The Defence Secretary, Wes Streeting asked the country a question this week. It lands differently in a boardroom.
On 22 October, at the opening of a new gun hall in Telford, Wes Streeting told households to keep three days of supplies: bottled water, food that doesn’t need a fridge, a battery or wind-up radio, and some cash in case card payments and cash machines stop.
Then he asked a question aimed at everyone, including business:
“How would we cope if the payment systems at the local supermarket went down?”
The tone was deliberately calm — alert rather than alarmed — but the list of things he was alert to was not vague. Increasingly sophisticated cyber attacks on businesses. Disruption to essential supply chains caused by hostile states or terrorists.
The household advice translates more directly than it looks.
Three days of water and tinned food is a continuity plan with a 72-hour horizon. Cash under the stairs is a manual workaround for a failed dependency. A wind-up radio is an out-of-band communications channel.
Strip the domestic framing away and a Cabinet minister has just advised every household in the country to do business continuity planning.
Most organisations would tell you they already have that. The harder question is whether it has been tested against the scenarios he named rather than the ones that were convenient to model.
Five questions worth asking this week
- Do you know how AI is being used across your business, and who is accountable for it? Not the approved deployments. The ones inside tools you bought for something else.
- How exposed are you to global tensions? Sanctions regimes change faster than supplier onboarding. Suppliers in unstable regions rarely appear in your register as “unstable region”.
- If your systems went down tomorrow, how would you keep trading? Streeting’s supermarket example is useful precisely because the failure is mundane. Not a breach. Not a headline. Payments simply stop.
- Which suppliers could you not do without, and what is your plan B? Most third-party risk programmes stop at tier one. The dependency that stops you trading often sits two tiers further down.
- Does everyone know who decides what in a crisis? The decision to take a revenue-generating system offline is commercial, not technical. If the answer is “we’d escalate”, escalate to whom, and how fast?
#RISK Expo Europe: Why this sits across three stages, not one?
Read those five back and notice how few belong to a single department.
- AI accountability is governance.
- Supplier concentration is third-party risk.
- Trading through an outage is operational resilience.
Who decides is a board question.
That is the argument for the show at #RISK Expo Europe, where Justin Crump, CEO of Sibylline and a former British Army tank commander, delivers a keynote built in the week of the show from whatever is live; where Alex M., Head of Financial Services Cyber at the National Cyber Security Centre, speaks on geopolitical risk; and where operational resilience, supply chain concentration and AI governance each get sessions of their own.
Streeting’s framing was that everyone has a part to play. In most organisations, that means more people than currently get invited to the conversation.
#RISK Expo Europe, 10–11 November 2026, ExCeL London.
Build my agenda → (show me the sessions, exhibitors and speakers relevant to me)
Sources: ITV News · Brit Brief
No comments yet