Four Strategic Moves to Make in 2026

Last year at this time, the unexpected Los Angeles wildfires came with a sharp reminder: disruption doesn’t wait for a strategic planning cycle. With $40 billion in insured losses and thousands of businesses navigating complex business interruption claims1, one truth stood out — risk maturity is built long before a crisis, and it’s what determines who gets back to business first. 

The HUB International 2026 Profitability & Resiliency Executive Survey shows this divide is widening. Nearly one-third of organizations operate without a mature, enterprise-wide risk strategy, and only 5% demonstrate advanced maturity. With rising costs, AI-enabled cyber threats, geopolitical volatility and climate-driven events, organizations must move from reactive to ready.

Here are four strategic moves to prioritize in 2026. 

1. Calculate Your Total Cost of Risk (TCOR)

Most organizations underestimate the full financial impact of risk. Beyond premiums, the true cost includes uninsured exposures, volatility, business interruption, reputational damage, deductibles and self-insured retention. Yet only 31% factor reputation into TCOR — despite its outsized effect after a crisis. 

The Los Angeles fires illustrate this clearly: debris removal, code upgrades, delayed reopening, vendor failures and relocation costs can eclipse insured losses and prolong downtime. 

The HUB EDGE: You can’t navigate what you can’t see. A full view of risk costs helps leaders allocate capital wisely and strengthen resilience long before disruption hits. 

2026 Takeaways 

  • Expand TCOR to include reputation, regulatory exposure, uncovered losses and volatility. 
  • Use catastrophe modeling, cyber quantification and stochastic analysis. 
  • Reassess coverage annually as valuations, supply chains and climate exposures shift. 

2. Embed Risk Analysis in Strategic Planning

Only 26% of organizations use past, current and future risks to guide decision-making. Without a forward-looking risk lens, strategies that seem sound on paper can collapse as conditions change. 

HUB’s property, casualty and cyber leaders note that many losses are predictable with the right data. Organizations that incorporated climate trends, labor dynamics, cyber threat intelligence and accurate valuations into planning last year avoided the surprise premium increases and supply chain delays others experienced. 

“Once a company suffers a loss, they often increase their coverage. It's very reactive,” says Blake Giannisis, HUB’s Property Practice Leader. Mature organizations flip that pattern — they anticipate impacts before they materialize. 

The HUB EDGE: Clarity comes from data. When decisions are pressure-tested against emerging risks, leaders move faster with fewer surprises. 

2026 Takeaways

  • Bring climate, labor, cyber, AI and geopolitical risks into annual planning cycles.
  • Use scenario modeling and stress tests to validate strategy before investing.
  • Incorporate risk scoring into capital allocation and budgeting decisions. 

3. Build Your Business Continuity Foundation

Understanding vulnerabilities and the potential cost of downtime is the foundation of resilience. Yet while 61% of organizations report having an Enterprise Risk Management (ERM) program, only 52% have a detailed business continuity plan. As Raymond Monteith, HUB’s Organizational Resilience Practice Leader, puts it: “An ERM program that does not include a business continuity plan ignores the crucial component of operational resilience that a response and recovery plan affords. ERM and business continuity should be tightly integrated.” 

The value of preparation is evident. When a major hurricane hit the Southeast, a regional bank with an integrated continuity plan became the first to reopen. Their advantage wasn’t luck — it was assessment, planning and testing long before the storm arrived. 

The HUB EDGE: Resilience isn’t built in a crisis. It’s built long before one ever happens. 

2026 Takeaways

  • Conduct a business impact analysis and update continuity plans annually. 
  • Test BCPs and incident response plans through simulations and tabletop exercises. 
  • Treat continuity as a required component of ERM, not a separate effort. 

4. Distribute Risk Ownership Throughout the Organization

Only 15% of organizations believe risk is everyone’s job — even though 67% have a dedicated risk manager or ERM function. Monteith calls this 15% “the most mature respondents” because they understand that operational, cyber and reputational risks originate across the business, not just within the risk team. 

Organizations that embed shared accountability have more eyes on emerging risks, faster response times and stronger alignment between strategy and execution. 

The HUB EDGE: The most resilient organizations make risk everyone’s business — and make it simple to act on it. 

2026 Takeaways

  • Make risk identification part of every role and performance plan. 
  • Train employees to spot, report and mitigate operational and cyber risks. 
  • Create cross-functional committees to broaden visibility and accelerate action. 

A Resilient 2026 Begins with Risk Maturity 

Risk maturity should not be treated as an afterthought, as it now represents a significant competitive differentiator. Organizations that strengthen continuity foundations, make risk-informed decisions, understand their true cost of risk and embed shared accountability will recover faster and outperform competitors relying on reactive approaches. 

Download the full HUB International 2026 North American Report to benchmark your organization and chart your path to greater profitability and resilience in the year ahead. 

1 Swiss Re, "Wildfires and thunderstorms drive global insured losses in first half of 2025," Aug. 6, 2025.