Businesses must invest in resilience as risks become increasingly interconnected

Economic pressures are forcing businesses to scrutinise spending ever more closely. But as cyber threats, geopolitical tensions and supply chain dependencies become increasingly interconnected, relying on outdated assumptions about risk could prove costly, warns Gallagher Specialty CEO Sarah Lyons.

KEY POINTS:
A ‘tougher environment’ for businesses
Risks are becoming interconnected
Cyber is now a board-level issue

Businesses are under pressure from almost every direction. Growth remains elusive in many sectors, costs continue to weigh on margins and investment decisions face increasing scrutiny. Yet just as organisations seek greater certainty, the risks they face are becoming more difficult to isolate, predict and manage.

Speaking to AIRMIC Today, Lyons argues that while awareness of emerging risks has improved, many organisations still underestimate their exposure and how quickly disruption can cascade across a business when risks are assessed in isolation.

A cyber incident might originate with a third-party supplier before escalating into an operational, financial and reputational crisis. Geopolitical tensions, while appearing distant, can disrupt shipping routes, increase energy costs, drive inflationary pressures and expose organisations to new cyber threats. Extreme weather events can damage physical assets while simultaneously disrupting operations and supply chains.

“The risk landscape for large organisations has become far more complex, and much more interconnected, over the past decade,” says Lyons. “One disruption often triggers several others.”

“Large UK and international organisations are facing a mix of traditional risks that have intensified, alongside entirely new risks created by AI, geopolitics and digital interdependence.”

While traditional concerns such as property damage, liability and business interruption remain important, boards are increasingly focused on risks that can emerge rapidly, spread globally and create far-reaching financial and reputational consequences.

“Geopolitical instability is not going away. It is becoming a constant.”

Cyber risk remains one of the clearest examples.

The frequency and sophistication of ransomware attacks, data breaches and supply-chain compromises have increased significantly in recent years. As organisations become more digitally connected and increasingly reliant on third-party providers, cyber resilience has evolved from a technical concern into a strategic business issue.

Yet awareness does not necessarily translate into preparedness.

“Most large organisations now recognise cyber and AI as major board-level risks,” says Lyons. “But I would not say they all fully understand their exposure or have the resilience capabilities needed to manage them.”

Compliance is not resilience

The distinction is important. Businesses have invested heavily in governance, compliance and regulatory frameworks, but Lyons believes many organisations still overestimate their ability to respond when disruption occurs.

“A key gap is confusing compliance with real resilience,” she says. “Just because you pass an audit doesn’t mean you can withstand or recover from a major event.”

That message is becoming increasingly relevant as organisations accelerate their adoption of AI technologies. While many businesses are embracing AI to improve efficiency and productivity, governance frameworks are often struggling to keep pace.

“AI governance is lagging behind adoption,” Lyons says, pointing to risks around data leakage, legal exposure and accountability.

The issue is not limited to technology. Geopolitical instability continues to reshape the risk environment, creating uncertainty for organisations across virtually every sector. Ongoing tensions in the Middle East, conflicts in multiple regions and an increasingly fragmented geopolitical landscape are affecting businesses both directly and indirectly.

“Geopolitical instability is not going away,” Lyons says. “It is becoming a constant, and businesses need to plan for operating in a state of ongoing disruption, not just isolated incidents.”

For many UK companies, the effects are felt less through direct exposure and more through their consequences. Rising fuel costs, pressure on global shipping routes, supply-chain disruption and market volatility can all have a direct impact on business performance. Even organisations with no physical presence in affected regions might find themselves exposed through suppliers, logistics networks or digital dependencies.

Those pressures are arriving at a time when many businesses are already facing difficult economic conditions. Higher costs, tighter margins and uncertain growth prospects are forcing organisations to scrutinise spending more closely and, in some cases, delay investment.

“It is a tougher environment, and most UK businesses are feeling it,” says Lyons. “Margins are under pressure, costs are higher and growth is less certain.”

“Businesses need to understand their current risks, not rely on old assumptions. Focus on resilience, not just cutting costs.”

Looking beyond cost-cutting

However, Lyons warns against viewing resilience as an area where savings can be made. While economic pressures encourage organisations to focus on cost control, cutting expenditure alone is unlikely to strengthen their ability to withstand future disruption.

“Businesses need to understand their current risks and not rely on old assumptions,” she says. “They should focus on resilience, not just cutting costs.”

That means continually reassessing exposures, understanding critical dependencies and ensuring risk management strategies reflect the realities of the current, rather than prior, operating environment.

Importantly, Lyons argues that the current insurance market provides an opportunity for organisations to strengthen rather than reduce protection.

With market conditions becoming more favourable in several classes, businesses might be able to secure broader coverage, higher limits and improved terms at a lower cost than in the past.

“They should use the current insurance market to strengthen their cover,” she says. “As we are in a softer market, businesses can take advantage of better pricing and terms to fix gaps in their programmes.”

For risk managers, this represents an opportunity to move the conversation beyond premium spend and towards resilience.

That shift is also changing expectations of brokers. Increasingly, organisations are looking for strategic advice, analytics, benchmarking and support in understanding emerging exposures rather than simply placing insurance.

The role of risk management itself has evolved.

“When I first came into the industry, risk management was largely about compliance and insurance –identify the risk, transfer it and move on,” Lyons says. “Today, organisations are taking a much broader view.”

That broader view reflects a growing recognition that disruption is inevitable. The question is no longer whether businesses will face shocks, but how effectively they will respond when they do.

The organisations best positioned to succeed will not be those that avoid disruption altogether, but those that understand how risks connect, challenge outdated assumptions and invest in the resilience needed to continue operating when disruption occurs.

“A challenging environment is pushing businesses to be sharper,” Lyons says. “Those actively managing their risks are the ones best placed to succeed.”

For more news from AIRMIC Today, click here.

Did you get value from this story? Sign up to our free daily newsletters and get stories like this sent straight to your inbox.