Board Audit Committee

A board audit committee is a standing committee of a company's board of directors responsible for overseeing the integrity of financial reporting, the system of internal control, the internal audit function and the appointment and work of the external auditor. It is made up of non-executive directors, and in most listed companies all of its members must be independent of management.

The committee exists because the full board cannot examine accounting and control matters in sufficient depth, and because the people who prepare the accounts should not also control the relationship with those who audit them. It does not prepare financial statements or conduct audits itself. Its role is oversight on behalf of the board and, ultimately, the shareholders. In banks and insurers it works alongside the board risk committee.

Law and governance codes set minimum standards. In the United States, the Sarbanes-Oxley Act of 2002 requires every member of a listed company's audit committee to be independent, meaning that the member accepts no consulting or advisory fees from the company and is not an affiliate of it. Companies must also disclose whether the committee includes at least one financial expert. The UK Corporate Governance Code calls for at least three independent non-executive directors, or two in smaller companies, with at least one member having recent and relevant financial experience. European Union audit legislation requires public-interest entities, which include listed companies, banks and insurers, to have an audit committee with a majority of independent members.

The chair of the board is generally not expected to chair the committee. Members need enough financial literacy to challenge management and auditors, and the committee as a whole should understand the sector in which the company operates.

The committee's terms of reference normally cover the following areas:

• Financial reporting. It reviews the annual and interim financial statements before the board approves them, focusing on significant accounting policies, estimates and judgements, unusual transactions and the going concern assumption.
• External audit. It recommends the appointment, reappointment or removal of the independent auditor, approves fees and terms, assesses independence and reviews audit findings.
• Internal control. It reviews the effectiveness of controls over financial reporting and, where there is no separate risk committee, wider risk management.
• Internal audit. It approves the internal audit plan, receives reports, monitors management's response and safeguards the function's independence.
• Whistleblowing and compliance. It oversees the whistleblowing framework for concerns about accounting or audit matters and may receive reports on fraud and regulatory breaches.

A defining feature is that the external auditor reports to the committee, not to management. Under Sarbanes-Oxley the audit committee is directly responsible for appointing, paying and overseeing the auditor. The committee meets the auditor without executives present, discusses the audit plan and the level of materiality, and reviews the auditor's report together with any disagreements with management.

To protect independence, the committee sets policy on non-audit services, approves them in advance and monitors the ratio of non-audit to audit fees. In the European Union, public-interest entities must rotate audit firms after a maximum period and must run a tender overseen by the committee. The head of internal audit usually has a direct reporting line to the committee chair, with access that does not depend on the chief financial officer or other executives.

Committees typically meet four or more times a year, timed around the reporting calendar. A cycle includes reviewing the audit plan, examining half-year and full-year results, considering control reports and assessing the auditor's performance. The chair reports to the board after each meeting, and the committee publishes an annual report to shareholders describing the significant issues it considered and how it addressed them.

Within the three lines model of governance, the committee is the main board-level recipient of assurance from the third line, internal audit, and from external audit. It relies on management for information, which is why private sessions with auditors and direct access to staff are treated as essential.

Banking regulators add expectations of their own. The Basel Committee's corporate governance principles call for an audit committee in systemically important banks, distinct from the risk committee, with a chair who is independent and does not chair the board or another committee. Bank audit committees spend much of their time on judgemental areas such as loan loss provisions, the valuation of financial instruments and the adequacy of regulatory reporting controls. They also review findings from supervisors and track remediation.

An audit committee can only be as effective as the information it receives and the willingness of its members to challenge. Corporate failures in which accounts later proved misleading have repeatedly involved committees that met their formal obligations but did not probe aggressive accounting. Members serve part-time and depend on management and auditors for analysis. The remit has also grown steadily, taking in cyber security, sustainability reporting and conduct in many companies, which risks crowding out the core task of scrutinising the audited financial statements. Reviews of audit quality in several countries have recommended clearer standards for committees and closer regulatory oversight of how they select and supervise auditors.

• Financial Reporting Council
• U.S. Securities and Exchange Commission