The audit committee decides in about an hour whether its new chief audit executive is a leader it can rely on or a reader of reports, and the first meeting is where that decision begins. Most new chief audit executives prepare for it as a performance: a polished deck, a confident biography, a plan with ambitious verbs. The committee is not looking for a performance. It wants to know whether this person has understood what they inherited, will tell the committee the truth about it, has a credible way of working, and will come back with facts. The first meeting that achieves those four things can be plain and short; the one that fails them can be dazzling and set the relationship back a year.
This guide treats the first meeting as a project. It covers what the meeting is for, the one-on-ones to hold before it and what to listen for, how to read the function you inherited and turn it into facts the committee has not heard, a content arc for thirty to forty-five minutes, how to be candid about inherited problems without blaming a predecessor or overpromising, the working rituals to propose and why the first meeting is the moment to propose them, the first private session, the follow-up notes that make the meeting stick, variants for an IPO committee, an internal promotion, a predecessor who left under a cloud and a small company, a worked first meeting at Fernhill Communications, and the mistakes that take a year to undo. It is the committee-facing chapter of the first 90 days as chief audit executive guide, and it assumes the reader has the job; the becoming a chief audit executive and chief audit executive interview guides cover getting it.
In this guide
- What the first meeting is for
- The one-on-ones before the meeting
- Reading the inheritance
- The content arc
- Candor on inherited problems
- The rituals to propose
- The first private session
- The follow-up notes
- Variants: IPO, internal promotion, a cloud, a small company
- A worked first meeting: Fernhill Communications
- Mistakes that take a year to undo
- Questions about the first audit committee meeting
- Related guides
What the first meeting is for
Three outcomes, and nothing else. The committee leaves understanding what the new chief audit executive has found so far, stated as facts with sources rather than impressions, and how the rest of the assessment will proceed. The committee and the chief audit executive have agreed, or at least begun to agree, how they will work together: the cadence of contact with the chair, the private session, the pack, the plan process, the escalation protocol. And the private relationship with the chair has started, in the one-on-ones before the meeting and in the first private session after it. Everything the new chief audit executive is tempted to add (a vision statement, a reorganization, a new methodology, an opinion about management) either serves one of the three or waits. The committee’s members have seen new executives arrive with visions; what they have seen less often is a new executive who tells them, in the first hour, two things about their own organization they did not know, and then tells them when they will hear the rest. The hiring a chief audit executive guide describes what the committee thought it was buying; the first meeting is where it finds out.
The one-on-ones before the meeting
The meeting is won or lost before it starts, in conversations of forty-five minutes each held in the first weeks. Their order matters: the chair first, because the chair’s expectations shape everything else and because the chair should never hear anything in the meeting they did not hear privately first; then each committee member; then the chief executive, the chief financial officer and the general counsel; then the external audit partner; then the predecessor, if available and willing; and throughout, the function’s own managers and a sample of staff. Each conversation has the same shape: what the person expects of internal audit, what has worked and what has not, what they would change, what they are worried about that nobody is looking at, and what they would want the new chief audit executive to say or not say at the first meeting. The listening is for differences: what the chair thinks the function is for against what the chief financial officer thinks; what members say about the predecessor against what the staff say; what the external auditor says about reliance against what the managers say about the relationship. The differences are the first meeting’s content, and they are also the first map of the politics the chief audit executive has walked into.
