2026 Conference Highlights

From Risk Insight to Action

Session Highlights

How To Prepare for High-Impact Audit Committee Interactions
  • Use one-on-one meetings with the Audit Committee Chair to prepare for formal discussions, align on key messages, and seek guidance on sensitive issues.
  • Leverage private executive sessions to discuss systemic concerns, emerging risks, management responsiveness, and other matters requiring confidential committee awareness..
  • Reserve formal Audit Committee meetings for issues requiring full committee visibility, oversight or action, including audit plans, significant findings, resources and emerging risks.
  • Prepare for every interaction by aligning its purpose, attendees, topics, desired outcomes, and supporting materials.
  • Communicate objectively, emphasize systemic themes, protect confidentiality and appropriately document required interactions without compromising internal audit’s independence.
  • Newly emerged, highly interdependent (NEHI) risks are unlike enterprise risks or emerging risks because they are gradual, uneven and unpredictable. They often span multiple business areas in interconnected ways.
  • There are three main types of NEHI risk response misalignments heads of ERM have told us: missing response(s), wasteful response(s), and harmful response(s).
  • Missing response(s): Some risk drivers or impacts go untreated by any part of the business.
  • Wasteful response(s): Multiple part of the business invest in redundant or duplicative treatments.
  • Harmful response(s): Treatments in one part of the business have detrimental effects elsewhere.
  • To respond to NEHI risks caused by the new risk environment, ERM must first detect instances of harmful alignment.
  • ERM should guide the business to coordinate risk treatments.
  • Start by identifying the strategic, operational, and revenue-generating priorities that matter most to the business.
  • Evaluate risks based on their potential impact on those priorities rather than attempting to address every conceivable threat.
  • Compare mitigation options and costs to ensure resilience investments deliver measurable business value.
  • Define clear risk and cost appetites, so leaders can make consistent trade-offs between protection, performance and efficiency.
  • Strengthen accountability by assigning resilience decisions to business owners and using phased actions, including near-term prioritization, a 90-day capability assessment, and longer-term metrics.
  • Poor-quality data can be amplified by AI, producing unreliable results at greater speed and scale.
  • Assurance leaders should begin with a priority AI use case and identify the data it requires. Different applications, such as fraud detection, AI-assisted data analysis and self-service chatbots, rely on different AI techniques and types of data
  • Most assurance teams do not lack data, but they may lack data that is usable for AI.
  • Leaders should establish what data they have, where it is stored, whether it can be accessed and whether its quality makes it suitable for the intended use.
  • The cost of preparing data depends on the people, tools and effort required. A relatively simple project may involve an internal team cleaning data from one source, while a more complex use case may require data scientists, specialist tools and continuously updated data from multiple systems.
  • Few compliance leaders are highly satisfied with their current risk indicators. These indicators commonly fail to give a complete picture, risk exposure, or show leaders where to focus their attention.
  • To improve risk monitoring activities, compliance leaders should evaluate them using two measures: precision shows how often alerts identify genuine policy or process deviations, while sensitivity indicates which monitoring activities identify the greatest share of verified incidents that lead to action
  • Compliance teams should assess precision by determining how often alerts point to genuine policy or process deviations.
  • To compare sensitivity, teams can use existing incident reports to track where verified, actioned incidents were first detected.
  • Combining sensitivity with precision allows leaders to decide which monitoring activities to continue, modify or stop, while also considering the cost of operating them.
  • Only 10% of business leaders demonstrate highly active compliance involvement, while 90% have not received complete training and 68% have limited risk-management knowledge.

  • Active business ownership supports faster issue remediation, stronger mitigation plans and less operational disruption.

  • Effective compliance ownership requires both “know-what,” including clear roles and obligations, and “know-how,” including the skills and tools to manage risk.

  • Compliance functions should enable and coordinate risk management by providing enterprise-wide visibility, standardized methods, self-assessments, playbooks, benchmarks, and scenario-based training.

  • Organizations should strengthen ownership through a phased approach that assesses maturity, prioritizes high-risk areas, clarifies accountability, builds capabilities and monitors progress.

Save the date for 2027

Gartner Enterprise Risk, Audit & Compliance Conference 2027 returns to London, U.K., 27 – 28 September.

Join us to uncover the latest assurance insights and solutions with Gartner anaylsts, peers and service providers to accelerate your business.

“Great conference with relevant speakers on timely topics and peers across industries and geographies."

Joseph Garrison
VP Ethics & Compliance and Internal Audit, Sinch 

Sign up to get more information

Sign up to receive our latest updates on conference details.

By clicking the "Continue" button, you are agreeing to the Gartner Terms of Use and Privacy Policy.

Contact Information

All fields are required.

      By clicking the "Sign Up" button, you are agreeing to the Gartner Terms of Use and Privacy Policy.

      Back

      Ready to register?

      Secure your space now.