The audit committee evaluates everyone. It assesses the external auditor’s performance and independence every year, it evaluates the chief audit executive and approves the internal audit plan, it reviews the finance function’s talent and the compliance program’s effectiveness, and it reports to the board on all of it. Once a year it also has to evaluate itself, and at New York Stock Exchange companies the committee’s charter must say so. The review is usually a questionnaire the corporate secretary circulates, the members tick mostly-fours, and the minutes record that the committee is effective. That is a form, not a review. Done as a method, the effectiveness review answers the questions a regulator, a litigant or a new director would ask: does this committee have the skills its risks require, does it spend its time on the right things, does it know things management did not choose to tell it, and does it oversee internal audit and the external auditor or merely receive them?
This guide gives the review as a method. It covers why the review exists and who requires it, internal audit’s role as facilitator rather than judge and the conflict of assessing the committee that oversees you, the scope areas, the competency matrix, the time allocation analysis of a year’s agendas, the red flags of a committee dependent on management, the oversight of internal audit itself, when external facilitation is required or wise, a worked review at Lakeshore Bancorp, how to act on the results, and the failures that turn a review into a form. It builds on the audit committee charter and annual agenda guides, which describe what the committee should be doing, and on the corporate governance audit, which assesses the board as a whole; this guide assesses the committee.
In this guide
- Why the review exists and who requires it
- Internal audit’s role: facilitator, not judge
- The scope of an effectiveness review
- The competency matrix
- Time allocation: what a year of agendas says
- Red flags of a committee dependent on management
- Information quality and meeting dynamics
- Oversight of internal audit and the external auditor
- External facilitation
- A worked review: Lakeshore Bancorp’s FY26 audit committee evaluation
- Acting on the results
- Failures that recur
- Questions about audit committee effectiveness reviews
- Related guides
Why the review exists and who requires it
The New York Stock Exchange’s Listed Company Manual, Section 303A.07(b), requires the audit committee’s written charter to provide for an annual performance evaluation of the committee, alongside the charter’s required purposes and duties; Section 303A.09 requires the board’s corporate governance guidelines to address an annual evaluation of the board. Nasdaq’s rules require the charter and the committee’s responsibilities but not an evaluation in terms, and most Nasdaq companies do one anyway because proxy advisers and investors expect it and because the committee’s own exposure recommends it. In the United Kingdom the 2024 Corporate Governance Code’s Provision 21 calls for an annual evaluation of the board and its committees, externally facilitated at least every three years for FTSE 350 companies, and the Financial Reporting Council’s Audit Committees and the External Audit: Minimum Standard (2023) sets expectations the review can test against. Behind the listing rules sits the law: directors’ oversight duties, articulated in Delaware’s Caremark line of cases and sharpened in Marchand v. Barnhill (2019), require a board to make a good-faith effort to put a reasonable reporting system in place for mission-critical risks, and the audit committee is where much of that system lives. A committee that can show it assessed its own composition, time, information and oversight each year, and acted on what it found, has evidence of good faith that a committee with a stack of ticked questionnaires does not. The Global Internal Audit Standards add a specific thread: the board’s responsibilities in Domain III (approving the charter and plan, overseeing the chief audit executive, ensuring resources, overseeing quality under Standard 8.3 and the external assessment under 8.4) are duties the committee discharges, and the review should ask whether it discharges them. The evolving responsibilities and audit committee playbook articles describe how much the committee’s load has grown; the review is how it checks it is carrying the load.
