100,000 Records in 20 Seconds: Gartner Pushes Risk Teams to Rethink Their Reports

“High risk” can be an expensive phrase if left unexplained. It tells an executive to be concerned, while much of the spending decision remains unresolved: how much the company could lose, whether existing controls are working and how long management can afford to wait.

Gartner’s latest recommendations address this weakness in risk reporting. Speaking at its Enterprise Risk, Audit & Compliance Conference in London on 29 September, director analyst Elliott Long called for reporting that gives management a better basis for acting, through more timely information, financial estimates and deeper use of AI (Gartner, 2026). “Risk reporting is often too repetitive, too slow or too subjective to help decision making,” he said.

The strongest example in his presentation concerned an organization that used AI to analyze 100,000 records in 20 seconds, producing insights into fraud events and the effectiveness of controls. Gartner provided no detail on whether those findings subsequently reduced losses, so the speed should not be mistaken for evidence of a successful intervention.

What makes the example interesting is the opportunity to examine whether controls are doing the job management believes they are doing. A company may have an approval process, a monitoring system and an escalation procedure, yet still experience recurring fraud. Analyzing the incidents together could help establish where those arrangements are failing, giving management a more useful starting point than another summary of losses. “Risk reporting is often too repetitive, too slow or too subjective to help decision making,” Long said.

Some of that slowness comes from the reporting timetable itself. Quarterly reviews give boards a regular opportunity to scrutinize exposure, yet a business may have to make several consequential decisions before the next meeting. Gartner recommends connecting risk indicators to operational performance and defining events that require a response in advance.

A supplier’s missed deliveries may be manageable until stock runs low or a major customer’s order comes due. Procurement might already be tracking the delays, but management needs to know when they will begin affecting commitments elsewhere in the business. Connecting those figures would help establish whether buying from a more expensive supplier is justified, and how soon a decision is needed. Putting a financial value on the exposure gives that discussion something firmer to work with. The additional cost of alternative supplies can be weighed against the potential cost of interrupted production or unfulfilled orders. Management may decide to accept the risk, but it should understand what it is accepting.

The estimate need not pretend to greater certainty than the evidence allows. Much of its value comes from showing what would change the decision. A short delay might be affordable; several weeks of disruption could justify immediate spending. Examining that range allows colleagues to challenge the assumptions and identify where better information would matter.

Gartner recommends beginning with one risk or business decision for which reliable information is available. This gives teams a manageable opportunity to test whether quantification improves the discussion before extending it to other exposures.

Long’s advice leaves room for a modest first step. A team might bring an existing warning to management sooner, investigate a recurring control failure with AI or attach a financial estimate to an investment proposal. Following that work through to the decision would reveal where reporting is falling short. If the analysis arrives in time but nobody has authority to approve a response, producing it faster will achieve little until that responsibility is settled.