Audit committees have always been asked to oversee financial reporting and internal control. Over the last few years the agenda has grown to include cyber, third parties, climate disclosure and now artificial intelligence. A new survey suggests the agenda has also changed in priority: Deloitte and the Center for Audit Quality’s 2026 Audit Committee Practices Report, published on September 22, 2026 and based on responses from nearly 250 audit committee chairs and members, ranks enterprise risk management (ERM) as the committee’s number one priority.
The headline is ERM. The more useful detail sits underneath it: a sharp rise in the importance of AI governance, and a much smaller rise in confidence that committees can actually oversee it. This article explains what the survey says, why the confidence gap matters, and a five-step plan any committee can start before its next meeting.
Crest.Digital’s platform gives risk, audit and procurement teams continuous visibility of third-party dependencies, open remediation and control health, ready for the committee pack.
Explore the PlatformWhat the 2026 Audit Committee Survey Found
The report covers several themes. Four findings stand out for anyone responsible for risk, audit or governance, and we quote them as published by Deloitte and the CAQ; readers should consult the full report for exact wording and methodology.
The Numbers Behind the Shift
- ERM is the top priority. Enterprise risk management emerged as the number one priority for audit committees, and 54% of respondents say their committee has become more focused on emerging risks over the past year.
- AI governance has more than doubled in importance. 75% now rank AI governance among their top three priorities, up from 35% the year before.
- Confidence trails priority. Only 56% are confident in their committee’s ability to oversee AI governance effectively, and 70% name technology, including AI, as the top skill needed to improve effectiveness.
- Cyber oversight feels more mature. Cybersecurity appears most often among the top three priorities, and 82% of committees that oversee it feel confident doing so.
Read together, the data tells a simple story. Committees are confident about the risk they have overseen for a decade, cyber, and unsure about the one that arrived in the last two years, AI. The survey also notes that 41% see higher-quality discussion and challenge in meetings as the biggest opportunity to improve. Challenge needs something to challenge, and that is where most committees run into trouble.
Why ERM Has Moved to the Top of the Agenda
ERM rising to number one is not a surprise once you look at what committees are being asked to hold in their heads. Geopolitical disruption, tariffs, supplier concentration, AI adoption, cyber incidents and regulatory change do not arrive one at a time, and they rarely stay inside one function. We covered this in our piece on why connected risk needs board action, and the same logic applies here: the committee that reviews each risk in isolation sees the parts but not the chain reaction.
ERM is the discipline that is supposed to connect the dots. The COSO ERM framework frames risk management as part of strategy and performance, not as a register that sits beside them. When a committee names ERM its top priority, it is implicitly asking for three things: a consistent way to identify and rate risks, a view of how they interact, and evidence that responses are working.
Many organisations can deliver the first and struggle with the second and third. A risk register updated twice a year is a list, not a management system. Emerging risks, the area where 54% of committees say they are looking harder, are by definition the ones that are not yet on the register. Our analysis of the RBI Governor’s warning makes the same point from a central-bank view: being strong today is not the same as being safe tomorrow.
The AI Confidence Gap: Why Committees Feel Unready
Why would 75% of committees put AI governance in their top three and barely more than half feel able to oversee it? In our experience advising risk and audit teams, three practical reasons recur.
First, there is no inventory to oversee. Management often cannot say how many AI systems, models and agents the business uses, including those embedded in vendor software. Without a list, the committee is overseeing a topic rather than a portfolio. Our guide on why your AI inventory starts with your vendor inventory shows where to begin.
Second, policies are mistaken for controls. An approved AI policy is a statement of intent. It becomes an internal control only when someone tests that it operates. We make the argument in detail in an AI policy isn’t an internal control until someone tests it, and the committee-level consequence is straightforward: ask for test results, not policy approvals.
Third, certification is read as assurance. A framework certificate such as ISO/IEC 42001 is useful, but its value depends entirely on scope. We explain in why ISO 42001 certified does not mean AI-governed how a narrow scope can leave the highest-risk use cases outside the certificate. A committee that hears “we are certified” should ask what the certificate covers.
The skills point in the survey is related. When 70% of respondents say technology, including AI, is the top skill needed, the issue is not that committee members must become engineers. It is that they need enough fluency to ask a good second question, and enough evidence in front of them to make the question worth asking.
A Five-Step Plan to Close the Gap
Closing the gap does not require a new framework. It requires converting ERM and AI oversight from narrative reporting into something testable. Here is a sequence any committee can request, each step with an owner and a date.
Ask for an AI Inventory With Owners
Request one register of AI systems, models and agents, including those inside third-party software, each with a named business owner, purpose, data used and risk rating. No register, no oversight.