| Conversation | What to ask | What to listen for |
|---|---|---|
| Committee chair | What do you want from the function and from me? What did the committee get from my predecessor that it valued, and what did it not get? What would you like the first meeting to cover? How do you want to be contacted between meetings, and about what? How is the chief audit executive evaluated and paid here? | Whether the chair sees the function as theirs or management’s; the chair’s own appetite for bad news; how the chair handles the chief financial officer |
| Each committee member | What keeps you awake about this organization? What do you wish internal audit had told you earlier? What do you read in the pack and what do you skip? What should I know about how this committee works? | Competency and engagement differences between members; which member the chair defers to; whether members know what the function does |
| Chief executive | What do you want from internal audit? Where has it helped and where has it been a cost? What are you worried about? How do you want to hear bad news from me? | Whether the chief executive sees the committee relationship as legitimate or as going around them; candor about problems |
| Chief financial officer | How has the relationship worked administratively? Where does internal audit’s plan intersect with SOX and the external audit? What are the open issues you own and what is realistic? | Whether the chief financial officer has been setting the function’s agenda; the state of SOX; appetite for remediation |
| General counsel | What investigations, regulatory matters and litigation touch internal audit? How have fraud matters been handled between us? What should I know about privilege? | Matters the committee has heard and not heard; the quality of the investigation protocol |
| External audit partner | How has reliance worked? What is your view of the function’s quality? What do you see in the control environment? What does the committee ask you privately? | The most independent view available of the function and of management’s candor |
| Predecessor | What is unfinished? What did you not get to tell the committee? Who is strong on the team? What did you fight about and lose? | The problems that were known and not escalated; the function’s history with the chair |
| Managers and staff | What works? What would you change tomorrow? What do you think the committee believes about us that is not true? Where are we behind? | The plan’s real status; morale; who is carrying the function; what the pack has been hiding |
Reading the inheritance
While the conversations run, the documents are read, and the point of the reading is to turn the inheritance into facts the committee can act on. The charter: when it was last approved, whether it reflects the Global Internal Audit Standards and the function’s actual mandate, and whether the committee has the duties the Standards’ Domain III gives it (the charter and audit committee charter guides give the checklists). The plan: approved against delivered for the current and prior two years, deferrals and what happened to them, the risk assessment the plan rests on and when it was last refreshed, and coverage of the high-risk universe over the cycle. The issues: the open population by rating and age, the overdue list, the extensions, the risk acceptances, the validation backlog, and the oldest five issues as stories (the issue tracking guide covers the system). The quality program: the last external assessment’s date and findings, the internal assessment’s status, and whether the function is within the Standards’ five-year cycle (the external assessment and self-assessment guides). The people: headcount against plan, vacancies and their age, certifications, turnover, the budget against peers, and co-source use. The committee’s own record: three years of packs and minutes, which show what the committee was told and how; the committee’s most recent effectiveness review, if one exists; and regulatory examination findings about internal audit, which at a bank or insurer are the committee’s most sensitive inheritance. Finally the circumstances of the predecessor’s departure, which the committee knows and the staff suspect, and which shape what the committee needs to hear.
| Document | What to look for | What it becomes at the meeting |
|---|---|---|
| Charter and committee charter | Approval date; Standards alignment; functional reporting; the committee’s Domain III duties | A fact about governance currency and, usually, a proposed charter refresh for a later meeting |
| Plans, three years | Planned versus delivered; deferrals that vanished; risk assessment currency; high-risk coverage | The planning realism fact and the coverage fact |
| Issue population | Aging, extensions, acceptances, validation backlog, oldest five | The remediation health fact and two or three issues named |
| Quality program | External assessment date and findings; internal assessment status | A conformance fact, often uncomfortable |
| Staffing and budget | Vacancies and age; turnover; certifications; co-source; benchmarks | The capability fact and the first resource conversation |
| Packs and minutes, three years | What the committee was told; what it asked; what it never heard | The information-quality fact and the pack redesign proposal |
| Regulatory findings on internal audit | Matters requiring attention, their status and the committee’s role | The most important fact, if it exists |
| The predecessor’s exit | Why, and what the committee concluded | Shapes the candor section; never discussed in the open meeting |
The content arc
Thirty to forty-five minutes in the open meeting, plus the private session, is the usual allocation, and the arc below fits it. The written pre-read is short (five to eight pages: the facts, the 90-day plan, the proposed working arrangements, the asks) and follows the structure the quarterly pack guide recommends, so that the committee sees the pack’s future shape in the first document it receives. The presenting to the audit committee guide’s rules apply in full, and more so: no reading of slides, no biography beyond two minutes, bad news first within each segment, and a stated request at the end.
