Preparedness Matters More Than Prediction: Uncertainty and Professional Service Firm Resilience

Evolving risk landscape

There is much discussion of the necessity for organizational resilience. Clearly, increased levels are required in some industries, evidenced by those subjected to disrupted supply chains and high-profile cyber-attacks. The interconnectivity of risks is very apparent, geopolitical and cyber being prominent illustrations.

Interacting risks are not new. The concept of messy and wicked risks exists in the vocabulary of risk management, signifying respectively complex risks and those with multiple dependencies.

Core fundamental risks remain constant, including people and strategic risks. The UK Treasury’s definition of risk is “the effect of uncertainty on objectives. Risk is usually expressed in terms of causes, potential events, and their consequences.”

So, what is new about uncertainty and the related need for resilience?

Changes in risk driven by technology adoption and volatile politics may be factors increasing risk velocity and severity. Political risk is not new of course. Technology and cyber risks have been with us for a while but have become more complex with cyber risk constantly changing and becoming more difficult to manage.

Why are changes occurring? Here are two factors:

1. The application of rapidly evolving AI with the need for people to adapt, presents a variety of short and longer term risks.
2. Geopolitical stress and political related risks are cited in surveys, e.g. cash flow and global political uncertainty. Cyber risk is strongly affected.

Having said that, longstanding risk management principles remain relevant:

• Shocking recent examples of technology mishaps were seemingly more about behavior, management, quality controls or culture rather than the actual technology. This emphasizes the need for robust conventional risk management structures.
  
  
• Fundamental strategic challenges involve opportunity risks that must be embraced in a competitive environment, with AI being prominent. This creates unavoidable exposures to risks which must then be managed.

People risk is a constant. Personal errors of judgment are often related to culture or governance. The traditional solutions remain, as do conventional management and governance responses, such as training and risk awareness, which can be adapted to embrace the new risks.

The related concept of “Talent” is a much-quoted risk in current surveys. On the cultural side, it is worth dwelling on trust and emotional intelligence which enable people to function when stress and uncertainty are high. Geopolitical tensions, technological acceleration, and client pressures are potentially creating new levels of workplace stress.

Resilience is not a new requirement

Resilience has always been about adapting to change and having systems in place to withstand setbacks, particularly when unexpected.

Fundamentally, building resilience begins with risk identification and analysis. Contemplating a wider risk horizon with more focus on developing scenarios and charting interconnections is now required. These dynamics can be incorporated into existing risk evaluation processes to address the new environment.

What factors are creating new challenges?

• Current risk assumptions may be wrong or outdated
• New externalities present increasing uncertainty
• New levels of resilience may be demanded.

Why current assumptions may be wrong or outdated

1. Risk management contains shortcomings if it fails to look at the bigger risk landscape.
2. Resources must be aligned to the identification of new and emerging risks to assess evolving vulnerabilities.

Of course, prediction is very difficult. Pre-COVID “pandemics” appeared in risk surveys. Many scenarios modelled but did not match the actual events and their continuing consequences. They did not contemplate the global scale, the length of lockdowns, and the continuing long-tail effects. Having said that, although assumptions were proven to be wrong, levels of resilience in the face of these unknowns proved to be quite high.

Adequate insurance can form part of the resilience plan. The coverage scenarios may be evolving. Insurers themselves are challenged by the current environment, partly because they are seeking growth in a soft market. Pricing is stretched and risks are arguably increasing. A change in market sentiment could result in new restrictions.

PI and Cyber policies should be reviewed against these emerging risks and their consequences. Key areas include Al, regulatory investigation costs, supply chain exposures, and the interaction between the two coverages.

New externalities demand a re-think?

In the professional services environment, at least two current developments may require some thought.

1. PE investments – several questions have been posed about the effects on the quality of work, independence and culture. Offsetting advantages include extra investments in efficiency and technology. Finance, strategy and technology are all interrelated risks.
2. AI is an unavoidable risk and presents increasing complexity as the full extent of potential perils emerge. Key risks must be identified, encompassing technology, people and regulatory.

New levels of resilience are required?

Uncertainty and change create the potential for new risks to manifest within traditional risk categories.

Cyber resilience is receiving a lot of attention and recent incidents reveal the need for cooperation between all parties including suppliers, security firms and governments. Traditional measures to foresee and control risks are more challenging due to increasing complexity.

This is why preparedness may matter more than prediction. There are more “known unknowns”. Crisis management is a vital element in the response, and that may demand a re-think of potential scenarios.

A holistic response – the facts are there, analysis is needed

Some risks emerging from current conditions have been labelled Black Swans. This is questionable. As Black and Grey Swans: 5 Ways to Avoid Shocks pointed out, Black Swan events are sudden shocks that could not have been foreseen or predicted. Grey Swan events however are predictable but unlikely surprises.

Resilience is about learning from all shocks, reorganizing around them, and emerging stronger. Connectivity across risk management resources is key. Human error may still at the core, phishing and social engineering being prominent examples of why this is true.

Failures may arise from operational errors, but vulnerability around values and ethics should also be examined. This is particularly true for reputation risks. Many risks revolve around the people and culture, both in terms of emergence and response. Keeping the workforce engaged and building trust are important parts of the equation.

Read more about professional service firms and Enterprise Risk Management.

About Aon

Aon (NYSE: AON) exists to shape decisions for the better — to protect and enrich the lives of people around the world. Through actionable analytic insight, globally integrated Risk Capital and Human Capital expertise, and locally relevant solutions, our colleagues provide clients in over 120 countries with the clarity and confidence to make better risk and people decisions that help protect and grow their businesses.

Follow Aon on LinkedIn, X, Facebook and Instagram. Stay up-to-date by visiting Aon’s newsroom and sign up for news alerts here.

©2026 Aon plc. All rights reserved.

Aon is not a law firm or accounting firm and does not provide legal, financial or tax advice. Any commentary provided is based solely on Aon’s experience as insurance practitioners. We recommend that you consult with your own legal, financial and/or insurance advisors on any commentary provided herein. All descriptions, summaries or highlights of coverage described herein are for general informational purposes only and do not amend, alter or modify the actual terms and conditions of any relevant policy. Coverage is governed only by the terms and conditions of such policy. Insurance coverage in any particular case will depend upon the type of policy in effect, the terms, conditions and exclusions in any such policy, and the facts of each unique situation. No representation is made that any specific insurance coverage would apply in the circumstances outlined herein. Please refer to the individual policy forms for specific coverage details.

The information contained in this document and the statements expressed are of a general nature and are not intended to address the circumstances of any particular individual or entity.

This document is not intended to address any specific situation or to provide legal, regulatory, financial, or other advice. While care has been taken in the production of this document, Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the document or any part of it and can accept no liability for any loss incurred in any way by any person who may rely on it. Any recipient shall be responsible for the use to which it puts this document. This document has been compiled using information available to us up to its date of publication and is subject to any qualifications made in the document.

Insurance products and services offered by Aon Risk Insurance Services West, Inc., Aon Risk Services Central, Inc., Aon Risk Services Northeast, Inc., Aon Risk Services Southwest, Inc., and Aon Risk Services, Inc. of Florida and their licensed affiliates.