.webp)
HM Treasury has published research on operational resilience in retail and hospitality, highlighting a gap between boardroom confidence and expectations of rising disruption.
The survey of 101 senior leaders in UK consumer-facing businesses was conducted with FreedomPay and Retail Economics. It found that 81% of respondents believe their organisation's investment in resilience is broadly sufficient, even though 60% expect operational disruption to increase over the next three years.
The data focuses on businesses in retail, leisure and hospitality, where payment systems and customer-facing operations are directly exposed to outages. The report warns that this mismatch between confidence and risk expectations could leave companies vulnerable if cyber incidents, geopolitical shocks or systems failures interrupt trade.
Cyber attack was cited by 51% of leaders as a top risk shaping resilience strategy over the next three years, making it the most frequently named threat in the research. Geopolitical instability followed at 42%, while 82% said global political developments had already increased their focus on resilience.
The findings also suggest senior management is not uniformly convinced that resilience spending delivers wider commercial value. Nearly half of respondents, 48%, said executives in their industry think too much is already being spent on resilience, while 45% said executives do not fully appreciate its value.
Confidence gap
A smaller but significant share of leaders acknowledged gaps in current spending. Seventeen per cent said their organisation's investment in resilience was insufficient.
That figure rose sharply among larger businesses. A third of large companies said investment was insufficient, compared with 15% of small businesses and 14% of medium-sized firms.
The results suggest larger organisations may have a clearer view of exposure across complex systems, supply chains and customer operations. At the same time, 67% of respondents said it is easy to secure board backing for resilience spending, indicating that access to budget may be less of a barrier than how directors judge the return on that spending.
Another measure in the research underlines that tension. Sixty-four per cent agreed that resilience investment reduces risk but delivers limited additional business benefit.
That view is significant in sectors where the commercial impact of an outage can be immediate. If payment systems fail, shops, restaurants and leisure venues can lose the ability to process transactions even when physical sites remain open.
Board priorities
The report argues that resilience is still often seen as a defensive cost rather than a core part of daily operations. In practice, that can make it harder for management teams to justify spending on systems designed to prevent events that may never visibly occur.
For boards, the challenge is compounded by the nature of resilience itself. Successful investment often means avoiding disruption rather than creating a visible new asset, making it harder to measure in conventional financial terms.
The research comes as the government has set out an economic agenda focused on stability after a prolonged period of political turnover. In that context, the findings raise questions about whether private sector businesses are placing enough weight on the systems that allow them to keep trading during disruption.
Retail and hospitality groups are particularly exposed because customer transactions sit at the centre of daily revenue. A payment outage, even if short-lived, can stop trade, affect consumer confidence and delay recovery if businesses cannot restore systems quickly.
The survey suggests many leaders already expect recovery times to lengthen in the coming years. That sits uneasily alongside the majority view that existing resilience investment is sufficient.
Sector exposure
The sample covered senior decision-makers with direct responsibility for risk management or membership of risk and audit committees in businesses with turnover above GBP £6 million. That means the findings reflect the views of executives responsible for assessing operational threats rather than a wider cross-section of employees.
Even so, the numbers point to a common concern across customer-facing sectors: threats are rising, but many boards remain comfortable with current levels of preparation. The result is a planning contradiction in which companies predict greater disruption while still judging present safeguards to be adequate.
Kevin Carson, senior vice president at FreedomPay, commented on the findings.
"This research shows a clear disconnect between how prepared businesses believe they are and the reality of the risks they themselves are forecasting," said Kevin Carson, senior vice president at FreedomPay.
"Resilience cannot be treated as a box-ticking exercise or a cost to be minimised. As the new government takes over plans for the UK economy, it must address the invisible vulnerabilities in our business infrastructure. Resilience must be built into the everyday running of a business, particularly at the point where a business interacts with customers and takes payment. That is often the first thing to fail during a disruption, and the first thing customers notice. Closing this confidence gap now, before the next shock arrives, should be a priority for every UK boardroom."