Most boards still review risk the way it has always been organised: cyber on one agenda, AI on another, suppliers somewhere else, geopolitics in the strategy session. The EY Audit Committee Quarterly Update for Q3 2026 argues that this separation no longer matches reality. It describes geopolitical disruption, tariff uncertainty, AI, cyber risk, market volatility and regulatory change as converging across operations.
Our Crest.Digital News Bite covers the shift in a few minutes. Watch it, then read on for the board-action plan: what an audit committee can ask and decide at its next meeting.
A note on sources: this article draws on EY’s published summary of its Q3 2026 update. The full update covers more topics than we discuss here, including financial reporting and SEC regulatory developments, so readers should consult EY directly for exact wording. The board-action recommendations and the Crest.Digital perspective are ours, not EY’s.
Crest.Digital’s platform gives risk, audit and procurement teams continuous visibility of third-party dependencies, control status and open remediation, ready for the committee pack.
Explore the PlatformWhy the Audit Committee Agenda Is Changing
Audit committees once had a fairly contained remit: financial reporting, internal controls, internal and external audit. Over the past several years the remit has widened to include cyber, climate disclosure, third-party risk and now AI. The more important change is the one EY highlights: these topics are interacting. A supplier outage becomes a cyber event, which becomes a disclosure question, which becomes a liquidity or customer issue.
EY’s update asks committees to look past single-risk reviews to second- and third-order effects, and to test resilience through triggers, thresholds and contingency actions rather than assuming stability. That is a governance request as much as a risk one: it asks who connects the dots, and how often.
The Risks Are No Longer Separate
Think of the exposure as a chain: AI, cyber, supply chain, third parties and geopolitics, each linked to the next.
How One Event Travels Down the Chain
- Geopolitics to supply chain: Tariffs or sanctions force a change of supplier, often at speed and with less due diligence.
- Supply chain to third parties: The new supplier becomes a critical dependency, and often a concentration risk, before it has been properly assessed.
- Third parties to cyber: Supplier access and software become the way in. Our piece on supply chain cyber risk intelligence explains why a questionnaire cannot see this.
- Cyber to AI: AI systems and data pipelines widen the attack surface and the data-exposure risk.
- AI back to third parties: Most organisations rely on a handful of AI providers, a concentration theme in AI third-party concentration risk.
Each link belongs to a different owner and often a different committee. That is the gap connected-risk oversight is meant to close. For a recent central-bank view of the same theme, see the RBI Governor’s warning that strength today is not immunity tomorrow.
AI Widens the Board’s Lens, and Cyber Shortens the Clock
As AI scales, EY points the committee towards cost, return, accountability and control, with clear decision rights and appropriate controls over data and models. For a board that means asking more than whether AI is being used: who owns each use case, what it costs, what value it returns, what data it touches, and what happens when it is wrong. We argue in why an AI policy is not an internal control that policy only counts once someone tests it.
Cyber adds time pressure. In our experience, and in what security teams widely report, newly disclosed weaknesses are now probed very quickly, which compresses the time available to detect, decide and respond. A board that sees supplier and control status once a quarter is working from old information. The point is not a specific statistic but a direction: the gap between an event and the committee knowing about it needs to shrink.
Four Questions Every Audit Committee Should Ask
Drawing on the themes in EY’s update, these four questions turn connected-risk oversight into something a committee can do at its next meeting.
What Should Audit Committees Ask?
- Are risks connected? Does management assess AI, cyber, supply chain, third-party and geopolitical risk together, including second- and third-order effects?
- Are dependencies visible? Can management show the suppliers, technologies, third parties and markets the business cannot operate without?
- Are leading indicators reaching the board? Does the pack carry current signals and trends, or only last quarter’s status?
- Are responses aligned to strategy? Do contingency plans and AI investment match strategy and risk appetite?
If any answer is a hesitant “mostly” or “we will check”, that is a finding. Minute it, assign an owner and a date.
The Board Action Plan: What to Decide at the Next Meeting
Questions without decisions change nothing. A committee that wants connected risk oversight in place by year end can use these six actions as an agenda, each with an owner and a deadline. The first two can be requested at the next meeting.
Map Critical Dependencies
Ask management for a single view of the suppliers, technologies, third parties and markets the business cannot operate without, including fourth-party and concentration exposure.
