Risk · Resilience · Research · Nordic Noir

Hannimari
Savola

Risk strategist. Published researcher. Nordic noir author. Based in Frankfurt.

I specialize in risk and resilience strategy, geopolitical risk, organizational advisory, and ICT risk methodology for complex international environments. More than a decade of building frameworks, leading teams through disruption, and translating weak signals into decisions before they become crises.

Everything else on this page explains why.

Professional Profile

Risk, resilience, strategy, advisory.

I am an architect. Not in the sense of having a corner office and strong opinions about open-plan layouts, but in the sense that I build risk and resilience infrastructure from the ground up, in environments where it does not yet exist, under conditions that do not always make this easy. This has been the pattern across every role I have held.

I work at the intersection of risk strategy, technology, and organizational behaviour. My domain is the space between what an organization thinks its risk exposure is and what it actually is. That gap is almost always larger than anyone is comfortable admitting, and closing it requires a combination of methodology, systems thinking, and the willingness to say things that are inconvenient to hear. I have developed proprietary frameworks and published methodology in this space. I have also spent considerable time explaining to people why their existing frameworks are measuring the wrong things. Both activities are necessary.

My work spans enterprise risk, ICT risk, operational resilience, business continuity, crisis management, geopolitical risk, and governance. I move between strategic design and operational execution without losing the thread. I develop methodology, translate complex risk signals for executive and board-level audiences, and build the kind of frameworks that are meant to be used rather than filed. I regularly advise at C-suite level. The title has not always matched the level of the work. I have found this more motivating than frustrating.

I think in systems. I stay until the thing works. I have solved problems that had been stalled for years, not because I am uniquely gifted, but because I ask different questions and do not stop when the first answer is inconvenient.

Education

MSc Strategy and Management in International Organizations, Linköping University (exchange: Macquarie University, Sydney)  ·  BSc International Business, Kymenlaakso University of Applied Sciences, Finland  ·  BA Business Administration, Averett University, United States  ·  Russian Trade Specialisation, Inzegon, St. Petersburg  ·  Universidad Argentina de la Empresa, Buenos Aires  ·  Finance, Universidade Federal de Santa Catarina, Florianópolis

Research and Methodology

Ideas with evidence attached.

I don't separate professional practice from intellectual contribution. The research I publish is the same thinking I bring to the work, just with citations and a methodology section. In 2019 I was already writing seriously about AI before it became everyone's declared emergency. Simply curious about where the signals were pointing. Turns out they were pointing somewhere quite specific.

2019
Recruiters Just Wanna Have AI?
Research on the implications of AI in HR recruitment: algorithmic decision-making, organizational trust, and the risks nobody was formally measuring yet. Before the hype. Before the headlines. Just two researchers who thought the question was worth taking seriously.
Linköping University · 2019
2026
PRISM-C: Propagation Risk Intelligence and Signal Mapping
A signal-based methodology for translating weak organizational indicators into measurable, actionable risk intelligence, before those signals become crises. Built from first principles because the existing frameworks were not asking the right questions. Published on Zenodo. Also available at prismsignalsystem.com, where the methodology lives in a form you can actually use.
Zenodo · 2026
2026 · Under Review
Closing the Incident, Not the Risk
Submitted to ISACA Journal, November/December 2026 "Transforming Technology" issue. On why closing an incident ticket is not the same as resolving the underlying risk, and what organizations systematically miss in the gap between the two.
ISACA Journal · Under Review
Ongoing
Active Research Portfolio
Current work spans AI intelligence continuity management, human resilience screening, strategic risk telemetry for executive decision-making, and a synthesis paper on organizational models for the AI era. Independent research. What happens when you cannot stop asking the next question and have the discipline to write it down properly.
Independent Research
How I Think

Some views, stated plainly.

