This article originally appeared in our December 4th edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe 

Compliance gaps widen: Are you ready to respond?

 from Diligent Institute, in partnership with Corporate Board Member, reveals a clear trend: legal, compliance, and audit leaders continue to perceive significantly heightened risk heading entering Q4 with heightened risk perceptions - and they are mobilizing accordingly. 

Business risk now stands at 7.9 out of 10

, up from 5.8 in Q1, a 36% increase in just six months. Leaders point to the combined impact of regulatory complexity, tariff volatility, geopolitical tensions, and persistent inflation as the primary forces destabilizing today’s operating environment.

“The convergence of these factors keeps risk levels high and requires businesses to invest more in 

proactive compliance, risk management, scenario planning and governance frameworks

,” says respondent Taras Lytovchenko, Chief Legal and Compliance Officer at Trinitex.

Shifting risk landscape: From regulatory exposure to tariff and cross‑border volatility

Regulatory risk remains a top concern, but its share dropped by 10 percentage points since our Q2 2025 reporting, suggesting growing confidence in internal regulatory frameworks and monitoring capabilities. As compliance programs mature, attention is moving toward more specific operational threats: tariff changes, global volatility, and cross-border policy shifts that can outpace traditional response mechanisms.

Accordingly, legal and compliance teams report reinforcing nearly every dimension of their programs — with a strong focus on technology (including AI) for monitoring and regulatory tracking, alongside expanded training and policy reviews. One area that isn’t gaining traction: whistleblower and reporting channels, which most GCs do not expect to prioritize in 2026.

Geopolitical risk shows a clear divide in response. Nearly 27% of organizations have expanded their monitoring of cross-border trade or engaged external advisors to navigate international regulatory complexity; proactive moves that position them to adapt as conditions change.

Yet, 43% report no change in compliance priorities, even though geopolitical conflicts rank as the third-most pressing risk today. This disconnect should concern directors and executives alike. True resilience requires active reassessment of policies and controls as the environment evolves, not a wait-and-see approach.

AI integration: Widespread planning, uneven confidence

Many teams have started building AI governance guardrails, but confidence remains low. Only 29% report a comprehensive plan in place, while 38% are actively drafting guidelines and 44% say their policies need refinement. Just 11% feel very confident in their current approach. The pace of AI adoption is introducing novel risks, making transparency and trust essential in deployment and oversight.

Board action plan: 4 steps to close compliance gaps now

Double down on scenario planning for tariff and trade disruptions; ensure supply chain, pricing, and market-entry contingencies are current and tested.

Strengthen regulatory monitoring with technology-enabled workflows, and pair them with periodic policy reviews and targeted training to maintain agility.

Address the geopolitics posture gap by mandating regular reviews of regional exposure, even if current operations feel insulated.

Prioritize AI governance through clear usage policies, risk assessments, human oversight protocols, and transparent reporting. Educate the board so oversight keeps pace with adoption.

The headline is clear: Risk is rising, but so is the capacity to respond. The organizations that win in this environment will be those that turn maturing compliance programs into a forward-looking risk posture, board-level fluency on emerging technologies, and maintain consistent operational readiness.

 for more insights on emerging threats and benchmarks to guide your next move. 

Compliance gaps widen: Are you ready to respond? 

The internal audit profession stands at an inflection point. For decades, audit functions have excelled at looking backward. Examining what happened, confirming compliance and validating controls after the fact is no longer enough; as risk grows more interconnected and fast-moving, boards and executive teams are demanding more. They want internal audit to shift from the rearview mirror to the windshield, providing insights that help prevent problems before they occur.

This evolution from descriptive analytics to predictive and prescriptive insights isn't just a nice-to-have.

It's becoming essential for audit functions that want to remain relevant strategic partners to their organizations.

Most internal audit functions today find themselves somewhere along a four-stage maturity curve:

: This is where many audit teams still operate. They conduct retrospective reviews, sample transactions and report on historical compliance. While valuable, this approach limits the audit's ability to add strategic value.

: More advanced teams dig deeper to understand root causes. They don't just identify control failures. They analyze why those failures occurred and what patterns exist across the organization.

: Leading audit functions use data analytics and statistical modeling to forecast emerging risks. By analyzing trends and patterns, they can alert management to potential issues before they materialize.

Prescriptive analytics (what should we do)

: The most sophisticated audit teams go further, using advanced analytics to recommend specific actions. They don't just predict that a risk might occur. They provide data-driven guidance on how to prevent or mitigate it.

