The Third Layer

In April, this brief asked whether a company could still carry a decision when the conditions around it suddenly changed. Seven months later, those conditions have not settled. An interim deal was signed in mid-June, and the ceasefire collapsed in mid-July.¹ Attacks on energy infrastructure continued, including the bombing of Saudi Arabia's East-West pipeline on 11 September.² The IMF now assumes the disruption continues through the first quarter of 2027.³

So the question has changed shape.

April: can the company hold when the shock arrives? October: can the company keep holding when the shock becomes a condition?

The three layers are the same as in April.

The first layer is pressure in the market: prices, insurance, financing, supply.

The second layer is what that pressure does to how a company makes decisions.

The third layer is what happens to the company's ability to carry its decisions out: authority, controls, escalation and correction.

What is new in this edition is time. A shock tests whether a company's controls hold. A condition tests whether they keep holding.

A note on method. This edition keeps the April edition's framework and its doctrine. The three layers, the control gap and the eleven questions remain tools for reading this period, not a fixed model every company fits; the plan decides which risks matter most. The record shows the outside pressure and how its measures moved. The second and third layers are FEC's reading of what a company should then examine inside itself. Figures come from the IMF, the UAE central bank and statistics centre, Fitch Ratings, Oxford Economics, the International Energy Agency (IEA) and S&P Global, and from reporting by major outlets. The April 2026 edition is kept as it was written. Read the April 2026 edition →

The IMF described the region as showing "considerable adaptability, but also diminishing buffers."³ Both halves are visible in the figures.

What held: credit ratings mostly held. Fitch removed Qatar from Rating Watch Negative in September, keeping a negative outlook, and said "the risks of further severe damage have reduced since March."⁴ It removed Ras Al Khaimah's watch in October.⁵ Moody's moved Bahrain's outlook to negative in April;⁶ among the GCC sovereign ratings reviewed, we found no downgrade during the period checked. According to the IMF, the capital outflows that began early in the conflict "have largely dissipated," and the extra cost governments pay to borrow (sovereign spreads) has "narrowed across most economies."³

What did not hold: the outlook for 2026. The IMF now expects the Middle East, North Africa, Afghanistan and Pakistan region to shrink by about 1.3% in 2026, 2.7 percentage points below its April forecast.³ For the Gulf economies as a whole it expects a contraction of 4.8%,⁷ and it expects every GCC economy except Oman to shrink this year, with Saudi Arabia and the UAE in recession.³ Oxford Economics has cut its 2026 forecast for the Gulf three times: to a 0.2% contraction in March, 2.4% in June, and 6.4% in September.⁸

In the UAE, the economy grew 0.4% in the first half of 2026, but shrank 2.1% in the second quarter, as tourism, transport and trade were hit by disruption to travel.⁹ The UAE central bank now expects growth of 1.6% for 2026, after 6.2% in 2025.¹⁰

Recovery is expected. The IMF forecasts 6.6% growth for the wider region in 2027,³ and the UAE central bank 10.4% for the UAE.¹⁰ But the IMF's regional director said the region "will not go back to the prewar trajectory in the medium term."⁷

So the picture in October is not collapse. It is strain that has lasted longer than April assumed, with a recovery forecast on a timeline that depends on the disruption ending.

FEC's reading

By October, the surface indicators and the underlying outlook were moving in different directions. S&P Global's survey of UAE businesses outside oil and gas (the PMI, where any reading above 50 means growth) rose to 55.3 in September, a 20-month high, while business optimism stayed "only just above March's recent low."¹¹ In Saudi Arabia, the same survey also reached 55.3, while firms' expectations weakened "amid heightened concerns about regional tensions."¹² Activity recovered. Forecasts kept falling. Confidence did not come back.

FEC reads that divergence as a reason to look beyond the market itself: at how sustained pressure is changing decisions inside the company, and whether the operating controls behind those decisions still hold. The figures do not show either of those things happening in any particular company. They show the conditions a company has been deciding in.

A shock and a condition ask different things of a company.

Many companies met the spring with a fast response. Plans were revised against the conditions of the time, including a ceasefire that later collapsed. Each revision may have been right on the information available. The October question is what those months of response have left behind.

The question is no longer only whether controls hold through a sudden shock. It is whether they continue to hold after months of changing assumptions, repeated pressure and plans being adjusted while execution continues.

Some of that pressure eased. Oil flowing through the Strait of Hormuz rose by 3.7 million barrels a day to 10.9 million in September, and Gulf crude exports reached over 75% of their pre-war level.² But the IEA warned that renewed attacks on energy infrastructure and tankers are "threatening to derail further gains."²

Some of it deepened. We found no reliable figure for war-risk insurance on ships in October. The latest we could verify is from July, when a Marsh executive told The National that rates could be "anywhere between 3 per cent and 10 per cent" of a ship's value, against about 0.25% before the war.¹³ In April, this brief reported a rise to about 1%. In early October, Gulf News reported that the daily cost of hiring a supertanker had risen about 43 times since January.¹⁴ UAE firms raised their selling prices in September at the fastest rate since May 2011.¹¹ Oxford Economics expects no cut in interest rates before 2028, which will keep borrowing costs in the region high.⁸

What defines the first layer has not changed: it can be seen, measured and priced. What seven months add is movement. Some pressures ease while others build, and a company's picture of its market has to be redrawn more than once. Its limit has not changed either. It describes the pressure on the company, not how the company is responding to it.