Risk exists to enable innovation, not to prevent it.
Most organizations treat risk management as a defensive exercise. This misses the point entirely. Good risk work makes a company secure enough to take the bets that matter. It is the infrastructure of innovation. The fact that this remains a minority view explains quite a lot about the state of most organizations. I find this professionally frustrating and personally very motivating. There is a lot of work still to do.
Every major failure leaves signals. We choose not to read them.
Crises are rarely surprises. They are patterns that were visible, reported, or intuited, and then ignored, misclassified, or buried under more comfortable information. The skill is not crisis response. The skill is signal literacy. Everything else is expensive damage control with a lessons-learned slide deck attached.
Resilience is not optimism. It is preparation.
Resilient organizations are not cheerful about disruption. They are honest about it. They have thought through the version of events nobody wants to plan for and built the muscle memory in advance. Finland has a word for this: kokonaisturvallisuus, comprehensive security. Less marketable than "agile." Considerably more useful.
When people do well, the organization does well. This is not complicated.
Organizations that discard human capacity through poor decisions or rigid structures are making a risk management error. The strongest indicator of organizational resilience is whether the people inside it are supported to be genuinely good at what they do. Everything else follows. This is not idealism. It is systems thinking applied to the part that organizations prefer not to measure.
Background

Why I think this way.

I grew up in Lahti, Finland, in the 1990s. Finland has maintained a doctrine of comprehensive security (kokonaisturvallisuus) since the post-WWII era: the idea that preparedness is a shared responsibility of government, businesses, organisations, and citizens. It is not a policy most Finns read consciously. It is background noise. You absorb it. You grow up understanding that preparedness is not paranoia. It is the responsible default.

This is also a country that produced Nokia, leads in quantum computing research, and built one of the world's best education systems from a position of geographic and economic disadvantage. Fixing problems that were not supposed to be your problem is a cultural reflex in Finland, not a professional specialisation. I grew up diagnosing and repairing my own computers because that was the only way to have a working one, and driving whatever was available, which in Lahti meant mopeds and tractors before it meant anything else. You learn to work with what exists rather than wait for something better to arrive. None of this felt like a skill at the time. Later I understood it was exactly that, and also a reasonable preview of a career in which "we have never done this before" functions less as a warning and more as a starting point.

Russia was never abstract to me. As a child I visited through charity work, helping at orphanages through an association. In 2011 I studied Russian trade and language formally, completing my Russian specialisation at Inzegon in St. Petersburg. I have loved Russian culture throughout my life. I have also watched, from close range, what happens when geopolitical risk is treated as someone else's problem until it is not. That proximity shapes how I read organizational risk signals today.

I also lived in Stockholm for roughly a decade. Watching Finnish structured preparedness, Swedish consensus culture, and Russia's entirely different relationship with institutional trust from the inside gave me a comparative lens that no single-country career provides.

Life then took me further: Argentina, the US, Spain, Australia, eventually Germany. Each country added a layer. Different systems, different failure modes, different relationships between institutions and the people inside them. The pattern underneath was usually the same.

Finnish Upbringing
Comprehensive security as background noise. A country built on preparedness, engineering, and the productive refusal to accept that problems cannot be solved.
Russia, Up Close
Childhood charity visits. Formal study in St. Petersburg, 2011. Russian trade and language specialisation. Culture loved. Geopolitics observed at close range.
Nordic Comparative Lens
Finland, Sweden, and Russia as three distinct models of institutional trust and national resilience. Studied from the inside, not from a textbook.
International Career
Finland, Sweden, Argentina, USA, Spain, Russia, Australia, Germany. International business, Latin American markets, Russian trade. Life can take you anywhere. It did.
Always Learning
Six languages and counting. Licences, certifications, and qualifications across domains. The question is always: what if this turns out to matter?
Engineering Culture
Nokia, quantum computing, world-class education built from disadvantage. Problem-solving as a cultural reflex, not a professional choice.
"Be water, my friend."
Bruce Lee
The water metaphor belongs to Bruce Lee, and before him to the Taoist tradition. But sisu is the Finnish version: quieter, less poetic, and equally stubborn. It means you do not announce that something is impossible. You find out what it takes. You do it. You do not make a performance of the difficulty.