Internal audit’s role: facilitator, not judge
Internal audit is often asked to run the review, because it has the method, the independence from management and the chief audit executive’s standing relationship with the chair. It is also the function the committee oversees, which makes rating the committee a conflict in both directions: the chief audit executive who tells the committee it is ineffective is criticizing their own boss, and the committee’s oversight of internal audit is one of the areas under review. The workable position is that internal audit facilitates and the committee judges. The function designs the instrument, gathers the evidence (agenda analysis, minutes, pre-read timing, competency data, interviews), presents it without ratings, and lets the committee reach its own conclusions in a discussion the chair leads; the function’s own view on the committee’s oversight of internal audit is given as the chief audit executive’s input, clearly labeled, not as a finding. Three safeguards make this credible: the questions about internal audit oversight are drafted from the Standards rather than from the chief audit executive’s wishes; the results go to the committee chair and, in summary, to the board or its nominating and governance committee, so the committee is answerable for acting on them; and the review is externally facilitated periodically (every three years is the common cycle) so that an independent party asks the questions the chief audit executive cannot. The independence and objectivity guide covers the safeguards framework; the governance and board relations guide the relationship this review sits inside. Where the corporate secretary or general counsel runs the review instead, internal audit’s contribution is the evidence (the agenda analysis in particular), which is where most reviews are thinnest.
The scope of an effectiveness review
| Area | Questions the review answers | Evidence beyond the questionnaire |
|---|---|---|
| Composition and independence | Do members meet the exchange’s independence and financial literacy requirements and the SEC’s audit committee financial expert disclosure? Is size right (three to five is typical)? Is tenure mixed? Is anyone overboarded? | Director questionnaires, other board seats and committee chairs, tenure data, attendance |
| Competencies | Does the committee collectively hold the skills its risk profile requires, and where are the gaps? | The competency matrix, mapped to the risk assessment |
| Charter and mandate | Is the charter current, compliant and actually followed? Does the committee do everything the charter says, and does the charter say everything the committee does? | Charter-to-agenda mapping over the year |
| Agenda and time allocation | Where did the hours go? Does the allocation match the risks and the charter? How much is management presenting versus the committee discussing? | Minutes-coded time analysis of every meeting |
| Information quality | Are papers timely, right-sized, candid and decision-oriented? Does the committee receive bad news early? | Pre-read delivery times, page counts, examples of issues and when the committee first heard of them |
| Independence from management | Does the committee know things management did not choose to tell it? Does it set its own agenda, call its own experts, hold private sessions, change management’s proposals? | The red flags in the dependency section |
| Financial reporting oversight | Does the committee engage with critical accounting estimates, judgments and the external auditor’s critical audit matters, or receive them? | Minutes; questions recorded; estimates challenged |
| External auditor oversight | Does the committee own the relationship (appointment, fees, scope, independence, evaluation, private sessions) or does the CFO? | Evaluation records; private session frequency; fee approvals |
| Internal audit oversight | Does the committee approve the charter and plan, evaluate and protect the chief audit executive, ensure resources and quality, and meet privately? (Standards, Domain III) | The chief audit executive’s labeled input; plan changes; resource decisions; private session frequency |
| Compliance, ethics and whistleblowing | Does the committee oversee the complaints procedures required by Sarbanes-Oxley Section 301 and the ethics program, or hear about them annually? | Hotline reporting to the committee; investigation escalations; the compliance program audit |
| Risk oversight allocated to the committee | Where the committee holds risk oversight (cyber, ERM, where there is no risk committee), does it have the competence and time? | Agenda analysis; competency matrix; the board risk reporting pack |
| Dynamics and culture | Does every member contribute? Does the chair run the meeting or management? Is dissent heard? Are requests followed through? | Interviews; open-request log |
| Development and succession | Is there a committee education plan and a chair succession plan? | Education records; nominating committee minutes |
| Reporting to the board | Does the board hear what the committee decided and why? | Board minutes |
The competency matrix
A competency matrix lists the skills the committee’s responsibilities and the organization’s risk profile require, rates each member’s depth in each (expert, working knowledge, awareness, none, with the member’s own rating checked against their biography and the chair’s view), and shows where the committee is deep, adequate or exposed. The required skills come from two sources: the universal ones (financial reporting and accounting, auditing, internal control, risk management, legal and regulatory, executive leadership) and the ones the organization’s risk assessment makes specific (credit and treasury for a bank, revenue recognition and cloud security for a software company, reimbursement and privacy for a health system, climate and sustainability reporting where the organization is in scope of the new disclosure regimes, technology and cyber almost everywhere, and increasingly AI governance, which the AI governance guide argues the committee will be asked about). The matrix’s value is in the gaps and in the single points of failure: a committee whose only member with banking credit expertise retires next year has a succession problem the matrix shows two years early. The matrix feeds the nominating committee’s recruitment criteria, the committee’s education plan (a gap can be closed by education and expert briefings as well as by recruitment) and the decision about which topics need outside advisers. It also answers an uncomfortable question candidly: a committee of three former chief financial officers is deep in financial reporting and may be blind to technology, and a committee that has added a cyber expert may have a member who contributes on one agenda item a year.
