The Third Layer

A company in the GCC approving a large decision in 2026 has a different question to answer. It is no longer only whether the decision is sound. It is whether the company can still carry it out, now that conditions have changed since the decision was first framed.

The region entered 2026 strong. What changed is the conditions decisions are made in. Pressure no longer arrives through one channel. It arrives through several at once: shipping, insurance, energy prices, the cost of borrowing, and the way businesses behave.

This brief reads that pressure as three layers.

The first layer is pressure in the market: prices, insurance, financing, supply.

The second layer is what that pressure does to how a company makes decisions.

The third layer is what happens to the company's ability to carry its decisions out: authority, controls, escalation and correction.

Market analysis can show the pressure in great detail. What it cannot show on its own is whether the company itself can still carry its plan once that pressure arrives. That question sits in the third layer, which is why this brief spends most of its time there.

The first shock hits the market. The second hits decisions. The third tests whether the company can still carry what it decided.

A note on method. The three layers, and the other ideas in this brief (the control gap and the eleven questions), are tools for reading this particular period. They are not a forecast, and they are not a fixed model every company fits. The plan decides which risks matter most. The published figures show the pressure; the three layers are FEC's reading of how that pressure can travel through a company. Figures come from the UAE central bank, the IMF, Fitch Ratings, Oxford Economics, the World Economic Forum and S&P Global, and from reporting on shipping and insurance. The brief adds to existing risk practice. It does not replace it.

Any honest reading starts with how strong the position was. The UAE's economy grew 5.1% in the first nine months of 2025, and the part of the economy outside oil and gas grew 6.1%.¹ Fitch Ratings said the conflict had not changed ratings or outlooks for most Gulf countries, although it placed Qatar on Rating Watch Negative (a formal warning that a rating may be cut).² The UAE's pipelines, which carry oil around the Strait of Hormuz, kept its oil export income broadly in line with where it was before the conflict.²

The problem is not that the region became fragile. It is that conditions became less forgiving. The IMF described the conflict as hitting three "pillars of stability": energy markets, trade routes and business confidence. Insurance for ships was repriced, shipping routes grew longer, air travel through the Gulf's main hubs was disrupted, and financial markets reacted.³ The IMF expected growth across the Middle East, North Africa, Afghanistan and Pakistan region to slow to 1.4% in 2026, a cut of 2.3 percentage points from its October forecast and one of the largest six-month cuts since the 2008 financial crisis.³

Some of the pressure eased quickly. Government borrowing costs in several countries rose by 0.5 to 1 percentage point in March, then returned to their pre-conflict levels after the ceasefire.³ But not everything returned. On 30 March, Oxford Economics cut its forecast for the Gulf economies in 2026 from 4.4% growth to a 0.2% contraction.⁴ In late April, it said borrowing costs for companies were still high, especially for riskier sukuk (Islamic bonds).⁵

So even as the headline numbers settled, the conditions a single company decides in had not gone back to where they were. The margin for error became narrower. Assumptions aged faster. A decision that looked manageable last quarter could need tighter control today, not because it was wrong, but because the conditions it has to be carried out in are different.

What changed in the region has been recorded in detail by central banks, international bodies and rating agencies. The more useful question for a company is what happens inside it once that change arrives.

The first layer acts outside the company. It shows up in shipping costs, insurance, the cost of borrowing, energy prices, supplier prices, customer behaviour and contract terms. It is the layer most risk teams are built for, because it can be measured, priced and reported with tools a company already has.

This period gave unusually clear examples. War-risk insurance for ships in the Gulf rose from about 0.2% of a ship's value to as much as 1% within 48 hours. For a $100 million tanker, that took the premium for a single voyage from roughly $200,000 to about $1 million, and some insurers stopped offering cover at all.⁶ Traffic through the Strait of Hormuz fell sharply. The United States put up an insurance facility of up to $40 billion to keep ships covered, an unusual step by a government into a market that private insurers normally serve on their own.⁷

What defines the first layer is that it can be seen. The data exists, and much of it is public. A risk team with good market information can watch it form in real time. Market risk, supply risk and the risk that a partner fails to pay or deliver all sit here. They act outside the company, and they can be handled through pricing, hedging, contracts or sourcing.

Its limit is that it describes only the pressure on the company. It says nothing about how the company responds. A company can see, measure and price all of its first-layer exposure and still be unprepared for what happens next inside it.

The second layer acts on how decisions are made, not on the conditions around them. Approvals take longer than they used to. Money is held back, or pushed out faster than the analysis supports. Standing assumptions are dropped without anything replacing them. Debate inside the company grows past the point where it helps, or shrinks past the point where anyone challenges anything. Each shift can be defended on its own. Together, they describe a way of deciding that has changed without anyone saying so.

There were visible signs of this in the region. S&P Global's monthly survey of UAE businesses outside oil and gas (the PMI, where any reading above 50 means growth) fell to 52.9 in March 2026 from 55.0 in February, its joint-lowest reading since mid-2021, and business confidence fell to its lowest in more than five years.⁸ In a single week in March, the Dubai Chamber of Commerce held 13 meetings with business groups and councils, attended by 127 members of the business community, to support business continuity.⁹ That activity is consistent with a period in which businesses were reassessing continuity, exposure and operating decisions. The figures show the pressure. They do not, on their own, show how any company's decisions changed; that is what the second layer describes.

What defines the second layer is that it is hard to see while it is happening. The first layer shows in market data. The second shows only in patterns of behaviour, and each pattern looks reasonable on its own. Slower approvals look like care. Faster ones look like decisiveness. Tighter spending looks like discipline. Looser spending looks like seizing the moment. The people leading the company usually believe it is working normally, and by most measures it is. What has changed is the quality of the decisions.

