KPMG highlights audit committee priorities for 2026, from AI to cyber risk

The U.S. version of KPMG’s 2026 audit committee agenda, published by KPMG Board Leadership Center on Dec. 5, 2025, shows which issues audit committees need to prioritize to maintain investor confidence. Reporting, risk, and technology now land in the same meeting.

Boards are being pulled into a broader remit

Across KPMG’s regional editions, audit committees are taking on an expanded remit shaped by uncertainty, regulatory change, and technological disruption. The UK edition puts hard numbers behind that pressure: 82% of surveyed board members point to corporate reporting obligations as one of the challenges that has grown most for boards and directors, and 81% say the current regulatory landscape makes the board member experience increasingly challenging.

Audit committees are not just reviewing financial statements after the fact anymore. They are expected to understand how cyber threats, AI use, data governance, internal controls, and finance function effectiveness can affect reporting outcomes before issues become visible to investors or regulators.

What rises to the top in 2026

Across markets, the priorities are familiar but more intertwined: financial reporting, SEC developments, internal controls, audit quality, oversight of AI, cyber risk, data governance, finance organization effectiveness, and the composition of the committee itself. Some regional editions frame the agenda around seven key issues, while others identify eight, which underscores that local regulatory pressures still shape the final board checklist.

The list matters less than how it is being used. Board questions will increasingly connect technology to controls, controls to reporting, and reporting to investor confidence. Advisors can add value early, especially when a client has not yet translated a technology change into an audit committee discussion.

The client-preparedness checklist KPMG teams should use now

The agenda is operational: it tells engagement teams what to raise before the board does. If a client is rolling out new AI tools, the first question is not whether the model works, but how management is documenting oversight, validating outputs, and defining escalation when results affect reporting or controls. If a company is exposed to cyber risk, the conversation should move quickly to disclosure readiness, control implications, and who on the management side owns the response.

A practical checklist for auditors and advisors looks like this:

• Ask where AI, automation, and data tools touch financial reporting or internal controls.
• Test whether cyber incidents, business interruption, and third-party dependencies are already reflected in control design and committee reporting.
• Push management to explain any gaps between finance transformation plans and the committee’s current oversight structure.
• Review whether the audit committee has the right mix of skills and enough time on agenda for emerging issues, not just recurring reporting items.
• Surface regulatory developments early, especially where SEC changes or local reporting rules could affect disclosures, controls, or timetable pressure.

Regional editions show where board pressure is heaviest

The Middle East edition tells audit committees to continue focusing on the effects of economic and geopolitical volatility on financial reporting and related internal control risks. Macro shocks are still board-level issues when they affect valuation, forecasts, liquidity judgments, or the reliability of controls across geographies.

In India, an audit committee can expect the company’s financial reporting, compliance, risk, and internal control environment to be put to the test in 2026. The point is a more integrated oversight model, one where compliance and control design are no longer separate from finance transformation or risk discussions.

A related KPMG Board Leadership Center quarterly note for Q1 2026 lists economic uncertainty, including recession, inflation, and interest rates, plus business model disruption and competition, as major board concerns in 2026. Board packets increasingly need to explain not just what happened, but how management is prepared for what could happen next.

What it means for audit quality and career growth

For auditors on public-company clients, the agenda is also a guide to board expectations. Audit committees are key decision-makers in selecting and evaluating auditors, so knowing their priorities helps engagement teams anticipate where they will press for detail, challenge assumptions, or ask for a clearer line of sight on risk. The teams that do this well tend to look more proactive, which matters in a profession where trust and judgment influence the partner track.

Controls modernization, risk management, and AI governance all sit close to the agenda topics, and the firms that can speak fluently across those areas are better positioned to move from narrow technical support to broader board-level counsel. For managers and senior associates, that means the agenda is not just a governance document; it is a clue to which skills are becoming more valuable in client service.