Link ERM Risks to Controls and Owners
For each top enterprise risk, including AI and emerging risks, ask management to show the controls that mitigate it, who owns them, and when they were last tested. Gaps become agenda items.
Replace Policy Approval With Control Testing
Ask internal audit or an independent party to test whether key AI and risk controls actually operate, using risk-based samples rather than a single annual review. Report exceptions, not assurances.
Define Leading Indicators and Triggers
Agree a short set of indicators, such as supplier concentration, open remediation age, control failure rates and AI incident counts, with thresholds that trigger escalation between meetings.
Build Committee Fluency and Record the Challenge
Schedule short briefings on AI and emerging risk, and minute the questions asked and the decisions taken. A record of challenge is itself evidence that oversight is working.
Boards that want the testing step to rest on solid practice can draw on the Institute of Internal Auditors standards and on ISACA’s governance guidance. Our overview of risk and audit committee intelligence describes what a committee-ready evidence layer looks like in practice.
Crest.Digital’s Agentic GRC workflows monitor controls, track remediation and assemble committee-ready evidence continuously, with human approval and a full activity record. See the industries we cover.
From Quarterly Narrative to Continuous Evidence
The reason committees feel unready is partly structural. A quarterly pack is a snapshot compiled by hand, and by the time it reaches the table the risk has moved. Continuous monitoring changes what the committee can ask: not “is the register up to date?” but “which control failed this month, which supplier changed risk profile, and who is fixing it?”
This is where agentic AI earns its place. Agents can collect evidence across ERP, procurement and security systems, flag exceptions and drift, track remediation to closure and keep a log of every action, while accountable people review and decide. That human-in-the-loop design matters for the AI governance question itself: the tools that help oversee AI should be auditable too, a point we develop in why AI agents need audit trails. For third-party dependencies, see our overview of end-to-end vendor risk governance and the measurable impact organisations report.
Your Turn: Where Does Your Committee Sit Today?
- Narrative oversight: ERM and AI are discussed, but evidence is a quarterly deck.
- Structured oversight: An AI inventory and a risk-to-control map exist, with periodic testing.
- Evidence-led oversight: Indicators, test results and remediation status reach the committee continuously.
The survey says the priority is settled. The open question is capability. Which describes your committee? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
AI governance programmes that treat AI risk as a technology problem will be underprepared for the regulatory environment taking shape in 2025–26. The EU AI Act, NIST AI RMF, and emerging FCA guidance all frame AI risk as a governance and accountability question first — the technology controls follow from having clear answers to who is responsible, what decisions the AI influences, and what the escalation path is when the system behaves unexpectedly.
Frequently Asked Questions
The report, published on September 22, 2026 and based on responses from nearly 250 audit committee chairs and members, ranks enterprise risk management as the number one priority for audit committees. It also reports that 54% of respondents say their committee has become more focused on emerging risks over the past year. In practice that means committees are asking for a clearer view of how risks connect and whether responses work, not just a list of risks. Readers should consult Deloitte’s publication for the exact findings and methodology.
The survey reports that 75% of respondents rank AI governance in their top three priorities, up from 35% a year earlier, yet only 56% are confident they can oversee it effectively. By contrast, 82% of committees that oversee cybersecurity feel confident. Cyber has had a decade of established reporting, frameworks and metrics. AI is newer, often lacks a complete inventory, spans vendors and internal teams, and many committees report a technology skills gap. Confidence tends to follow the quality of evidence in front of the committee, so building an AI register and testing key controls is the fastest way to close the gap.
Start with five questions. Do we have a complete inventory of AI systems, models and agents, including those inside vendor software? Who owns each one? Which controls apply, and have they been tested rather than only documented? What indicators, such as incidents, exceptions and concentration on a few providers, will reach us between meetings? And what does any certification, such as ISO/IEC 42001, actually cover? Minute the answers, assign owners and revisit them at the next meeting.
A risk register is a list of identified risks with ratings and owners. Enterprise risk management is the wider discipline: setting risk appetite, identifying and assessing risks consistently, understanding how they interact, linking them to strategy and controls, monitoring indicators, and showing that responses work. Frameworks such as COSO ERM treat risk management as part of strategy and performance. A register is one input. If it is updated twice a year and not linked to tested controls, it describes risk rather than managing it.
Continuous monitoring replaces hand-built quarterly snapshots with current indicators: control test results, supplier risk changes, remediation ageing and AI incidents. Agentic AI can collect and correlate evidence across ERP, procurement and security systems, flag exceptions, track fixes to closure and keep an auditable log of every action, while accountable people review and approve. The committee then spends its time challenging trends and exceptions rather than reconstructing the picture, which is what the survey’s call for higher-quality discussion and challenge requires.