| Competency | Why Lakeshore’s committee needs it | Member A (chair) | Member B | Member C | Member D | Member E | Collective position |
|---|---|---|---|---|---|---|---|
| Financial reporting and accounting (bank GAAP, CECL, fair value) | Large accelerated filer; CECL allowance is the critical estimate | Expert | Expert | Working | Awareness | Awareness | Deep |
| Auditing and internal control | SOX 404 with 212 key controls; oversight of two audit functions | Expert | Working | Working | Awareness | Awareness | Adequate |
| Banking regulation and supervision | OCC-supervised lead bank; examination findings come to the committee | Working | Expert | Awareness | Awareness | None | Adequate, one expert |
| Credit risk | Loan book is the balance sheet; underwriting audit findings in FY26 | Awareness | Expert | None | Awareness | None | Single point of failure (Member B retires FY28) |
| Treasury, liquidity and interest rate risk | Risk committee holds primary oversight; audit committee oversees the models’ control environment | Awareness | Working | None | Awareness | None | Thin; relies on risk committee |
| Technology and cybersecurity | Committee holds cyber oversight; FY26 incidents reported | None | Awareness | Expert | Awareness | Awareness | One expert, otherwise thin |
| Legal, regulatory and compliance | BSA/AML, consumer compliance; Section 301 procedures | Awareness | Working | Awareness | Expert | Awareness | Adequate |
| Climate and sustainability reporting | Disclosure regimes in scope from FY27 in two jurisdictions where the bank has operations | None | None | None | Awareness | Working | Exposed |
| AI governance | 23 AI systems in use; first AI governance audit FY26 | None | None | Working | None | Awareness | Exposed |
| Executive leadership and strategy | Judging management’s candor and competence | Expert | Expert | Expert | Working | Expert | Deep |
Time allocation: what a year of agendas says
Time is the committee’s scarcest resource and the least examined. The analysis is mechanical and revealing: take every agenda and set of minutes for the year, code each item by topic (financial reporting and estimates, external auditor, internal audit, SOX, compliance and ethics, cyber and technology, enterprise risk, regulatory matters, governance and administration, education, other), by mode (management presentation, committee discussion, decision, private session) and by nature (recurring calendar item or emerging matter), estimate the minutes from the timed agenda or the minutes’ sequence, and total it. Then compare the result to three references: the charter (does every charter duty get time?), the risk assessment (do the rated risks get time in proportion?) and the committee’s own stated intent (the chair’s view of where time should go). The findings are usually the same shape across organizations. Financial reporting and the external auditor take the largest share, as they should, but recurring compliance presentations consume more than their risk warrants because they are on the calendar, emerging risks get a slot only when something has happened, management presents for most of the meeting and the committee discusses for the remainder, and private sessions are short and sometimes skipped when the agenda runs long. The analysis also measures what the committee asked for: the number of information requests made to management in the year and how many were answered on time, which is the simplest indicator of a committee that directs rather than receives. The annual agenda guide gives the calendar the analysis is compared with; the presenting to the audit committee guide explains why the management-presentation share runs high and how presenters can cut it.