The gap between where most audit functions are today and where they need to be is significant. According to recent industry research, fewer than 30% of audit functions have moved beyond basic descriptive analytics, yet 85% of chief audit executives (CAEs) acknowledge that predictive and prescriptive capabilities are critical to their future success.

Several converging forces are making analytics maturity urgent:

: Organizations generate more data in a month than they did in a year just five years ago. Traditional sampling-based auditing simply can't keep pace. Analytics tools allow auditors to examine 100% of populations, uncovering anomalies and trends that would otherwise remain hidden.

: Emerging risks like cybersecurity threats, supply chain disruptions and ESG compliance don't fit neatly into traditional audit programs. These dynamic risks require continuous monitoring and predictive modeling, capabilities that descriptive analytics alone cannot provide.

: Audit committees increasingly expect internal audit to serve as an early warning system. When management asks, "What risks should we be worried about next quarter?" they want data-driven answers, not just historical observations.

: Most audit functions face pressure to do more with less. Analytics and automation enable teams to focus limited resources on the highest-value activities while technology handles routine testing and monitoring.

Building blocks of an analytics-driven audit function

Transforming an audit function's analytical capabilities requires intentional investment across three critical dimensions:

Analytics maturity starts with the right technology infrastructure. Leading audit functions are investing in:

Audit management platforms that integrate with source systems and enable continuous monitoring

Data visualization tools that translate complex findings into clear, actionable insights for stakeholders

Process mining software that maps actual business processes and identifies inefficiencies or control gaps

AI and machine learning capabilities that detect anomalies and predict potential issues

The key is selecting tools that integrate with each other and with the organization's broader technology ecosystem. Siloed point solutions create more work, not less.

Technology alone doesn't create an analytics-driven audit function. Organizations need people who can harness these tools effectively:

: Leading audit teams are recruiting data scientists, business analysts and technology specialists alongside traditional auditors. These multidisciplinary teams bring diverse perspectives that enhance audit quality.

: Not every auditor needs to become a data scientist, but all auditors need baseline data literacy. Forward-thinking CAEs are investing heavily in training programs that develop analytical skills across their teams.

: Some organizations are establishing dedicated analytics teams within internal audit. These specialists serve as centers of excellence, supporting fieldwork auditors with advanced analytical capabilities.

: Analytics tools evolve rapidly. The most successful audit functions foster continuous learning, encouraging experimentation and providing time for team members to stay current with emerging technologies.

Perhaps most importantly, audit functions must rethink how they work:

: Instead of rotating through audit areas on a fixed schedule, analytics-driven functions use real-time risk indicators to dynamically prioritize their work. High-risk areas get more attention; low-risk areas get continuous monitoring rather than full audits.

: Leading teams are moving away from point-in-time audits toward continuous monitoring of key controls and risk indicators. This allows them to identify issues immediately rather than months after they occur.

: Rather than producing lengthy audit reports weeks after fieldwork concludes, analytics-driven functions provide dashboards and real-time insights that stakeholders can access when needed.

: Analytics capabilities enable internal audit to partner more effectively with risk management, compliance and business intelligence teams. By sharing data and insights, these functions create a more comprehensive view of organizational risk.

The path to analytics maturity isn't without challenges. Here are the most common obstacles and how to address them:

: Many auditors feel comfortable with traditional approaches and skeptical of new technologies. Address this by starting small—pilot analytics projects in specific audit areas where the value will be immediately visible. Early wins build momentum and credibility.

: Advanced analytics capabilities require investment. Build a business case by quantifying the value analytics can deliver—time saved, risks identified earlier, enhanced insights for stakeholders. Many organizations find that analytics investments pay for themselves within the first year through increased efficiency alone.

: Analytics is only as good as the underlying data. Work closely with IT and data governance teams to address data quality issues systematically. Start with the highest-quality data sources while broader data improvement efforts continue.

: If hiring data specialists isn't feasible immediately, consider alternatives like partnering with external consultants for initial projects, leveraging internal resources from other departments or using analytics software with intuitive interfaces that don't require coding skills.

The strategic advantage of analytics maturity

Organizations that successfully build analytics-driven audit functions gain significant competitive advantages:

: Predictive analytics allows teams to flag emerging risks before they impact operations or financials, giving management time to respond proactively.

: When audit provides forward-looking insights backed by robust data analysis, their voice carries more weight in executive discussions. They become true strategic advisors rather than just compliance checkers.