| Segment | Minutes | Content | Pitfalls |
|---|---|---|---|
| 1. Who I am and how I work | 2 | Two sentences of background relevant to this organization; one sentence on how you work (facts, early bad news, no surprises for management or the committee) | The career tour; the vision statement |
| 2. What I have done so far | 3 | The conversations held (count and roles), the documents read, the engagements observed; what remains | Implying the assessment is finished |
| 3. What I have found: facts | 10 | Five to eight facts with sources: plan realism, coverage, remediation health, quality program status, staffing, information quality, any regulatory matter. Numbers with context; no adjectives | Judgments dressed as facts; too many facts; facts the chair has not heard |
| 4. What concerns me | 8 | The two or three inherited problems that matter, stated with the evidence, what you know and what you do not yet, what management has already said, and what you will do by when | Blaming the predecessor; overpromising; a list of ten |
| 5. The next 90 days | 5 | What the committee will receive at the next meeting and the one after: the assessment’s completion, the plan review, the charter refresh, the pack redesign, the staffing proposal | A reorganization announced before the assessment is complete |
| 6. How I propose we work together | 5 | The rituals (below), proposed for the chair’s and committee’s reaction, not announced | Dictating to the committee; skipping this because it feels presumptuous |
| 7. What I need from you | 2 | Specific asks: a decision on a deferral, support on a resource request, time at the next meeting, a date for the chair’s monthly call | Asking for nothing |
| 8. Questions | Remainder | Answers in facts; “I don’t know yet, and I will by” for what you do not know | Speculating to fill silence |
| 9. Private session | 10 to 15 | See below | Repeating the open session |
Candor on inherited problems
Every new chief audit executive inherits problems, and the first meeting is the only one at which they can be named without owning them. A quality assessment three years overdue, a risk assessment untouched since the pandemic, a high-rated issue extended four times, a plan that has delivered 60 percent for three years running, a pack that told the committee nothing: say so, in the first meeting, or inherit them as yours by the second. The way to say it matters. Facts with sources, not characterizations: “the last external quality assessment was completed in 2021, the Standards require one at least every five years, and the committee’s minutes do not show it being scheduled” rather than “the quality program has been neglected.” The predecessor is not blamed and not defended; the facts stand without a villain, and the committee will draw its own conclusions, which it probably drew before you arrived. What you know is separated from what you suspect: “I have confirmed the first two; the third is my working hypothesis and I will have tested it by the next meeting.” Management has heard it first: each inherited problem has been discussed with the executive concerned before the meeting, following the management responses principle that a surprise in the committee room costs more than it gains, and the pre-read says what management said. And the commitment is modest and dated: what will be done by the next meeting, not what will be transformed by year end. The committee hears a great deal of ambition from new executives; it hears less often “here are three things that are wrong, here is how I know, here is what I will have done in ninety days,” and it remembers who said it. The independence and objectivity guide covers the harder case in which an inherited problem is a pressure on the function itself, which belongs in the private session.
The rituals to propose
Working arrangements with the committee are easiest to set when there are none, which is to say in the first meeting; six months later, changing the chair’s habits is a negotiation. The rituals below are proposed, not announced, and the chair has heard them in the one-on-one and shaped them. Together they are the operating model the annual agenda guide assumes and the audit committee charter guide describes from the committee’s side.
