Enterprise risk management (ERM) teams should make greater use of AI-generated risk insights, according to Gartner.
They should also work to incrementally quantify and improve the timeliness of risk insights to make them more actionable and keep pace with today’s rapidly changing risk conditions.
Elliott Long, director analyst in the Gartner Audit & Risk Practice, explains how improvements in these three key areas can improve risk reporting.
“Risk reporting is often too repetitive, too slow or too subjective to help decision making,” he says. “The risk environment has changed with more risks at a faster pace than ever before. ERM teams must innovate if they are to keep up.”
Use AI to Generate New Risk Insights
ERM teams should go beyond streamlining reports and visualizing data by using AI to detect trends, uncover risk dependencies and recommend potential risk responses.
Long cites as an example how an organisation used AI to analyze 100,000 records in 20 seconds, bringing new insights into fraud events and the effectiveness of key controls into its risk reporting.
“AI can generate new insights for risk reporting, not just provide efficiency,” he says. “Efficiency and insight generation don’t have to be mutually exclusive. You can get both at the same time.”
Move Toward More Timely Risk Insights
Quarterly reporting remains important, but it may not provide decision-makers with sufficiently timely information when risk conditions change between scheduled committee meetings. ERM teams should connect risk indicators with business performance data, so everyone can see how changing risk exposure is affecting operations.
“Bringing risk updates closer to real time enables an ongoing dialogue with the business about performance and risk together,” says Long. “Even relatively simple improvements, like pre-defining trigger events and the associated required actions, can help ERM teams move from retrospective reporting towards predictive risk insights that have clear actionability.”
Quantify Risks to Improve Decision Making
Expressing selected risks in monetary terms gives executives a more consistent basis for comparing risk exposures, evaluating mitigation investments and making strategic decisions.
“ERM teams can overcome stakeholder skepticism by quantifying risks, starting with one small pilot,” said Long. “This risk quantification pilot could focus on a single risk or business decision where the available information is strong, and the results can support capital investments.”
Long emphasized that the goal is to incrementally improve the value of risk reporting to decision-makers rather than attempting to transform every element at once. ERM leaders should begin with one practical improvement to their reporting, whether using AI to uncover new insights, moving toward more timely updates or piloting risk quantification.