Crisis & Security Consulting · Control Risks

In autumn 2023, I interned with the Crisis and Security Consulting team at Control Risks in Shanghai. I worked on site security, financial regulation, incident research, a crisis exercise, and very short business-development briefs. Client identities and engagement details are generalized throughout this page.

From geopolitics to a decision

From the outside, risk consulting looks like geopolitics. Inside a project, it feels closer to translation. A question as broad as "Can we keep operating in this market?" has to become a set of decisions: what is exposed, how much does it matter, what can change, and what new evidence would alter the recommendation?

A country can generate an endless supply of true information; only a small part of it will change what a client should do. The work is to find that part, show where it came from, and make sure the conclusion never sounds more confident than the evidence deserves.

The work, at a safe level of detail

Physical-security review. I supported a site assessment for a logistics operation. The team combined a walk-through, interviews, a threat taxonomy, and a mitigation matrix. A generic checklist can miss the way a place actually lives. Shift changes, access habits, lines of responsibility, and recovery options often matter more than the most visible piece of hardware.

Financial-regulation research. I mapped a changing licensing regime for a financial-services client, reading consultation papers, regulator notices, and the underlying legislation in both Chinese and English. The task was to separate rules already in force from proposals, guidance, and market interpretation, then connect each one to a concrete operating choice.

Incident research. I reviewed open-source reporting and supported local-source interviews for corporate security questions. Sources varied in access, incentives, and reliability. Writing the result meant preserving those differences instead of compressing them into a single confident story.

Crisis exercise. I supported a scenario-based tabletop around a supply-chain shock with operational, regulatory, and communications consequences. My role was junior and practical: records, timing, and synthesis. Watching the facilitators was the education. They created enough pressure for hidden dependencies to surface, while keeping the session focused on systems rather than blame.

Short prospect memos. These covered company background, fit with relevant service lines, and possible outreach angles. Each had to fit within roughly half a page. The format punished decorative research and rewarded clear selection.

Risk and uncertainty

The most useful distinction I took from the internship was between risk and uncertainty.

When evidence supports a probability range, even a wide one, I can call the thing a risk. When the situation is new, its drivers are moving, or the evidence is too thin, a probability produces only the appearance of measurement. Then the more honest answer is a judgment, its level of confidence, the better and worse cases, and the signals that would make me change my mind.

Both forms can support a decision. Problems begin when a judgment is dressed up as a measured probability.

Writing is part of the method

I left with a better order of operations: define the decision, ask what each source can actually support, separate observation from inference, and write the uncertainty into the answer. Writing is not the packaging that comes after the research. It is where the discipline becomes visible.