Risk & Resilience

The problems that kept European supply-chain managers awake a few years ago have become considerably less troublesome. Raw materials are easier to secure, semiconductors are less scarce, goods are moving, but the trouble has migrated elsewhere.Between 2023 and 2025, the share of EU firms reporting raw materials as a supply-chain obstacle fell from 27% to 8%, according to a new study from the European Investment Bank (EIB) and European Commission. Semiconductor concerns dropped from 15% to 3%, while logistics obstacles fell from 28% to 12%.

In risk management, we tend to obsess over black swans. Rare, unpredictable, high impact shocks that arrive without warning and rewrite the narrative overnight. Yet most organizational failures are not born from surprise. They emerge from visible, accelerating threats that were identified, debated, scored, and then quietly deprioritized because mitigation was inconvenient, expensive, or politically uncomfortable. These are gray rhinos. High probability, high impact risks charging directly at the organization. The breakdown is not foresight. It is governance.

Amazon Web Services has spent months trying to recover cloud infrastructure damaged during the war with Iran. In Bahrain, it has reached the end of that effort. AWS cannot restore access to its Bahrain cloud region or to resources and data held exclusively in one of its three availability zones in the United Arab Emirates, according to a company status update seen by Reuters. Reuters first reported the development Tuesday.

The Central Bank of the UAE and Mastercard have completed a four-day program designed to sharpen the central bank’s expertise in fraud risk management, with 25 CBUAE employees receiving training on the risks emerging alongside new forms of digital payments and commerce.

The Basel Committee on Banking Supervision is turning its attention to the technology failures that can disrupt banks without a cyberattack ever taking place, highlighting weaknesses in change management, system testing and third-party dependencies as persistent sources of operational risk.

At two CEO roundtables in June, the Australian Prudential Regulation Authority and Australian Securities and Investments Commission asked industry leaders to consider cyberattacks complicated by artificial intelligence, failures at critical service providers and crises that spill across organizational boundaries. The regulators published notes from the discussions Tuesday.

Not long ago, a CFO at one of the world's largest pharmaceutical companies said something that has stayed with me. We were discussing a major acquisition his company had just completed, and I asked what kept him up at night during the integration. His answer was not about valuation, synergies, or headcount. It was about business processes.