| Ritual | Why | How to propose it |
|---|---|---|
| A standing call with the chair between meetings (monthly is common) | The chair should never be surprised; the chief audit executive needs a channel that does not wait for the quarter | “I would like thirty minutes a month; here is what I would use it for” |
| A private session at every regular meeting, with time protected | The exchange rules contemplate it; the relationship depends on it; its absence is the first red flag in an effectiveness review | “I will have something for it each time; if I do not, I will say so in one minute” |
| An escalation protocol | Both sides should know what the chief audit executive reports immediately, within a week, or at the next meeting (fraud involving an officer, a regulator’s contact, a scope restriction, a significant control failure) | A half-page proposal in the pre-read for the chair to edit |
| The pack’s structure and the seven-day pre-read | Information quality is the committee’s main instrument of oversight; the quarterly pack guide’s four questions | Show the dashboard page as a mock-up and ask for reactions |
| The plan process | The committee approves the plan and significant changes; it should see the risk assessment, the coverage, the resource assumptions and what is not covered | Propose the calendar: risk assessment discussion in one quarter, plan approval in the next, mid-year change review |
| The chief audit executive’s evaluation and compensation process | Functional reporting means the committee, not the chief financial officer, evaluates and sets pay, with management input | Ask the chair how it has worked and propose the Standards’ model if it has not |
| Direct access to members | Members may want to call; the chief audit executive should be able to call the chair | Agree it explicitly so nobody feels gone around |
| Committee education from the function | One short session a year on something the committee needs (a new standard, the function’s methods, an emerging risk) | Offer the first topic |
| An annual informal meeting | Relationships are built outside the agenda | Suggest a dinner before a meeting, chair’s choice |
| The committee’s evaluation of the function | Annual performance measures agreed with the committee, reported against | Propose five measures for the committee to choose from |
The first private session
Ten to fifteen minutes with the committee alone, and the temptation is to fill them with a repeat of the open session. Instead: first impressions of the function’s independence in practice (has anyone, in your first weeks, suggested what should or should not be audited, reported or rated?); the state of the relationships with the chief executive and chief financial officer as you have found them, in facts (how often you have met, how they responded to the inherited problems); anything from the predecessor conversation the committee should know; what you need from the committee that you could not ask for in front of management (support on a resource request, a word with an executive, time); and the invitation for the committee to tell you what it has not said in the open meeting, which it often will. The question new chief audit executives dread is the chair’s “what do you think of the chief financial officer?” The answer is facts and a date: what you have observed, what you have not yet, and when you will have a view worth giving. An opinion formed in five weeks and offered in a private session will follow the chief audit executive around for years whichever way it goes; the committee respects the refusal to give one more than it would respect the opinion. The what is a chief audit executive guide describes the dual reporting line this session makes real.
The follow-up notes
The meeting lives on in four notes, all sent within two business days. To the chair: a one-page summary of what was agreed (the rituals accepted or adjusted, the escalation protocol, the asks granted), the actions with dates, and the questions you could not answer with the date each will be answered; this becomes the first entry in the open-request log the effectiveness review guide recommends. To the committee, through the corporate secretary: the formal actions for the minutes and the pre-read for the next meeting’s expected content. To the chief executive and chief financial officer: what you told the committee, so that there is no version of the meeting they heard second-hand, and what the committee asked of management. To the function: what the committee heard about them, what was agreed, and what changes for the team, because the staff will have heard that the new chief audit executive met the committee and will fill the silence with anxiety if nothing is said. The notes are also the chief audit executive’s own record: a year later, when the committee’s expectations and the function’s delivery are compared, the first meeting’s note is the baseline.
Variants: IPO, internal promotion, a cloud, a small company
When the committee is new too, as after a listing, the first meeting is a mutual induction: the chief audit executive explains what an internal audit function is for and what the committee’s duties toward it are (the Standards’ Domain III, the exchange’s requirements), proposes the rituals as the committee’s first operating model rather than a change to one, and spends more time on the plan’s logic because the committee has never approved one; the internal audit after the IPO guide covers the eighteen months this meeting begins. When the chief audit executive is promoted from within, the committee knows them as the deputy who presented the IT findings, and the first meeting has to reset that: the facts about the inheritance are harder to deliver because they are partly the new chief audit executive’s own, and the right posture is ownership (“these are the function’s problems and now mine”) with the same candor and dates. When the predecessor left under a cloud (a dispute with management, a failure the committee blames the function for, a regulator’s criticism), the committee is anxious and divided, the one-on-ones are longer, the private session carries more, and the first meeting’s facts must be unimpeachable, because the committee will test whether the new chief audit executive is management’s choice or its own. And at a small company, where the committee has three members, meets four times a year and the chief audit executive may run a function of two or be part-time, the arc compresses to twenty minutes, the rituals shrink to a quarterly call with the chair and a private session each meeting, and the facts are fewer but the same in kind; the one-person shop guide describes the function this chief audit executive is presenting.
