s thinking, he suggests they hold scenario-planning workshops and invite international security experts along with managers from specific regions. This will help in setting KPIs and for continuity and operational risk planning. However, bear in mind that some precautions, like building slack into supply chains or taking out extra insurance, means spending money today to be prepared for eventualities tomorrow that may never materialize. This will impact your KPIs.

Design for disruption, not just efficiency
Lean management and just-in-time principles, long the gold standards of operational excellence, only work when there is high predictability in both supply and demand. “I always say that while lean management is good, lean dogma is bad,” notes Calvo. At times like these, effectiveness — ensuring you have what you need when you need it — trumps efficiency.

Joan Jané, drawing on his study of the U.S. drive to reshore manufacturing, emphasizes the importance of supply-chain mapping and risk-modeling tools to identify bottlenecks and make vulnerabilities visible, thereby improving operational responsiveness.

The weakest links
Here are some recurring weak links in supply chains — and actions to address them.







Plan for multiple futures and seize the opportunities

In any case, leaders must prepare for multiple geopolitical futures — and align capacity strategies accordingly. As part of scenario planning, categorize which aspects are fixed (geographical realities), semifixed (sociopolitical, with the potential to change over a period of time) and current (events in flux or unfolding). After all, tariffs can shift overnight while factories take years to build.

Whatever decisions you make must be assessed with care. In this effort, tech aids like Internet of Things (IoT) sensors and AI-assisted predictive analytics can help with data-driven decision-making.

“Executives should calculate the total cost penalty of localization by product,” adds Jané, “factoring in labor cost differences, logistics savings, loss of scale effects and automation offsets. This includes determining the product-specific ‘tariff tipping point’ — the threshold at which tariffs make local production more viable than importing.” The cost penalty of localizing smartphone assembly, for example, is not the same as for battery cells.

Amid all the doubts, Canals encourages leaders to seize the opportunities afforded by the changed landscape. For every downside, there are upsides for many sectors, and companies operating in these sectors should seek to capitalize on them. “The new geopolitical context is opening opportunities that until now did not exist or remained latent — opportunities that senior executives should approach with an entrepreneurial mindset and spirit, and with a level of resilience appropriate to the new circumstances.”



Artigo publicado no IESE insight