| Coding dimension | Categories | What the comparison shows |
|---|---|---|
| Topic | Financial reporting and estimates; external auditor; SOX and internal control; internal audit; compliance, ethics and whistleblowing; cyber and technology; enterprise and emerging risk; regulatory matters; governance and administration; education; other | Share of hours by topic against the charter’s duties, the risk assessment’s ratings and the chair’s stated intent |
| Mode | Management presentation; committee discussion; decision; private session; education | Whether the committee directs or receives: a presentation share above two thirds and a private-session share below a tenth are the usual warning readings |
| Nature | Recurring calendar item; emerging matter raised by management; matter raised by the committee; matter raised by internal audit, the external auditor or a regulator | Whether the agenda responds to risk or to the calendar, and who brings new matters |
| Follow-through | Information requests made; answered by the next meeting; answered late; still open | The simplest measure of a committee that directs |
| Timeliness of bad news | For each significant matter in the year: date management knew, date the committee heard, channel | Whether the escalation protocol works |
Red flags of a committee dependent on management
| Red flag | What it looks like | What an independent committee does instead |
|---|---|---|
| Management sets the agenda | The CFO or general counsel drafts the agenda; the chair approves it the week before | The chair builds the agenda from the annual plan with the corporate secretary, consulting the CFO, chief audit executive and external auditor |
| All information comes through one channel | Every paper is prepared or reviewed by the CFO’s office; the committee has never commissioned its own analysis | The committee receives directly from internal audit, the external auditor, compliance and risk, and uses its authority to engage advisers (Rule 10A-3 gives it the funding) |
| Private sessions are rare or short | Executive sessions with the external auditor and chief audit executive happen once or twice a year, for ten minutes, when the agenda allows | Private sessions with the external auditor, the chief audit executive and management separately at every regular meeting, as the exchange rules contemplate |
| Bad news arrives late and from outside | The committee learns of a control failure from the external auditor, a regulator or the press rather than from management first | An agreed escalation protocol (what the committee hears within 24 hours, within a week, at the next meeting) that management follows and the committee tests |
| Pre-reads arrive late and long | Three hundred pages delivered 36 hours before the meeting | A standard (seven days, one-page summaries, decisions flagged) that the chair enforces |
| The committee never changes anything | Every management proposal (plan, fees, auditor, policy) is approved as submitted; no request has altered a management decision in two years | A record of plan changes, scope additions, requests for more work and rejected proposals |
| Questions are not followed through | A request made in March is not on the agenda again until the next March, if then | An open-request log reviewed at every meeting |
| The CFO manages the auditors’ relationships | External auditor evaluation, fee negotiation and internal audit’s budget are handled by finance and ratified | The committee owns the external auditor relationship and the chief audit executive’s appointment, evaluation, compensation and resources |
| The chief audit executive reports functionally to management in practice | Internal audit’s plan is changed by the CFO; the chief audit executive’s compensation is set by the CFO without committee input | Functional reporting to the committee as the Standards and the charter require, with the committee approving the plan and evaluating the chief audit executive |
| Education is management-delivered | The committee’s technical updates are given by the CFO and the external auditor only | Independent education: regulators, outside counsel, industry experts, peer committees |
Information quality and meeting dynamics
Two things the questionnaire cannot measure well are the quality of what the committee reads and how the meeting runs, and both need interviews. On information: the review samples papers from the year against a simple standard (purpose stated, decision or discussion flagged, one-page summary, the bad news on the first page, trend data rather than point-in-time, consistent format meeting to meeting) and asks members which papers they read fully, which they skim and which they do not understand. Papers that are consistently skimmed are either too long or not relevant; papers not understood are a competency or a presentation problem. On dynamics: structured interviews with each member, the chair, the CFO, the general counsel, the chief audit executive and the external audit partner, under a confidentiality promise, asking the same questions (does every member contribute? does the chair draw out the quiet members and stop the dominant ones? is disagreement with management voiced? what did the committee get wrong this year? what does it not discuss that it should?). The interviews with the chief audit executive and the audit partner are the most important, because they sit in the room, are independent of management and will say what members will not say about each other. Patterns across interviews are reported; individual attributions are not. The presenting guide describes the meeting from the presenter’s side; the first meeting as chief audit executive guide describes what a new chief audit executive learns about the committee in the first hour, which the review should confirm or correct.
