Crisis & Security Consulting · Control Risks

Autumn 2023 on the Crisis and Security Consulting team at Control Risks in Shanghai. The work included site-security analysis, regulatory research, incident research, crisis exercises, and short business-development memos. Client identities and engagement details are intentionally generalized here.

What the work actually is

Risk consulting looks like geopolitics from the outside. From inside a project, it is closer to translation. A broad question about operating in a market has to become a decision: what is exposed, how material is it, what can be changed, and what evidence would change the recommendation?

That translation determines the shape of the deliverable. A country can generate an endless amount of true information, but only a small part of it changes what a client should do. The work is to find that subset, show the evidence behind it, and keep the language inside the confidence of the sources.

The work, at a safe level of detail

Physical-security review. I supported a site assessment for a logistics operation. The team combined a walk-through, interviews, a threat taxonomy, and a mitigation matrix. The useful lesson was that a generic checklist misses how a site actually works. Shift patterns, access routines, responsibilities, and recovery options often matter more than the most visible piece of hardware.

Financial-regulation research. I mapped a changing licensing regime for a financial-services client, reading consultation papers, regulator notices, and the underlying legislation in both Chinese and English. The task was to separate rules already in force from proposals, guidance, and market interpretation, then connect each one to a concrete operating choice.

Incident research. I reviewed open-source reporting and supported local-source interviews for corporate security questions. Sources varied in access, incentives, and reliability. Writing the result meant preserving those differences instead of compressing them into a single confident story.

Crisis exercise. I supported a scenario-based tabletop around a supply-chain shock with operational, regulatory, and communications consequences. My role was junior and practical: records, timing, and synthesis. Watching the facilitators was the education. They created enough pressure for hidden dependencies to surface, while keeping the session focused on systems rather than blame.

Short prospect memos. These covered company background, fit with relevant service lines, and possible outreach angles. Each had to fit within roughly half a page. The format punished decorative research and rewarded clear selection.

Risk and uncertainty

The most useful distinction I took from the internship was between risk and uncertainty.

When evidence supports a probability range, even a wide one, the analysis can describe a risk. When the situation is novel, the drivers are changing, or the evidence is too thin, a probability can create false precision. In those cases the deliverable should state the judgment, its confidence, the upside and downside cases, and the signals that would change the view.

Both forms can support a decision. Problems begin when a judgment is dressed up as a measured probability.

What I took home

I left with a better method for moving from research to action: define the decision, rank sources by what they can actually support, separate observation from inference, and write the uncertainty into the answer. The writing is where that discipline becomes visible.