Key takeaways
Cyberattack, data loss and health and safety lead GB board concerns, rated important by 83%, 82% and 80%, respectively.
GB directors broadly mirror global priorities but place greater emphasis on corporate crime and board structure and composition risks.
The Corporate Governance Code 2024 and Economic Crime and Corporate Transparency Act 2023 are reshaping board risk agendas.
Organisations are improving cyber preparedness, while boards seek clearer oversight of cyber risk, mitigation efforts, governance and fraud prevention.
WTW's Global Directors' and Officers' (D&O) survey report 2026, in conjunction with Reed Smith, sheds new light on the importance British boardrooms are attaching to the risks their organizations face. The results indicate that directors in Great Britain (GB) are identifying risks that are not drastically different to those identified in other regions, with GB having the same three top #3 ranked risks as five other regions (Europe, Asia, North America, Latin America and Pacific). This article considers the different factors that may shape the perception of the risks being faced. Interestingly, GB boards ranked two risks in the top #7 that were not ranked by directors in other regions: corporate crime and board structure.
This article considers the risks identified by GB directors, analyzes the findings in prior years and offers an observation on what is driving these results in order to inform future board risk management. We take each of the top 7 risks in GB in turn below.
Top 7 risks in GB
| Rank | Risk | Percentage |
|---|---|---|
| 1 | Cyber attack (includes cyber extortion) | 83% |
| 2 | Data loss | 82% |
| 3 | Health and safety | 80% |
| 4 | Systems and controls | 72% |
| 5 | Regulatory breach | 70% |
| 6 | Corporate crimes/ failure to prevent | 62% |
| 7 | Board structure, composition, independence, diversity | 61% |
Cyber attack and data loss
Out of all responses received from GB organizations, 83% ranked cyber attack as an "extremely" or "very important" risk. Data loss followed closely behind with 82% of respondents ranking it as an important risk. Whilst these figures show a slight decline in perceived importance according to the global average (cyber attack 75% and data loss 76%) boards in Europe, Asia, North America, Latin America and Pacific concur with GB’s view that these risks are within the top two most important that their organizations face. These two risks have been ranked consistently highly for the last decade.
It appears that many GB organizations are still seeking better knowledge of the threat that these risks present to their businesses. The Global Directors' and Officers' survey report 2026 shows that 60% of the GB respondents who identified cyber attack to be an important risk completed a cyber table-top exercise in the last 12 months, and that 80% also put a cyber incident response plan in place.[1] However, only 55% of global respondents feel as though they are "well informed"/"very well informed" about cyber risks facing their organization and only 45% feel that the board is "well informed"/"very well informed" about the effectiveness of its cyber security spend in reducing risk exposure. This may indicate that although GB organizations seem to be taking action to mitigate these cyber related risks, they do not yet have a confident understanding of the risks and how their actions will effectively mitigate them. Perhaps this is understandable given the relative newness and still developing nature of this risk category.
The significance and overall awareness attached to these risks by GB organizations has likely been exacerbated by the several widely publicized incidences of cyber attacks and data breaches suffered by British companies, causing significant business disruption and losses. This current awareness coupled with the fact that these risks only gained prominence within the last decade and GB organizations are still trying to digest them is likely to have influenced these findings.
Health and safety
This year, health and safety was ranked third by GB organizations, with 80% of respondents ranking it as a “very” or “extremely” important risk. The global average rankings of health and safety have slightly declined since their peak in 2024, from 84% to 80% to 77%. For those respondents who ranked health and safety as “important”, physical health and safety was still the "most important".
However, whether the dominance of physical health risk over mental health risk continues remains debateable; the survey results show that workplace factors and personal matters affecting mental health and wellbeing is undoubtedly gaining importance in a director’s assessment of the board level risk profile. Indeed, when asked about employees’ risk, respondents ranked mental health highest and some way above physical safety.
The development of health and safety risk as a global concern for directors and officers is discussed further in a separate article.
Governance risks
Systems and controls risk was ranked at #4 by GB organizations, with 72% of respondents ranking it as important, 6% higher than this year’s global average. Relatively speaking, GB remains in line with average global results regarding systems and controls risks over the last 3 years. Alongside, systems and controls, GB has ranked an additional corporate governance risk in the top 7, one which no other region ranked.
61% of GB respondents deemed board structure, composition, independence and diversity to be an important risk faced by their organization. The ranking could well be underpinned by the Section 3 Principles of the 2024 updates to the UK Corporate Governance Code 2024 (which applied to financial years beginning on or after 1 January 2025). The code operates on a ‘comply or explain’ basis for board appointments, composition and promotion of diversity, equity and inclusion (DEI).
Of the 52% of global respondents who said that diversity, equity and inclusion risks are important, only 40% of those organizations had regular briefings on relevant legal and regulatory developments and only 26% had engaged with external legal or DEI advisors on those risks. This suggests that organizations in GB should ensure that they continue to be up to date with developments in this sector to enable them to properly assess and mitigate risks as legal and regulatory framework develops.
We consider the global factors regarding DEI-related risks in a separate article.
Legal and regulatory risks
Corporate crimes/failure to prevent was ranked as the #6 most important risk facing GB organizations, with 62% of GB respondents deeming it an "important" risk. This is a risk that no other region ranked in their top 7, and is likely driven by the new failure to prevent fraud offenses contained in the Economic Crime and Corporate Transparency Act 2023, which came into effect on 1 September 2025.
The new corporate offenses of failure to prevent fraud (s.199 of the Economic Crime and Corporate Transparency Act 2023) means that an organization is held accountable if they benefit from a fraud committed by an associated person (including employees), and do not have reasonable fraud prevent procedure in place. This is a new risk that organizations are navigating and it is increasingly important for boards to put in place robust systems to prevent individuals from committing fraud offenses and to ensure that policies and procedures and put in place and are appropriately maintained and reviewed.
Regulatory breach was ranked at #5, with 70% of respondents perceiving it as an "important" risk. Regulatory risks consistently ranked as the "most important" risk faced by GB organizations between 2013 and 2017. Despite regulatory risks continuing to be important, these concerns may have been overtaken by others, which is consistent with the position globally. It could also be said that despite regulatory oversight generally increasing over recent years, organizations are better informed and more able to mitigate regulatory risks affecting their business.
Some of the global challenges in the corporate crime and regulatory space are discussed further in a separate article.
Conclusion
The findings of the Global Directors' and Officers' survey report 2026 reveal that GB organizations share many of the same broad risk priorities as their global counterparts, with cyber attack, data loss and health and safety occupying the top three positions. However, GB is set apart from other regions in the compliance risks GB face in relation to the UK Corporate Governance Code 2024 and the Economic Crime and Corporate Transparency Act 2023. Organizations would do well to focus their efforts on understanding these new risks and implement management strategies that are tailored to their individual situation and which they can trust to provide effective mitigation of the risks faced.
Footnote
- These results will be detailed in a separate report focusing on the Cyber results from the survey. Return to article
Authors
Contact