Oversight of internal audit and the external auditor
The committee’s oversight of the two audit functions is where the review tests whether it governs or receives. For internal audit, the Standards’ Domain III gives the test list: the committee approved the charter and reviews it periodically; it approved the plan and the budget and was told of significant changes and their effect on coverage; it appointed, evaluates and sets the compensation of the chief audit executive and would decide on removal; it ensured the function’s independence and dealt with impairments; it received the function’s conformance assessment and the external quality assessment results and acted on them (Standards 8.3 and 8.4, with the self-assessment and external assessment guides describing what it should have received); it set and reviewed the function’s performance measures (the KPIs guide gives candidates); and it met the chief audit executive privately at every meeting. The chief audit executive’s input on these questions is labeled as such, and the chair’s and members’ views are gathered separately. For the external auditor, the equivalent list: the committee appointed and would replace the auditor; approved fees and the audit plan and understood the scope; pre-approved non-audit services; assessed independence including the firm’s relationships and the hiring of former engagement staff; evaluated the auditor’s performance with input from management and internal audit; met the partner privately; and engaged with critical audit matters and the auditor’s view of management’s estimates rather than receiving a summary. The hiring a chief audit executive guide describes the committee’s most consequential internal audit decision and the first 90 days as chief audit executive guide what the committee should expect in return.
External facilitation
An externally facilitated review brings three things an internal one cannot: an interviewer the members and management will speak to candidly, benchmarks from peer committees (how much time comparable committees spend, how their charters allocate risk oversight, how often they meet privately), and the ability to say that the committee’s oversight of internal audit is weak without the chief audit executive saying it. The UK Code requires external facilitation at board level every three years for FTSE 350 companies; in the United States it is practice rather than rule, and the common cycle is every three years with internal reviews between, brought forward after a significant event (a restatement, a material weakness, an enforcement action, a cyber incident the committee learned about late), a change of chair or a substantial change in composition. Choosing the facilitator matters: a governance consultant or law firm with audit committee experience and no other relationship with management, selected and engaged by the committee chair with the corporate secretary, reporting to the chair. The facilitator should want the internal evidence (the agenda analysis, the competency matrix, the request log) rather than starting from a generic questionnaire, which is where internal audit’s work feeds in even when the review is external. The UK audit committee and UK Code articles describe the regime where external facilitation has been standard longest.
A worked review: Lakeshore Bancorp’s FY26 audit committee evaluation
Lakeshore Bancorp is the $9 billion publicly traded regional bank holding company used in the banking examples on this site, a large accelerated filer with an OCC-supervised lead bank, a board risk committee that holds primary risk oversight, a 22-person internal audit function and a five-member audit committee that met nine times in FY26 for a total of about 31 hours. The committee’s charter provides for an annual evaluation; the FY24 review was externally facilitated, the FY25 review was a questionnaire administered by the corporate secretary, and for FY26 the chair asked the chief audit executive to facilitate a fuller review on the understanding that the function would present evidence and the committee would judge. The function spent 110 hours: a 42-question instrument completed by the five members; eleven interviews (members, chair, CFO, general counsel, chief risk officer, external audit partner and the chief audit executive’s own labeled input); the competency matrix above; the time analysis of all nine meetings; a sample of 20 committee papers against the information standard; and a reconciliation of the charter to the agendas.
