All 2026 Conference Sessions

How To Prepare for High-Impact Audit Committee Interactions

Speakers:

• Tim Berichon, Executive Partner, Business Services, Gartner

Key takeaways

• Use one-on-one meetings with the Audit Committee Chair to prepare for formal discussions, align on key messages and seek guidance on sensitive issues.
• Leverage private executive sessions to discuss systemic concerns, emerging risks, management responsiveness and other matters requiring confidential committee awareness..
• Reserve formal Audit Committee meetings for issues requiring full committee visibility, oversight or action, including audit plans, significant findings, resources and emerging risks.
• Prepare for every interaction by aligning its purpose, attendees, topics, desired outcomes and supporting materials.
• Communicate objectively, emphasize systemic themes, protect confidentiality and appropriately document required interactions without compromising internal audit’s independence.

Managing Newly Emerged, Highly Interdependent Risks

Speakers:

• Jim Mello, Senior Director Analyst, Gartner

Key takeaways

• Newly emerged, highly interdependent (NEHI) risks are unlike enterprise risks or emerging risks because they are gradual, uneven and unpredictable. They often span multiple business areas in interconnected ways.
• There are three main types of NEHI risk response misalignments heads of ERM have told us: missing response(s), wasteful response(s) and harmful response(s).
• Missing response(s): Some risk drivers or impacts go untreated by any part of the business.
• Wasteful response(s): Multiple part of the business invest in redundant or duplicative treatments.
• Harmful response(s): Treatments in one part of the business have detrimental effects elsewhere.
• To respond to NEHI risks caused by the new risk environment, ERM must first detect instances of harmful alignment.
• ERM should guide the business to coordinate risk treatments.

From Risk Appetite to Cost Decisions: How ERM Enables Resilience That Gets Executed

Speakers:

• Suzie Petrusic, Vice President Analyst, Chief of Research, Gartner

Key takeaways

• Start by identifying the strategic, operational and revenue-generating priorities that matter most to the business.
• Evaluate risks based on their potential impact on those priorities rather than attempting to address every conceivable threat.
• Compare mitigation options and costs to ensure resilience investments deliver measurable business value.
• Define clear risk and cost appetites, so leaders can make consistent trade-offs between protection, performance and efficiency.
• Strengthen accountability by assigning resilience decisions to business owners and using phased actions, including near-term prioritization, a 90-day capability assessment and longer-term metrics.

Ready Your Data for AI

Speakers:

• Gleb Zhukov, Director Analyst, Gartner

Key takeaways

• Poor-quality data can be amplified by AI, producing unreliable results at greater speed and scale.
• Assurance leaders should begin with a priority AI use case and identify the data it requires. Different applications, such as fraud detection, AI-assisted data analysis and self-service chatbots, rely on different AI techniques and types of data
• Most assurance teams do not lack data, but they may lack data that is usable for AI.
• Leaders should establish what data they have, where it is stored, whether it can be accessed and whether its quality makes it suitable for the intended use.
• The cost of preparing data depends on the people, tools and effort required. A relatively simple project may involve an internal team cleaning data from one source, while a more complex use case may require data scientists, specialist tools and continuously updated data from multiple systems.

Using Incident Data to Evaluate Risk Monitoring Activity Performance

Speakers:

• Mara Lindokken, Director Analyst, Gartner

Key takeaways

• Few compliance leaders are highly satisfied with their current risk indicators. These indicators commonly fail to give a complete picture, risk exposure, or show leaders where to focus their attention.
• To improve risk monitoring activities, compliance leaders should evaluate them using two measures: precision shows how often alerts identify genuine policy or process deviations, while sensitivity indicates which monitoring activities identify the greatest share of verified incidents that lead to action
• Compliance teams should assess precision by determining how often alerts point to genuine policy or process deviations.
• To compare sensitivity, teams can use existing incident reports to track where verified, actioned incidents were first detected.
• Combining sensitivity with precision allows leaders to decide which monitoring activities to continue, modify or stop, while also considering the cost of operating them.
   

Building a Business­ Led Compliance Operating System

Speakers:

• James Crocker, Senior Director Analyst, Gartner

Key takeaways

• Only 10% of business leaders demonstrate highly active compliance involvement, while 90% have not received complete training and 68% have limited risk-management knowledge.

• Active business ownership supports faster issue remediation, stronger mitigation plans and less operational disruption.

• Effective compliance ownership requires both “know-what,” including clear roles and obligations, and “know-how,” including the skills and tools to manage risk.

• Compliance functions should enable and coordinate risk management by providing enterprise-wide visibility, standardized methods, self-assessments, playbooks, benchmarks, and scenario-based training.

• Organizations should strengthen ownership through a phased approach that assesses maturity, prioritizes high-risk areas, clarifies accountability, builds capabilities and monitors progress.