Section 3 – Managing risks

Some risk management measures have declined

The general picture is a high level of understanding of technology risks, with some growing caution. However, this does not appear to translate into action, with low levels of uptake of policies and procedures to manage common technology risks.

In some cases, risk management appears to have relaxed. For example, in 2022, 61% of respondents said they had a policy to regulate IP licensing. Despite growing concerns about AI-related IP disputes, this proportion fell to 55% in 2024. Adoption of this policy only grew among respondents in the Life Sciences & Healthcare sector, suggesting a greater awareness of disputes of this nature.

As noted elsewhere in this report, there has been a growing incidence of data-related claims over the last two years. Perhaps surprisingly, that has not translated directly into risk management measures, at least in the form of risk management plans. Only 56% of respondents had an incident response plan to manage a cyber breach, a modest increase from 54%. Meanwhile, the proportion of respondents which carry out tabletop exercises to simulate a cyber-attack reduced from 69% to 64%, and respondents which had plans to manage claims by individual data subjects of a breach or misuse of data reduced from 60% to 54%.

Given the indication by survey respondents that the management of data and data security is the principal driver for adoption of new technologies, this may indicate an over-reliance by businesses on technological solutions to manage the risks relating to a data claim and, potentially, a lack of investment by businesses in the policies and procedures to deal with the risk of human error.

When it comes to managing a general technology failure, businesses in the Media sector should fare better than others, with 80% having plans in place. Businesses in the Life Sciences & Healthcare (49%) and Financial Services (66%) sectors would manage less well.

Overall, businesses in the Consumer & Retail sector showed a noticeably greater level of preparedness than other sectors surveyed, but those businesses are not well prepared for managing class actions, with only 33% having plans for the management of group claims.

Across the geographical regions surveyed, there was relatively little difference in the overall levels of preparedness.

Barriers to risk management

Internal barriers to minimising technology-related risks have remained largely steady since 2022, with a couple of notable changes: fewer respondents identified resistance to change as a leading barrier this year (47%, down from 54%), but this is offset by an increase in the proportion who report a lack of time or resources (54%, up from 49%). Life Sciences & Healthcare businesses in particular are concerned about lack of time and resources, with 64% reporting it as an issue.

There are significant variations across sectors. Consumer & Retail respondents are particularly concerned about lack of board commitment, with 60% reporting this as a barrier to effective risk management, whilst the figures for respondents in the Energy and Financial Services sectors are only 17% and 21% respectively, indicating strong alignment between directors and the legal and risk management teams.

Only 37% of respondents in the Consumer & Retail sector identify lack of in-house skills and expertise as an issue, much lower than other sectors surveyed.

Perhaps surprisingly, respondents from larger organisations were more likely to identify lack of time and resources as an issue: 73% of businesses with 250k+ employees. Those respondents also considered resistance to change to be an issue (70%), whilst this was noticeably lower for smaller businesses (41% for businesses with 50,000 or fewer employees) suggesting the larger organisations are less flexible or more set in their ways.

Notwithstanding the challenges in managing technology risks, according to our survey respondents, 82% of businesses across all sectors consider that they need constantly to update their technologies to compete with others in their sector. In the Energy sector, 96% held that view, and 75% of respondents expect to make greater use of new technologies such as AI over the next three years, with 87% of respondents in the Media sector holding that view.