Businesses are taking a different approach to risk than they were three decades ago, according to Simon Rees (pictured), director at AE Insurance Brokers in Romsey, Hampshire. But how far that shift has taken hold still depends largely on business size, and even where it has, the risks themselves are moving faster than most review cycles can keep up with.
For the smallest firms, typically turning over a few hundred thousand pounds with five or six staff, insurance often remains an annual task rather than a continuous process. "Unfortunately they are often viewing the insurance as, we need to talk about this once a year," Rees said. "They'll be shopping around, rightly so, for the best price. But whether they're getting the best advice or the best cover, I'm not so sure these days."
Larger organisations tell a different story. "These companies in my experience are looking at their risks all the time," he said. "They're thinking about a variety of scenarios, what's happened to their supplier that's having problems with shipments via the Middle East, and they're considering what could arise from a climate perspective and how is this going to affect their business going forwards."
That shift towards continuous monitoring is being driven by risks that don't wait for a renewal date. Cybercrime is the one Rees believes businesses are least prepared for. "You're more likely to suffer a cyber attack that takes your business down than a burglary these days," he said, adding that fraudsters are increasingly sophisticated even against businesses with strong controls.
The scale backs this up: the Department for Science, Innovation and Technology's Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses identified a breach or attack in the past 12 months, while the proportion reporting lost revenue more than doubled year on year.
Climate change presents a slower-moving but equally structural challenge. Rees believes businesses need to think beyond property damage towards its operational consequences. "It's going to accelerate, in my opinion," he said, adding that extreme heat could push some manufacturers towards "a more continental style of working, where employees start their day earlier and work different shifts".
These pressures are increasingly showing up in the contracts businesses sign, not just the policies they buy. Professional indemnity and general liability are where Rees most often sees clients discover gaps between the two. "A lot of our clients are being asked to sign contracts that impose greater liabilities on them than provided by their insurance policy," he said.
"There are contractual liabilities that go way beyond the standard legal liability insurance cover provided, and that could leave them seriously exposed if there is a claim." Where those terms can't be negotiated, clients face a commercial choice: retain the residual risk with their eyes open, understanding exactly where their cover stops and their liability begins.
When asked what will distinguish resilient businesses over the next decade, Rees pointed to the quality of a company's risk register rather than simply having one. "All businesses need a risk register that's a meaningful document for them – what are the risks to their business? It should be reviewed regularly and not just by a management team," he said. "The best ones I see are where they reach out to other individuals within the business, and in some cases outside of the business."
He added: "There's nothing wrong with talking to your competitors, having a forum – what's the main issues for your business at the moment? I think that sort of attitude can really help inform where a particular sector is going."
Even a strong risk register, though, is only as good as the people applying it. "It's the human being at the other side of the keyboard which is often the weakest link," Rees said – a reminder that as risks multiply across cyber, climate and contract law, the businesses that cope best won't just be the ones with more coverage, but the ones that have built risk awareness into how people work, not just what they're insured against.