Link the Risk Registers
Connect AI, cyber, third-party, supply chain and geopolitical risks so the same event is visible across them, and name one executive owner for the combined picture.
Set Triggers and Thresholds
Agree the indicators that signal deterioration, the level at which action starts, and the contingency steps for each critical dependency.
Put Leading Indicators in the Board Pack
Replace backward-looking status with a short dashboard of current signals, trends and exceptions that reaches the committee every quarter.
Run a Combined-Scenario Exercise
Test two or three risks at once, such as a supplier failure during a cyber incident, and record decisions, gaps and follow-up owners.
Align Response to Strategy and Appetite
Check that contingency plans, spending and AI investment match strategy and stated risk appetite, and minute the committee's challenge and decisions.
Boards that want evidence behind the dashboard can lean on tested controls and clean audit trails. Our guide to why AI agents need audit trails shows what good logging looks like, and the board risk from AI agents’ third-party access covers a dependency many committees have not yet mapped. The governance frameworks from COSO and the Institute of Internal Auditors remain useful anchors for how the committee documents its oversight.
Crest.Digital’s Agentic GRC and Agentic AI workflows monitor third-party dependencies and controls continuously, with human approval and a full activity record. See the industries we cover.
From Quarterly Reporting to Continuous Visibility
A board pack is a snapshot. Connected risk moves between snapshots. The practical answer is continuous monitoring of vendors, controls and dependencies, with exceptions escalated as they arise. Agentic AI can collect and correlate evidence across systems, flag concentration and drift, and track remediation, while accountable people review and decide. See our overview of end-to-end vendor risk governance and the measurable impact organisations report. Operational dependencies are covered in operational resilience and third-party risk.
Your Turn: Are Boards Still Reviewing Risks One at a Time?
- Still in silos: Each risk has its own owner, meeting and report.
- Starting to connect: We map dependencies, but indicators are still quarterly.
- Connected and monitored: One view, live indicators, tested scenarios.
The next shock will not wait for the next agenda. Which describes your board today? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
Internal audit’s relationship with third-party risk has historically been reactive — reviewing incidents after they occur rather than providing assurance that controls are operating effectively in real time. Continuous monitoring creates a new opportunity: internal audit can verify that risk ratings are recalculated when trigger events occur, that escalations are documented, and that the board is receiving accurate information about vendor exposure — all of which are more meaningful assurance activities than an annual programme review.
Frequently Asked Questions
EY’s quarterly update for audit committees says geopolitical disruption, tariff uncertainty, AI, cyber risk, market volatility and regulatory change are converging across operations, so committees should assess risks together and understand their interdependencies. It also asks committees to test resilience through triggers, thresholds and contingency actions, to look at the cost, return, accountability and control of AI as it scales, and to check that financial reporting and disclosure controls respond to the current environment. Read the full update on EY’s website for exact wording.
Connected risk is the idea that risks which used to be reviewed separately, such as AI, cyber, supply chain, third parties and geopolitics, now affect one another. A cyber incident at a supplier can interrupt operations, trigger regulatory duties and move financial results at once. If each risk is reviewed in its own meeting, the committee sees the parts but not the chain reaction. Connected-risk oversight asks for second- and third-order effects, shared indicators and one view of dependencies.
Four questions give a practical start. Are risks being assessed together rather than one at a time? Are dependencies on suppliers, technologies, third parties and critical markets visible? Are leading indicators reaching the board before problems become losses or incidents? Are management’s responses aligned to strategy and to the organisation’s stated risk appetite? If any answer is uncertain or relies on a single annual report, that is where to ask for more.
Ask management to define triggers, thresholds and contingency actions: what signals would show conditions deteriorating, at what level the organisation acts, and what it would do. Then run scenario exercises that combine events, for example a supplier outage during a cyber incident in a key market, and record what the exercise revealed. The aim is to find weak dependencies before an event does, and to show the committee has challenged management rather than accepted assurance.
Quarterly packs describe the past. Continuous monitoring of vendors, controls and dependencies gives the committee current indicators, such as changes in supplier security posture, control test failures, concentration among critical providers and open remediation items. Agentic AI can collect and correlate that evidence across systems, with human review and a log of actions, so the committee asks about trends and exceptions instead of rebuilding the picture each quarter.