Australian independent schools report a wide gap between how prepared their boards feel and what they can do in practice, according to Aon’s 2026 Independent Schools Risk Report – and they do so as the financial and professional lines that cover that gap compete hard for well-governed risks. The report put average director assurance on cyber risk at 61.9% against average director capability of 37.1%, the widest such gap of any risk the sector recorded, using Convene Assure data. Released on June 29, 2026, and based on 306 schools surveyed between January and March 2026, the report ranks cyber threats, staff recruitment and retention, and mental health as the sector’s top exposures. For underwriters and brokers, the more useful reading is where that risk profile meets current market conditions.
Because accountability rests with the board when controls fail, the assurance-capability gap reads as management-liability exposure rather than a technical one. Schools also present as a severity risk. Katherine Jones, cyber incident response and privacy practice lead at Colin Biggers & Paisley Lawyers, said in the report that school-held data draws regulators once children are involved: “The highest ransoms our firm has seen paid have been for data breaches at schools.” Gavin Creighton, joint practice leader for the insurance group at the same firm, said “privacy breaches are increasingly triggering professional indemnity and management liability claims,” with parents seeking compensation when children’s information is exposed.
The national breach picture frames that exposure. The Office of the Australian Information Commissioner (OAIC) recorded 532 breach notifications in the January-June 2025 period, with malicious or criminal attacks the largest source at 59%, led by the health, finance, and Australian government sectors. Notifications reached 1,113 across 2024, the highest since the scheme began in 2018 and up 25% on 2023. Education did not sit among the top three notifying sectors – sharpening the report’s point that the concern is severity and downstream liability, not breach volume.
That demand-side risk arrives in a buyer’s market. Australian commercial insurance stayed soft through the first half of 2026, with financial and professional lines – directors and officers, cyber, professional indemnity, and management liability – continuing to soften, and clients with sound governance securing premium reductions and higher limits. Cyber has reached its steadiest underwriting position in years, posting positive insurance service results across the three most recent quarters in Australian Prudential Regulation Authority (APRA) data, though the class wrote only about 6,000 risks and $32 million in gross written premium in the March 2026 quarter. The exposure it covers is not easing. The average self-reported cost of cybercrime per report for businesses rose 50% to $80,850 in 2024-25, and for small businesses rose 14% to $56,600. For schools, the commercial logic is direct: those that close the assurance-capability gap can capture the better terms currently on offer across governance-sensitive lines, while capacity and pricing remain favourable.
Psychological injury is a live cost driver. Drawing on SafeWork Australia data that predates the current reforms, the Aon report put serious workers’ compensation claims for mental health conditions in education at an average of $67,400 and 35.7 working weeks off in 2022-23, against $16,300 and 7.4 weeks for other serious claims. The scale is visible statewide: psychological claims made up 12% of NSW workers’ compensation claims but 38% of total cost, and the average psychological injury claim cost rose from $146,000 in 2019-20 to $288,542 in 2024-25, per the Treasurer’s March 2025 ministerial statement.
Reform is narrowing recovery through the scheme. In Victoria, the WorkCover Scheme Modernisation Act, effective March 31, 2024, requires a mental injury to predominantly arise from employment and excludes stress or burnout from events considered usual or typical in a role. In New South Wales, reforms passed in November 2025 and February 2026 limited primary psychological injury claims to defined events, expanded the reasonable management action defence, and froze the Nominal Insurer’s premium target rate at 1.99% for 2026-27 and 2027-28.
The report frames this as a transfer. Kim Stapleton, national sales director for workplace risk at Aon Australia, said schools “may experience a reduction in their workers compensation costs but end up bearing the cost elsewhere,” through absenteeism, presenteeism, and income protection and liability claims. Gary McMullen, director of workplace risk at Aon, told Insurance Business Australia the “NSW workers’ compensation scheme stands at a critical crossroads and requires careful consideration to ensure its long-term sustainability.”
Attracting and keeping staff ranked second. Citing the TALIS 2024 Australian Report, Aon said full-time lower secondary teachers work 46.5 hours in a typical term week against an OECD figure of 40.8, and that about 24,864 people began initial teacher education in 2023, down from 35,000 to 36,000 in the mid-2010s. Replacing a teacher can cost up to one and a half times annual salary once recruitment and lost productivity are counted, according to Kristin Lopes of Colin Biggers & Paisley Lawyers.
The full top 10 ran:
Emerging risks included artificial intelligence, board capability, school travel, and e-bikes, permitted for students by 26% of schools.
On historic abuse exposure, the report noted the National Redress Scheme is legislated to end on June 30, 2028, with about 60% of applicants awaiting outcomes and no successor arrangement announced. That leaves schools and their liability insurers without settled guidance on how claims will be handled after that date. Lachlan Bowden, practice group leader of education for Australia at Aon, said the exposures are linked: “Cyber security, workforce dynamics, mental health, regulatory change, and financial sustainability are more closely linked and benefit from strong governance oversight and an integrated approach to risk management.”