A worked first meeting: Fernhill Communications
Fernhill Communications is the regional telecom and media operator used in examples on this site: $4.8 billion of revenue, 9,400 employees, 3.2 million subscriptions, six television stations, a $900 million capital program with a fiber build partly funded by federal broadband grants, and a 16-person internal audit function of a chief audit executive, three managers, nine auditors and three data analysts. Its chief audit executive of eleven years retired in the third quarter of FY26 and the committee hired an external successor, the deputy chief audit executive of a larger operator, who started six weeks before the October meeting. The new chief audit executive held fourteen one-on-ones (the chair, the three other members, the chief executive, chief financial officer, general counsel, the external audit partner, the retiring chief audit executive and all three managers plus two staff), read three years of plans, packs and minutes, and sent a six-page pre-read seven days before the meeting.
| Segment | What the new chief audit executive said | How the committee responded |
|---|---|---|
| Facts (10 minutes) | FY26 plan: 44 engagements approved, 29 complete at the end of the third quarter, 7 in progress, 8 unlikely to finish, against 71 and 68 percent delivery in the prior two years; the risk assessment last fully refreshed in 2023; 112 open issues of which 19 high, 6 of them overdue more than a year and 3 extended three or more times; the last external quality assessment completed in 2021 with the five-year point in 2026 and nothing scheduled; the charter approved in 2019 against the prior standards; one manager role (revenue and fraud) vacant for seven months; the committee’s packs averaging 68 pages with no trend data; and no regulatory matters touching the function | The chair confirmed the facts matched the one-on-one; one member asked why the delivery rate had never appeared in a pack |
| Concerns (8 minutes) | Three. The grant compliance program for the two federally funded fiber counties had a high-rated finding on documentation of eligible costs, open for 14 months and extended twice, with a federal audit possible in FY27; confirmed, discussed with the chief financial officer, who had committed a remediation date and resources. Dealer commission controls, where the FY25 audit had found overpayments and the follow-up had not been performed because of the manager vacancy; confirmed as a gap, with a co-sourced validation proposed. The quality assessment, overdue by any reading, with the risk that the function’s conformance statement could not be supported; confirmed, with a proposal to commission the assessment for the second quarter of FY27 after a self-assessment | The committee asked the chief financial officer, present, to confirm the grant remediation date; approved the co-source in principle; asked for the quality assessment proposal at the next meeting |
| Next 90 days (5 minutes) | Complete the assessment and present the FY27 plan on a refreshed risk assessment at the January meeting; propose the charter refresh and the pack redesign at the same meeting; fill the manager vacancy; validate the dealer commission issue by co-source | Accepted; the chair asked for the dashboard mock-up in the January pre-read |
| Working together (5 minutes) | Proposed a monthly call with the chair, a protected private session at each meeting, a half-page escalation protocol, the seven-day pre-read and a 15-page pack, the plan calendar, and five candidate performance measures | All accepted; the chair chose three measures and asked the corporate secretary to add the private session to the standing agenda |
| Asks (2 minutes) | Approval in principle for the co-source; support for the manager hire at a market rate above the current band; thirty minutes at the January meeting for the plan | Granted, with the compensation question referred to the chair and the chief executive |
| Private session (12 minutes) | No pressure on scope observed in six weeks; the chief financial officer responsive on the grant issue; the retiring chief audit executive’s view that the committee had received what it asked for and no more, offered as his words; a request for the chair’s support with the compensation question | The chair asked what the new chief audit executive would need to know about the committee itself; the answer was its most recent effectiveness review, which had not been done in three years, and the chair agreed to schedule one |
The follow-up note to the chair listed eleven actions with dates; the note to the chief executive and chief financial officer summarized the facts and concerns as presented; the note to the team led with the committee’s approval of the co-source and the hire. By the January meeting the plan, the charter and the pack had changed shape, and the committee’s first question was about the grant issue’s remediation date, which is what the first meeting had been for. The telecom and media pillar places the FY27 plan that followed in Fernhill’s wider program.