| Area | What the evidence showed | What the committee decided |
|---|---|---|
| Time allocation (31 hours) | Financial reporting and estimates 29 percent; external auditor 14 percent; SOX 9 percent; internal audit 11 percent; compliance and BSA/AML 15 percent (three recurring presentations); cyber 6 percent (two items, both after incidents); regulatory matters 7 percent; governance and administration 9 percent. Management presentation 68 percent of meeting time; committee discussion and decision 24 percent; private sessions 8 percent (chief audit executive at every meeting, external auditor at four of nine, management at two) | Cut recurring compliance presentations to two with a written update in between; add a standing cyber slot with the chief information security officer; set a target of at least 35 percent discussion; private session with the external auditor at every regular meeting |
| Competencies | Deep in financial reporting and leadership; credit expertise rests on one member retiring in FY28; climate reporting and AI governance exposed; cyber rests on one member | Recruitment criteria to the nominating committee: credit or banking background with technology awareness for the FY28 seat; two education sessions on climate disclosure and AI governance from outside experts in FY27 |
| Information quality | Pre-reads averaged 214 pages delivered 4.1 days before meetings against a seven-day standard in the charter; 6 of 20 sampled papers had no stated purpose or decision; members reported skimming the compliance papers and not fully understanding two model risk papers | Seven-day standard enforced by the chair through the corporate secretary; one-page summary template mandatory; model risk papers rewritten with the chief risk officer |
| Independence from management | Agenda drafted by the CFO’s office and approved by the chair; 14 information requests in the year, 9 answered by the next meeting; two instances where the committee learned of matters late (an OCC matter requiring attention communicated three weeks after receipt; a vendor incident learned from the external auditor); the committee had changed the internal audit plan twice and rejected one non-audit service | Chair to own the agenda with the corporate secretary; escalation protocol adopted (regulatory correspondence to the chair within two business days); open-request log at every meeting |
| Oversight of internal audit | Charter and plan approved; chief audit executive evaluated by the chair with CEO input; compensation reviewed; private sessions at every meeting; conformance assessment received; the FY25 external assessment’s two recommendations tracked. Chief audit executive’s labeled input: the committee engages with findings but rarely asks about the plan’s coverage gaps or the function’s resourcing against the universe | Annual coverage discussion added to the plan approval meeting; resource benchmarking requested |
| Oversight of the external auditor | Evaluation performed with management input only; partner private sessions at four meetings; critical audit matters discussed for 20 minutes in the year | Internal audit’s input added to the evaluation; CAM discussion scheduled before year-end rather than after; private session every meeting |
| Dynamics | Interviews: two members contribute on most items, one on financial reporting only, two rarely; the chair runs the meeting well but lets presentations run; dissent with management is voiced by the chair and one member; the external audit partner described the committee as “engaged on the numbers, light on everything else” | Chair to invite each member on each major item; agenda timings enforced; the partner’s observation reported verbatim to the committee at its request |
The committee’s conclusion, recorded in its own words, was that it was effective in financial reporting oversight and had allowed its time and information to be shaped by management in other areas; it adopted a nine-point action plan with the chair as owner, reported the review and the plan to the board, described the process in the proxy statement, and scheduled the FY27 review as externally facilitated with the function’s evidence pack supplied to the facilitator. The chief audit executive’s position after the review was stronger, because a committee that has decided to direct rather than receive asks more of internal audit, and the function’s FY27 plan approval included the first coverage-gap discussion the committee had held. The quarterly pack guide describes the reporting changes that followed.
Acting on the results
A review that produces a discussion and no decisions was a form with extra steps. The outputs should be specific: an action plan with owners (the chair for agenda and dynamics, the corporate secretary for information standards, the nominating committee for composition, the chief audit executive and CFO for the papers they produce) and dates; charter amendments where the charter and the practice diverged; recruitment criteria where the matrix showed gaps that education cannot close; an education plan for the gaps it can; changes to the annual agenda calendar; and a report to the board summarizing the process, the conclusions and the plan, which also supports the proxy statement’s description of the evaluation process. The next year’s review starts by testing whether the plan was done, which is how the review becomes a cycle rather than an event. Internal audit’s own follow-through is to adjust what it brings the committee in response: the quarterly pack if information quality was the problem, the plan presentation if coverage was never discussed, the presentation template if the committee asked for less presenting and more discussion.