I have moved countries multiple times, learned languages under pressure, built capabilities from scratch that organizations said they urgently needed but had never actually started, and led situations I was handed without a briefing. Sisu is not a personality trait. It is a decision, made repeatedly, often quietly, usually when no one is watching.
Outside the Office

Everything else I have done.

Seventeen years of conservatory flute. Summers packing beverages at Hartwall. Bar work, waitressing, coat checks at clubs. A hunting licence at sixteen, not because I intended to hunt, but because knowledge has unpredictable value and the question "what if I need this someday" has never once led me wrong. I have never gone hunting. I remain prepared to.

Along the same lines: I also hold a truck licence and a motorcycle licence. The reasoning is straightforward. If a situation ever requires me to drive anything at short notice and at speed, I will not be the person standing in the car park having a skills gap. Think of it as a personal continuity plan. Jason Bourne would understand.

I did Muay Thai for four years. I scuba dive. I sail, with both inland and sea licences. I paint. I dance. I bungee jump on occasion, which is a sentence I cannot believe I need to include on a professional website, and yet here we are. In 2018 I ran the Padasjoki nakukymppi, a ten-kilometre race run without clothes, which is exactly what it sounds like. A reporter happened to be there and asked if he could write a story about it. I said yes. It appeared in Iltalehti. I remain entirely unbothered by this, which probably tells you something useful about my approach to reputational risk.

I should also mention yoga. I genuinely disliked it. Sweaty hands, uncertain purpose. But enough people said it was worth learning that I decided to investigate properly. I booked a teacher training course from India without fully reading the details, and arrived to discover I had signed up for Ashtanga training, which is the most physically demanding yoga style in existence. I completed it. I am now a qualified Ashtanga yoga teacher. If you are going to learn something, you might as well learn it correctly. This is a principle I apply consistently, sometimes against my own better judgment.

I spent two months living with Buddhist monks in Thailand. I learned a great deal about meditation. I did not agree with much else they said, and I am now a qualified meditation trainer, which I consider a fair outcome. You can take the methodology and leave the dogma. This principle applies to more things than just meditation.

I am always learning the next language. Currently six. The list is not finished. I am also a board member of the Finnisch-Deutsch Handelsgilde in Frankfurt, the Finnish-German trade guild, which is what happens when you move to Germany and immediately find the Finns.

Writing

The fiction I write when the frameworks are not enough.

Nordic noir exists because some truths are easier to approach sideways. I write stories at the intersection of institutional corruption, human resilience, and the systems people build to protect each other when the official ones will not.

Spending years studying how organizations fail gives you very good material for crime fiction. Everything I have observed about what happens when bad decisions at the top quietly become everyone else's operational problem finds its way in eventually. My protagonist would diagnose a crime scene the way I diagnose a risk register: systematically, with mounting exasperation at the data management.

The writing is in Finnish. The themes are universal. Corruption does not require translation.

AKKATEMIA
A trilogy. Eeva is young, technically gifted, and trying to survive something the system has already decided not to prosecute. What she finds buried in files she was never meant to see is a corruption network reaching further than expected, and a judge named Anja who decides, quietly, that law and justice are occasionally different things. Book two moves to Tallinn. The network does not stay tidy when someone starts pulling the thread.
Trilogy · In progress
Financial Crime / Cross-Border
Next project. The systems that move money across borders are also the systems that move everything else. More when the time is right.
In development
Contact

Let's talk.

I am genuinely interested in hearing from people working on hard problems in risk, resilience, geopolitics, or research. If something on this page made you think "I want to talk to this person," that instinct is probably correct. Reach out. I read everything and reply to the interesting ones, which, based on the people who tend to find pages like this, is most of them.

LinkedIn · hannimari@prismsignalsystem.com · prismsignalsystem.com