Mistakes that take a year to undo
The vision meeting: forty minutes on where the function will be in three years and nothing about where it is. The surprise: a fact or a concern the chair hears for the first time in the room, which costs the chair’s trust before the relationship has any. The blame: a predecessor criticized by name or by implication, which tells the committee the new chief audit executive will one day talk about them the same way. The overpromise: a transformed function by year end, remembered at year end. The reorganization: a new structure announced before the assessment that would justify it. The opinion: a view of the chief financial officer offered in the first private session. The silence: a private session with nothing to say, which teaches the committee the session is unnecessary. The deference: no rituals proposed because it felt presumptuous, so the committee’s habits, including the ones that made the predecessor’s life hard, stay. The absence of asks: a chief audit executive who needs nothing is one the committee need not help. And the missing follow-up: a good meeting with no note, so that in six months nobody can say what was agreed. The tips for chief audit executives article and the first 90 days guide cover the rest of the first quarter; the first meeting is the hour in which most of it is decided.
Questions about the first audit committee meeting
What should a new chief audit executive cover at the first audit committee meeting?
Briefly who you are and how you work; what you have done so far; five to eight facts about the inherited function with sources (plan delivery, coverage, remediation health, quality program status, staffing, information quality, regulatory matters); the two or three inherited problems that concern you with evidence and dated actions; the next 90 days; proposed working rituals; specific asks; and a private session with content.
Who should the new chief audit executive meet before the first meeting?
The chair first, then each committee member, the chief executive, chief financial officer and general counsel, the external audit partner, the predecessor if available, and the function’s managers and a sample of staff. Nothing said in the meeting should be new to the chair, and inherited problems should have been discussed with the responsible executives first.
How candid should you be about problems you inherited?
Fully, in the first meeting, because problems not named then become yours. State facts with sources rather than characterizations, separate what you have confirmed from what you suspect, do not blame or defend the predecessor, make sure management heard it first, and commit to dated actions for the next meeting rather than transformations by year end.
What working arrangements should you propose?
A standing call with the chair between meetings, a protected private session at every meeting, an escalation protocol, the pack’s structure and a seven-day pre-read, the plan approval calendar, the committee’s role in your evaluation and compensation, direct access both ways, an annual education session, an informal annual meeting, and the performance measures the committee will judge the function by. Propose them in the first meeting, having shaped them with the chair beforehand.
What belongs in the first private session?
Observations on the function’s independence in practice, the state of relationships with the chief executive and chief financial officer in facts, anything from the predecessor the committee should know, what you need that could not be asked in front of management, and an invitation for the committee to say what it did not say in the open meeting. Decline to offer an opinion of the chief financial officer formed in five weeks; give facts and a date.
What should happen after the meeting?
Within two business days: a note to the chair with what was agreed, actions with dates and open questions with dates; the formal actions to the corporate secretary; a note to the chief executive and chief financial officer on what the committee heard and asked; and a note to the team. The chair’s note is the baseline for the relationship and the first entry in the open-request log.
Related guides
- The first 90 days as chief audit executive — the quarter this meeting opens.
- Becoming a chief audit executive and the chief audit executive interview — getting the job.
- Hiring a high-performance chief audit executive — what the committee thought it was buying.
- What is a chief audit executive — the dual reporting line.
- Presenting to the audit committee — the rules for the room.
- Reporting to the audit committee: the quarterly pack — the pre-read’s future shape.
- The audit committee effectiveness review — the committee’s side of the relationship.
- The audit committee annual agenda and the audit committee charter — the operating model the rituals create.
- The internal audit charter — the first document to read.
- Preparing for an external quality assessment and internal audit self-assessment — the quality program fact.
- Tracking internal audit issues — the remediation health fact.
- Internal audit KPIs and metrics — the measures to offer the committee.
- Evaluating management responses — no surprises for management either.
- Independence and objectivity — when an inherited problem is pressure on the function.
- Internal audit after the IPO — when the committee is new too.
- The one-person internal audit shop — the small-company variant.
- Tips for chief audit executives — the rest of the first quarter.
- Internal audit in telecom and media — Fernhill’s wider program.
Leave a Reply