Gartner Says 64% of Audit Leaders Now Find It Harder to Spot Risks Before They Have a Material Impact

Sixty-four percent of audit leaders say it has become more difficult to spot potential issues before they begin to materially impact the organization, according to Gartner, Inc., a business and technology insights company.

During the opening keynote at the Gartner Enterprise Risk, Audit & Compliance Conference today, Gartner analysts argued that this finding, from an April 2026 Gartner survey of 108 audit leaders, underscored the need to equip business leaders with greater risk know-how.

“Audit, risk and compliance functions cannot realistically manage every risk themselves now,” said Nancy Queally, Managing Vice President in the Gartner Assurance Practice. “They must find ways to better equip business leaders to manage risks more independently.”

During the keynote the analysts explained that the race to adopt AI, new strategies and new operating models amidst rapidly evolving regulation and geopolitical uncertainty is overwhelming traditional governance, controls and risk management practices.

“This environment has raised the bar on what is required of business leaders,” said Tegan Gebert, Vice President in the Gartner Assurance Practice. “What it takes for them to fulfil their risk responsibilities is not only harder to achieve, but also even more critical to get right.”

Providing business leaders with more policies, risk information and oversight will not be enough to close the growing gaps. To help business leaders better manage corporate risk requires building their understanding of what’s required of them and fostering their ability to do it well.

“Many assurance leaders are acutely focused on providing the business with greater visibility on risks, and more insights,” said Queally. “That’s valuable, but it’s not enough. Insights do not automatically mean the business knows what to do, or is able to do it.”

Gartner findings shared in the keynote suggested that most business unit leaders struggle to translate assurance insights into action with only about 30% saying, “My ability to manage risks is heavily influenced by the insights and findings I receive from audit, compliance and ERM.”

The growing control and oversight gap is reflective of a confidence gap at the business leader level, in how to manage risk independently of assurance functions. This confidence gap can be filled by building know-how outside traditional assurance functions.

The keynote made the case for three actions that assurance functions should take to broaden risk know-how in their organizations:

1. Design Know-How as a Service
   Assurance teams must find new ways to teach business leaders about their risk ownership responsibilities and how to fulfil them in ways that are easily scalable and repeatable. This can include embedding guidance and decision support tools into existing business workflows, delivering assurance coaching exactly when and where it is needed. Further, assurance teams can develop repeatable processes where they collaborate with the business
2. Improve Know-How with AI
   Assurance team investments in AI tend towards productivity use cases. While such improvements are real, organizations usually lack the ability to meaningfully exploit widely distributed, marginal productivity gains. However, by codifying assurance expertise and knowledge for automated systems, there is also a huge opportunity to then scale that know-how throughout the wider busines
   
   “AI can help us translate and deliver deep process knowledge and expertise – which is exactly what's needed for business leaders to operate on risk with greater autonomy,” said Gebert. “It is realistic now for assurance leaders to be thinking about AI tools that can help business leaders complete risk management tasks or validate their thinking against audit, risk and compliance expertise. 
3. Scale Know-How by Partnering across Assurance
   Audit, risk and compliance functions should define common expectations for good risk ownership and coordinate to share know-how with the business. By partnering to share observations and actions to fill gaps, assurance teams create a more complete view of where business leaders need help while reducing duplication (and fatigue), and using each function’s respective expertise to strengthen risk ownership across the organization.

“The question is not how audit, risk and compliance teams can manage more risk themselves, but how they can enable the business to make thousands of decisions safely every day,” said Queally.