Control Risks has considerable experience in Iraq as well as in the Kurdistan Region. What are the major differences in your operations in the north versus the south?
To begin, Kurdistan’s security situation has long been much more stable than most of southern Iraq. When Control Risks established a permanent presence in Kurdistan in 2006, security, while better than in the south, was not as stable as it is now, and infrastructure was sorely lacking. However, the catch-up growth of the Region has been incredible, and contrasts strikingly with development in the south.

Control Risks has operated in the south for longer than we have in Kurdistan, and southern Iraq is a more mature market. However, I would not necessarily characterize Kurdistan as a frontier market. When comparing Kurdistan with more mature markets in the Middle East, such as Federal Iraq, I conceive of Kurdistan as a hidden market whose potential went untapped for too long. Fortunately, this is changing quickly. Hotel construction in Erbil and Slemani, for example, clearly demonstrates how quickly the Region is developing, and how great the demand is.

One of Kurdistan’s primary advantages over the rest of Iraq, in terms of doing business, is the lighter regulatory burden and the more streamlined bureaucracy. Ultimately, of course, in both southern Iraq and Kurdistan, a strong grasp of the local environment, regulations, customs, and procedures is crucial. The rewards in both places can be significant once efforts have been invested in firmly understanding the operating environment.

Control Risks offers security reviews of international business hotels within the Region. What exactly do these reviews entail?
Control Risks has conducted security design and security reviews for many of the major hotel operators including InterContinental Hotels Group (IHG), Hilton, Marriott, Fairmont, and Hyatt, so we are very familiar with brand standards and their security requirements. While it is critical to have robust security measures in place, it is equally critical to ensure the hotel environment is welcoming. The balance, therefore, is subtle, the aim being to provide effective yet unobtrusive security.

The evaluation can take different forms. Although we happily conduct security reviews for hotels, the best results are achieved through longer-term partnerships with hotel groups. Collaboration begins long before the construction phase, allowing us to work together throughout the project life cycle, from original design to complete operational capability.

Whether we are engaged throughout the project or brought in to conduct a review, our methodology is defined by an integrated approach. In practical terms, this includes reviewing the threat environment, reviewing and advising on the hotel’s policies and procedures, providing accredited training to staff, and creating and testing robust crisis management plans. We also provide embedded security consultants to assist in implementing security procedures and maintaining standards through the long term.

The driver training school you offer is especially interesting. Can you tell us about the program and its objectives?
Clients are often surprised when we tell them that the biggest risk to their operations in Kurdistan comes from road traffic accidents rather than security incidents. The volume of traffic is increasing drastically, and the road infrastructure is struggling to keep up. The problem is so serious that the government has placed restrictions on the import of vehicles. Control Risks is addressing these concerns through our Driver Training School.

The School is a bespoke facility on the outskirts of Erbil. UK Driving Standards Agency-certified instructors conduct our training, which is internationally accredited. We offer this training not only to our personnel, but also to clients who want to ensure their drivers are proficient. The differences in driving standards from the beginning to the end of a course are very obvious. We give candidates the confidence, knowledge, and expertise to drive safely and responsibly. Additionally, this often helps the locals we train to secure employment as drivers with international companies.

Control Risks offers due diligence services, both for private and public entities operating in the Kurdistan Region. What issues or concerns do you typically address?
Control Risks provides pre-transactional or pre-relationship due diligence to help organisations mitigate some of the risks of forming alliances with unknown partners, in terms of both companies and individuals. The concerns of our clients are usually either reputational or regulatory. That is, they are concerned that a partnership with a certain company or individual will damage their reputation, or will affect their exposure to instruments of anti-corruption legislation such as the Foreign Corrupt Practices Act or the UK Bribery Act.

A company’s reputation may be damaged by an association with an unsuitable partner in a number of ways, and in this regard, Kurdistan is similar to many jurisdictions in the Middle East and around the world. A partner may misrepresent their level of experience or expertise, or the extent to which they have provided similar services to foreign investors in the past. A partner may also misrepresent the degree to which they can provide introductions to key players in the business world. A partner may also be experiencing financial difficulties, and may not be able to discharge its business obligations. More broadly, a partner may simply have a market reputation as an undesirable company or individual with which to engage. Any of these factors could spell the failure of the investor’s venture, and could result in reputational fallout among its clients, its partners, or in the industry more generally.

In our experience, one of the key ingredients of success in Kurdistan is ensuring in advance through due diligence that a local partner is representing themselves, their capabilities, connections, and track record accurately, and that their reputation and perceived integrity is beyond reproach. Our objective is not to stop companies from doing business, but rather to facilitate their operations while protecting their reputation and integrity.