: Automation of routine testing frees up time for higher-value activities. Leading audit functions report that analytics has reduced testing time by 40-60% in some areas, allowing them to expand audit coverage without increasing headcount.

: Top audit professionals want to work where they can develop cutting-edge skills. An analytics-driven operating model makes the audit function more attractive to high-potential talent.

For CAEs beginning this journey, my advice is to start strategically but act quickly:

: Honestly evaluate where your audit function sits on the analytics maturity curve. What capabilities do you have today? What gaps need to be addressed?

: Where do you want to be in two to three years? What specific capabilities would have the greatest impact on your organization's risk profile?

: Create a phased implementation plan. Quick wins in the first 6-12 months build momentum and funding for longer-term investments.

: Make the case to your audit committee and CEO for why analytics maturity matters. Frame it in terms of organizational risk and strategic value, not just audit efficiency.

: Technology is important, but your team makes the difference. Prioritize skill development and create a culture where analytical thinking is valued and rewarded.

: Track metrics that demonstrate the value of your analytics investments — time saved, issues identified earlier, insights that influenced business decisions. Share these wins broadly to build support for continued investment.

The internal audit profession's evolution toward analytics-driven operations isn't optional. It's essential for remaining relevant in an increasingly complex and fast-moving business environment. Organizations that invest now in building these capabilities will find their audit functions better positioned to provide the forward-looking insights that stakeholders increasingly demand.

The question isn't whether to make this shift, but how quickly you can get there. Organizations that move fastest will establish internal audit as an indispensable strategic partner, while those that lag risk relegation to purely compliance roles. For CAEs looking to elevate their function's impact, the time to begin building analytics maturity is now.

Building the analytics-driven internal audit function: From hindsight to foresight

This article originally appeared in our November 20th edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe

Boards in transition: Why active, data-driven governance is the 2026 imperative

Boards entered 2025 facing rising heightened risk, economic volatility, and an urgent mandate to modernize oversight. We recently hosted Diligent’s Elevate Leadership Summit, a by-invitation event where corporate directors, executives and leading experts gathered for candid, Chatham House Rule-style discussions on today’s challenges and the future of corporate governance.

Top Board Governance Trends for 2026: Active, Data‑Driven Oversight

Across sessions, a clear throughline emerged: the most effective boards are shifting from passive oversight to active, data-driven governance with disciplined processes and human judgment at the center. Here’s what our expert speakers and experienced director attendees had to say about the trends to watch in 2026:

From passive to active GRC, augmented by AI

Active GRC is replacing passive oversight as directors confront increasing risk and low confidence in near-term conditions. 

Speakers urged leaders to augment teams with AI agent

s to handle foundational tasks and “ask the next question,” freeing capacity for strategy amid resource constraints. The shift isn’t about automation for the sake of it; it’s about using technology to strengthen discipline, improve foresight and increase resiliency in governance processes.

AI governance: Measure what people actually do

The biggest AI risk isn’t only technical, it’s invisible usage

. Effective AI governance should incorporate real usage metrics

, not just periodic sentiment surveys, so boards and management can see where tools are actively embedded in work and where shadow adoption may be creating risk. Pair cultural encouragement (safe experimentation and knowledge sharing) with “lighthouse” projects that prove measurable value, building confidence while establishing standards that scale.

Culture oversight is expanding and needs better data

Board oversight of culture has outgrown legacy tools as public trust shifts towards employers and brands, and employees increasingly make choices based on societal values. Activism is rising, yet many boards still haven’t addressed company stances on social issues. Leaders discussed responsibly tapping a broader range of anonymized, unstructured data, such as employee intranet messages and chat activity, to surface actionable insights, while ensuring that individual employees aren’t singled out or penalized for raising concerns.

Board Priorities and Next Steps for 2026 and Beyond

The year ahead will reward boards that turn judgement into action: clear crisis protocols, richer data streams on people and culture, pragmatic compensation strategies, and stepwise AI adoption grounded in how employees actually use it. The common denominator is disciplined curiosity. The best directors will ask sharper questions, measure what matters and adapt faster.

If these insights resonate with your board or leadership team, start with a structured review of your speak-up mechanisms, succession playbooks, culture data sources and AI governance metrics to ensure they match today’s pace of change. Then, pick one “lighthouse” initiative to prove value within the next two quarters — and use what you learn to scale.

 to dive deeper and benchmark your board’s readiness for 2026 and beyond.

Diligent

Blog

Compliance gaps widen: Are you ready to respond?

Building the analytics-driven internal audit function: From hindsight to foresight

Your Data Matters