Failures that recur
The questionnaire as the review: fifteen minutes of mostly-fours, no evidence, no interviews, a minute that says effective. Rating without evidence: members rating their time allocation as appropriate when nobody has measured it. The chief audit executive as judge: ratings of the committee from the function it oversees, which neither side can take at face value. Management facilitating: a review run by the CFO’s office that finds the committee well served by management. No external cycle: ten consecutive internal reviews. Composition never addressed: the matrix shows a gap for three years and the nominating committee never hears of it. Results that stay in the committee: no report to the board, no proxy description, no action plan. Actions without owners: a list of good intentions revisited the following year with nothing done. And confusing activity with effectiveness: a committee that met twelve times, read 2,000 pages and approved everything may be the least effective committee in the sector, and only the time analysis, the request log and the interviews would show it. The corporate governance audit guide describes the same failure pattern at board level; the committee review is where a board that wants to avoid it can start.
Questions about audit committee effectiveness reviews
Is an annual audit committee evaluation required?
At New York Stock Exchange companies, yes: Section 303A.07(b) requires the committee’s charter to provide for an annual performance evaluation of the committee. Nasdaq’s rules do not require it in terms, though most companies do one. The UK Corporate Governance Code calls for annual board and committee evaluation, externally facilitated at least every three years for FTSE 350 companies.
Should internal audit run the review?
Internal audit can facilitate it, gathering the evidence and designing the instrument, while the committee judges itself; the chief audit executive’s view on the committee’s oversight of internal audit is given as labeled input, not as a finding. Periodic external facilitation, commonly every three years, provides the independent view the function cannot.
What should the review cover?
Composition and independence, competencies against the risk profile, the charter and whether it is followed, time allocation across a year of meetings, information quality, independence from management, oversight of financial reporting, the external auditor, internal audit, compliance and whistleblowing and any risk oversight the committee holds, meeting dynamics, education and succession, and reporting to the board.
What is a competency matrix for an audit committee?
A grid of the skills the committee’s duties and the organization’s risks require (financial reporting, auditing, industry, regulation, technology and cyber, legal, sustainability reporting, AI governance, leadership) against each member’s depth, showing where the committee is deep, adequate or exposed and where a single member’s departure would leave a gap. It drives recruitment criteria and the education plan.
What are the signs of a committee dependent on management?
Management drafts the agenda; all information comes through the CFO’s office; private sessions are rare or short; bad news arrives late or from outside; pre-reads are late and long; no management proposal is ever changed; requests are not followed through; the CFO manages the auditors’ relationships; and education is delivered only by management and the external auditor.
How often should the review be externally facilitated?
Every three years is the common cycle, and sooner after a significant event such as a restatement, a material weakness, an enforcement action or a late-discovered incident, a change of chair or a substantial change in membership. The internal evidence pack (time analysis, competency matrix, request log) should be supplied to the external facilitator.
Related guides
- The audit committee charter — the duties the review tests against.
- The audit committee annual agenda — the calendar the time analysis is compared with.
- How to audit corporate governance — the board-level assessment.
- Internal audit’s role in corporate governance and board relations — the relationship the review sits inside.
- The audit committee playbook and the evolving responsibilities of audit committees — how the load has grown.
- Presenting to the audit committee — why management’s share of the meeting runs high.
- Audit committee presentation template — less presenting, more discussion.
- Reporting to the audit committee: the quarterly pack — the information internal audit supplies.
- Your first audit committee meeting as chief audit executive — what a newcomer learns in an hour.
- Hiring a high-performance chief audit executive — the committee’s most consequential internal audit decision.
- The first 90 days as chief audit executive — what the committee should expect in return.
- The internal audit charter — functional reporting to the committee.
- Independence and objectivity — the safeguards for facilitating a review of your overseer.
- Internal audit self-assessment and preparing for an external quality assessment — what the committee should receive under Standards 8.3 and 8.4.
- Internal audit KPIs and metrics — the committee’s measures of the function.
- Auditing the ethics and compliance program — the committee’s whistleblowing oversight.
- Board risk reporting — risk oversight the committee may hold.
- Auditing AI governance — the competency the committee will be asked about.
- What UK audit committees expect from internal audit and the 2024 UK Corporate Governance Code changes — the regime where external facilitation is standard.
- Internal audit after the IPO — a new committee’s first evaluation.
Leave a Reply