AI, geopolitical uncertainty overwhelming risk management practices

A Gartner survey has found that 64 per cent of audit leaders are finding it more difficult to spot potential issues before they have a material impact.

Managing vice president of Gartner Assurance Practice, Nancy Queally, said audit, risk and compliance functions cannot realistically manage every risk themselves.

During the Gartner Enterprise Risk, Audit and Compliance Conference, analysts explained that the race to adopt AI and new operating models amidst evolving regulation and geopolitical uncertainty is overwhelming traditional governance, controls and risk management practices.

“This environment has raised the bar on what is required of business leaders,” said Tegan Gebert, vice president in the Gartner Assurance Practice.

“What it takes for them to fulfil their risk responsibilities is not only harder to achieve, but also even more critical to get right.”

Providing business leaders with more policies, risk information and oversight will not be enough to close the growing gaps, according to Queally.

Helping business leaders better manage corporate risk requires building their understanding of what’s required of them and fostering their ability to do it well, she said.

“Many assurance leaders are acutely focused on providing the business with greater visibility on risks, and more insights.”

“That’s valuable, but it’s not enough. Insights do not automatically mean the business knows what to do, or is able to do it.”

Gartner findings shared in the keynote suggested that most business unit leaders struggle to translate assurance insights into action, with only about 30 per cent stating that their ability to manage risks was influenced by the insights and findings they receive from audit, compliance and their risk management teams.

“My ability to manage risks is heavily influenced by the insights and findings I receive from audit, compliance and risk management,” said Queally.

“The growing control and oversight gap is reflective of a confidence gap at the business leader level in how to manage risk independently of assurance functions. This confidence gap can be filled by building know-how outside traditional assurance functions.”

According to Gartner, assurance teams must find new ways to teach business leaders about their risk ownership responsibilities and how to fulfil them in ways that are easily scalable and repeatable.

“This can include embedding guidance and decision support tools into existing business workflows, delivering assurance coaching exactly when and where it is needed. Further, assurance teams can develop repeatable processes where they collaborate with the business,” it said.

Gartner said AI can also help organisations translate and deliver deep process knowledge and expertise, helping business leaders operate on risk with greater autonomy.

“It is realistic now for assurance leaders to be thinking about AI tools that can help business leaders complete risk management tasks or validate their thinking against audit, risk and compliance expertise,” said Gerbet.

Audit, risk and compliance functions can also strengthen risk management across the organisation by sharing expertise and observations to create a more complete view of risk.

“The question is not how audit, risk and compliance teams can manage more risk themselves, but how they can enable the business to make thousands of decisions safely every day,” said Queally.