In April, the second layer described decisions changing under sudden pressure. Over months, it can take another form. Decisions made for an emergency become the standing way of deciding. Approvals given as exceptions stay in place. Assumptions revised in spring are revised again, sometimes in the opposite direction. Planning looks shorter and shorter ahead. Each step can be defended on its own.

The setting is visible. In May, the Dubai Chamber of Commerce hosted 64 business groups and councils to discuss "current challenges arising from regional and international developments."¹⁵ By September, its quarterly meeting with 80 representatives had turned to growth and competitiveness.¹⁶ Business optimism in the UAE stayed near its March low,¹¹ and Saudi firms' expectations weakened.¹² These figures show the setting decisions were being made in. They do not show how any company's decisions changed. That is what the second layer asks a company to examine.

What defines the second layer is that it is hard to see while it is happening, and time makes it harder. What looked unusual in March can look ordinary by October. Its limit is the same as in April: it describes the conditions that make failure more likely, not the failure itself.

Over a long disruption, the third layer can change shape. Authority given temporarily, so that people could move fast, keeps being used. Routes for raising problems that were bypassed in the emergency stay bypassed. The people who held things together in spring are still holding them. Ways of correcting course that were built for a disruption of weeks are carrying one of months. None of this shows in a quarterly figure.

Operational risk, as a discipline, already covers failures in processes, people and systems, including failures under stress. The third layer picks out one specific question inside that wider field: whether controls that look adequate in normal conditions still work under the pressure created by a particular plan or a particular change outside the company. Seven months on, that question has a time dimension: whether they still work after the pressure has lasted.

A company can have strong governance and sound internal controls and still carry third-layer risk, because the question is not whether those systems are good, but whether they hold under the pressure that is now present, for as long as it lasts.

That cannot be read from how the company performs on an ordinary day, and by October there may be few ordinary days to compare against. It can only be read by checking whether authority, escalation and correction have been tested under the conditions that now apply, and whether they hold.

This is often the layer where losses become hard to prevent. By the time it shows, the company is no longer only responding to the market. It is responding to its own breakdown.

Conventional review is necessary, and it is well developed across many GCC institutions and advisers. It examines financial, legal, tax and market risk, and the commercial assumptions behind a plan. It answers whether the plan is attractive, defensible and properly structured. That is its purpose, and it does it well.

Over a long disruption, conventional review is usually repeated: models are rerun, forecasts updated, scenarios redrawn. That keeps the first layer current. It is not designed to show whether the company's own way of deciding and controlling has held up over the same months.

ISO 31000, the international standard for risk management, sets out how risk is identified, analysed, evaluated, treated, monitored and reviewed.¹⁷ It is a standard for the risk process. Whether a particular company can carry a particular plan under present pressure is a different question, and the standard does not set out to answer it.

Trouble in carrying out a decision usually shows in operations before it shows in the numbers. The early signs are the same as in April:

• missed timelines
• slow decisions
• work done twice
• no one clearly owning a piece of work
• leaders stretched too thin
• reports that do not agree
• money leaking out in small amounts
• workarounds that become the normal way
• conflict inside the team
• too much resting on one or two people

What changes over months is how they look. In April, they could be written off as temporary strain. By October, they risk being accepted as the way things are. A workaround that has run since March is no longer a workaround in anyone's mind. That is the point at which the distance between what was approved and what is being delivered widens without anyone deciding it should.

A decision can be financially attractive, legally sound and strategically right, and the company making it can still not be able to carry it. The strength of the case belongs to the decision. The ability to carry it belongs to the company.

This brief calls that ability execution readiness: the company's ability to carry a decision through to the end while conditions change along the way, with its authority, controls, escalation and correction holding under those conditions, not only in normal times.

Readiness has a date. A company that could carry its plan in April may not be able to carry the revised plan in October, and the reverse is possible too. When readiness is assumed rather than examined again, the plan rests on an assumption that may have aged. The earlier the question is asked again, the more room there is to change or build what the plan now needs.

Its limit is the same as in April. It describes the company's ability, not the outcome.

A control gap can widen without anything changing on paper. The control is the same. The conditions it has to work under have moved, and kept moving. A control that was tested in March, under a shock, has not necessarily been tested in October, under a condition.

More documents, more committees or more written policy do not close it on their own. The gap closes when the company can show that its controls work under the conditions in which they would be needed, and where they do not, changes or builds what is missing. Showing it requires evidence beyond the assumptions of the people closest to the plan. Where the stakes justify it, an independent view can strengthen that examination.

Its limit is that it describes a condition, not a forecast. A company with a control gap is not certain to fail. It is exposed in a way it does not currently see.

The eleven questions are the same as in April. They are not an approval procedure, and they are not a rule for how boards should work. They are a lens: questions that show whether a company can still carry a decision under the conditions that exist now. Asked in April, they described a moment. Asked again in October, the answers may have changed.