This is narrower than the wider study of how people decide under uncertainty. Here, the second layer means only the drop in decision quality that follows a pressure you can point to. It is different from strategic risk, too: strategic risk is about which choices a company makes; the second layer is about how it is making them.

Its limit is that it is not yet the failure. It describes the conditions that make failure more likely. The failure is the third layer.

The third layer shows up inside the company. Authority becomes unclear at the moment it is most needed. The way problems are raised breaks in practice before it breaks on paper. The decision to stop or redirect something is made by whoever is in the room, not by a process that has been tested. Fixing things depends on particular people being there, not on a system that works whoever is there. Reporting slows as the company absorbs the strain. None of this is dramatic. Each sign looks like ordinary friction.

What defines the third layer is that it appears only under pressure. These systems were working before the pressure arrived. They are still written down. They still have people in them. They look intact. They fail when pressure in the market and changed decision-making arrive together. That is what makes the third layer hard to find: in normal conditions, nothing is wrong.

Operational risk, as a discipline, already covers failures in processes, people and systems, including failures under stress. The third layer picks out one specific question inside that wider field: whether controls that look adequate in normal conditions still work under the pressure created by a particular plan or a particular change outside the company.

It is not the same as weak governance, either. A company can have strong governance and sound internal controls and still carry third-layer risk, because the question is not whether those systems are good, but whether they hold under the pressure that is now present.

That cannot be read from how the company performs on an ordinary day. It can only be read by checking whether authority, escalation and correction have been tested under the conditions that now apply, and whether they hold.

This is often the layer where losses become hard to prevent. By the time it shows, the company is no longer only responding to the market. It is responding to its own breakdown.

Conventional review is necessary, and it is well developed across many GCC institutions and advisers. It examines financial, legal, tax and market risk, and the commercial assumptions behind a plan. It answers whether the plan is attractive, defensible and properly structured. That is its purpose, and it does it well. The question in this brief is a different one, so it helps to see where each sits.

ISO 31000, the international standard for risk management, sets out how risk is identified, analysed, evaluated, treated, monitored and reviewed.¹⁰ It is a standard for the risk process. Whether a particular company can carry a particular plan under present pressure is a different question, and the standard does not set out to answer it.

That different question is the one the third layer raises: not only whether the plan is sound, but whether the company can still carry it.

Trouble in carrying out a decision usually shows in operations before it shows in the numbers. The financial signal comes late. By the time it arrives, the company's ability to deliver, learn and stay in control has already changed.

The early signs are usually written off as friction or temporary strain:

• missed timelines
• slow decisions
• work done twice
• no one clearly owning a piece of work
• leaders stretched too thin
• reports that do not agree
• money leaking out in small amounts
• workarounds that become the normal way
• conflict inside the team
• too much resting on one or two people

Each can be explained away on its own. When they keep coming back, the distance between what was approved and what is being delivered starts to widen. That distance is where lasting damage starts.

Seeing the signs is necessary, but it is not enough. A company that sees them without asking whether it can still carry its plan has found a problem without dealing with it.

A decision can be financially attractive, legally sound and strategically right, and the company making it can still not be able to carry it. The strength of the case belongs to the decision. The ability to carry it belongs to the company. Under pressure, the two can drift apart.

This brief calls that ability execution readiness: the company's ability to carry a decision through to the end while conditions change along the way, with its authority, controls, escalation and correction holding under those conditions, not only in normal times.

It is specific to one plan. Whether the company can run its ongoing operations is a different question. So is whether a project is well planned and resourced: a well-planned, well-resourced project can still struggle if authority, escalation and correction do not hold when conditions change.

It is also a question of timing. When a company's ability to carry a plan is assumed rather than examined, the plan rests on an assumption, and when conditions change, that assumption is often the first thing to give. The earlier the question is asked, the more room there is to change or build what the plan needs.

Its limit is that it describes the company's ability, not the outcome. A company that can carry its plan still works in an uncertain world and can still meet conditions no one foresaw. What it has is that, when those conditions arrive, it responds with clear authority, working escalation and real correction, rather than with its systems giving way.

The control gap is a state the company is in, not a moment of failure. It exists whenever a company has named a risk, named a control for it, written the control into policy and given someone ownership of it, but has not checked that the control works under the conditions the risk would create. It can exist in companies with strong governance, up-to-date documents and regular risk discussions. Knowing about a risk, writing a policy, holding meetings and keeping records are all part of control. None of them, on their own, is control.

It is different from a known weakness, which the company has already found and is tracking through audits or fix lists. The control gap usually does not appear in either, because the controls are there and look like they work. The gap is the difference between how those controls look on a normal day and how they work when pressure arrives.

It is different from residual risk, too, which is what remains after controls are applied and working as designed. The control gap asks whether they work as designed once conditions change.

More documents, more committees or more written policy do not close it on their own. The gap closes when the company can show that its controls work under the conditions in which they would be needed, and where they do not, changes or builds what is missing. Showing it requires evidence beyond the assumptions of the people closest to the plan. Where the stakes justify it, an independent view can strengthen that examination. The confidence that let the gap form is the same confidence that would be judging whether it is closed, and that is hard to judge from inside.

Its limit is that it describes a condition, not a forecast. A company with a control gap is not certain to fail. It is exposed in a way it does not currently see. Whether that becomes failure depends on whether the conditions that would test its controls arrive.

The questions below are not an approval procedure, and they are not a rule for how boards should work. They are a lens: eleven questions that show whether a company can still carry a decision under the conditions that exist now. Some will matter more than others, depending on the plan.

Confidence and evidence are different things. Confidence rests on how things have gone before. These questions ask what the company can show today. The two have always been different. In a less forgiving period, the cost of confusing them goes up.