Businesses rank energy costs a top risk, yet many still lack a proper policy