When Resilience Earns Its Keep

A Question Worth Asking Honestly

For many businesses across the GCC, Governance, Risk & Compliance has felt, until recently, like a quiet corner of the organisation, a function that produced policies, satisfied auditors, and otherwise stayed out of the way of doing business.

The events of the past several months have changed that conversation entirely.

Since the conflict between the United States, Israel, and Iran escalated on 28 February 2026, the Strait of Hormuz has been effectively closed, tanker traffic through it fell at its lowest point to roughly 5 percent of pre-conflict levels, and air traffic across the region has been disrupted by drone activity, including incidents that briefly suspended operations at Dubai International Airport on 1 March and again on 16 March. Maritime war-risk insurance, which traded at around 0.1 to 0.25 percent of hull value before the war, has surged to between 1 percent and 8 percent and at peak reached 10 percent, a multiple of the pre-crisis cost that has, in itself, kept much of the Gulf's commercial shipping at anchor.

Against this backdrop, business leaders are right to ask a direct question: does our GRC function help us through this, or is it overhead while the conditions around us change by the day?

The honest answer, with respect, is: it depends on which version of GRC you have built, and, more importantly, what you do with it from here.

The Version That Needs Updating

If a risk and compliance function runs primarily on quarterly committee reviews, annual policy refreshes, and mandatory e-learning, it is not built for an environment in which conditions change inside a single business day. This is not a reflection on the professionalism of compliance teams across the region, many of whom are genuinely excellent, but on an architecture that was designed for steady-state regulatory reporting, not for live decision-making under pressure.

Geopolitical escalation moves in hours. A framework reviewed nine months ago has limited grip on it. In a fast-moving environment, that model produces paperwork and a sense of control rather than the control itself, and both can become liabilities rather than protections.

The encouraging news is that the gap between “what we have” and “what we need” is not as wide as it may appear. Most Gulf businesses already have the people, the policies, and the technology in place. What is needed is a deliberate shift in how those elements are used, and that shift is achievable in weeks, not years.

What the Disruption Actually Creates

Consider a mid-sized GCC trading company, with regional distribution, reasonable supplier diversification, a procurement function that has stress-tested its supply chain before. Here is the shape of what March of this year looked like for many such businesses.

A primary supplier in Bandar Abbas goes dark. Operations issues a directive: secure an alternative within 48 hours; cost is a secondary concern. Under that pressure, the standard three-week vendor verification compresses to same-day approval. A new supplier from a third jurisdiction offers immediate availability at a reasonable price. What may not be checked, because there is no fast-track verification process in place, is whether that new vendor is a front company connected to a network the U.S. Office of Foreign Assets Control (OFAC) has recently designated.

This is not a question of recklessness on anyone's part; it is a question of whether the compliance infrastructure was built to keep pace with the speed at which the business is being asked to operate. A single transaction in those circumstances can carry sanctions exposure. And under OFAC's strict liability standard, the absence of intent is not, on its own, a defence.

This pattern, supplier disruption, emergency procurement, fraud and sanctions exposure, is unfolding across Gulf businesses today. The companies navigating it well are not the ones with the thickest frameworks. They are the ones that built lean, fast verification protocols in advance, and have them ready to run when needed.

Emergency Procurement: Where Fraud Walks In

When primary suppliers fail and the directive is “find someone quickly,” several things tend to happen at the same time:

• Standard vendor onboarding timelines compress from weeks to hours.
• Financial controls are deferred under the understanding that paperwork will follow.
• Single-source approvals replace competitive tendering.
• Oversight of unusual payment terms including pre-payment, third-country routing, unfamiliar account structures, relaxes.

Every major supply-chain disruption in recent memory, SARS in 2003, Fukushima in 2011, the Suez blockage in 2021, and COVID-19, produced a similar pattern in its aftermath: a surge in procurement fraud, inflated invoicing, and improper payments. The cause is not that organisations suddenly become careless. It is that the control environment is temporarily relaxed in the name of speed, and bad actors recognise exactly when that window opens.

The GRC function that adds value here is not one that slows the business with additional approvals. It is one that has a pre-built emergency track, an accelerated 24-to-48-hour vendor verification protocol covering Specially Designated Nationals (SDN) screening, ultimate beneficial ownership, and basic financial legitimacy, that does not require a three-week committee process. The distinction is between operational agility and controlled risk-taking on one hand, and uncontrolled speed on the other.

What “Good” Practically Looks Like Right Now

Good GRC, in this environment, is not a thick risk register or a comprehensive framework document. The defining quality is the speed at which a useful signal reaches a decision-maker.

A risk and compliance function that is genuinely useful today can tell senior leadership, within 24 hours, whether a specific new vendor is clean, what the sanctions exposure on a proposed transaction looks like, and what the legal surface is if a contract needs to be exited. Concretely, that means:

• Automated SDN screening integrated directly into transaction and procurement workflows, not a manual check that runs once at onboarding.
• A pre-approved emergency vendor protocol that preserves minimum verification standards but compresses the timeline from weeks to 24–48 hours.
• Continuous monitoring of OFAC, EU, UK, and UN sanctions updates, not a quarterly compliance review cycle.
• Tested backup and recovery, not merely documented. The relevant question is not “do we have a backup?” but “have we recovered from one under a simulated failure?”
• Clear escalation authority for the risk function to pause a transaction, not only flag it. In most organisations, compliance can raise a concern but cannot stop a deal. In the current environment, that distinction matters.

A Practical Starting Point, Achievable in 30 Days

For most GCC SMBs, a meaningful improvement in resilience does not require a new framework or a large compliance team. It requires four focused actions:

• Refresh counterparty screening against the latest SDN, EU, UK, and UN lists for every supplier, customer, and bank correspondent the business has used in the past 12 months.
• Draft a one-page emergency vendor onboarding protocol that compresses verification to 24–48 hours while retaining the minimum checks that protect the business.
• Identify the three to five processes the business cannot operate without for more than 48 hours, and rehearse, not document, a recovery for each.
• Give the compliance or finance lead written authority to pause a transaction pending review. Most exposures are stopped at this single point.

In Closing

The conflict in the Gulf has not created new categories of corporate risk. It has compressed the timeline on risks that were always present, sanctions exposure, procurement fraud, supply-chain interruption, cyber vulnerability, and reduced the margin for slow processes.

High-performance brakes do not slow a race car down. They are what allow it to take the corner with confidence.

The companies that come through this period in good shape will not be the ones with the most polished frameworks on paper. They will be the ones whose risk infrastructure is fast enough, and trusted enough, to be genuinely useful, a mechanism that protects speed rather than impeding it.

Conditions in the region remain dynamic, and good information is moving faster than most corporate compliance calendars. If you are reviewing your organisation's sanctions screening, emergency procurement protocols, or business continuity arrangements, this is a sensible moment to do so, before circumstances make the review urgent rather than prudent.

WeConsulting works alongside Gulf businesses, from family-owned trading houses to mid-market industrial groups, to build GRC capabilities that are practical, proportionate to the business, and genuinely useful when conditions change. We would be glad to share a one-hour confidential discussion on where your organisation stands today, and the most efficient next steps from here.

---

SourceThe GRC Edge by WeConsulting.

Originally published in our LinkedIn newsletter. Read it on LinkedIn.

If any of the above is relevant to a decision you are currently facing, we are happy to talk it through. Get in touch.