The audit committee effectiveness checklist: the questions the committee should be able to answer

Audit committees are rarely found ineffective in one decisive way. They drift. The estimates inside the financial statements are received rather than interrogated; the external auditor’s independence is assumed rather than tested; internal audit reports to the committee, and the committee never changes its plan; and the whistleblowing case, when it comes, arrives at a committee that has never rehearsed one. Each is invisible in the committee’s own minutes, which record that the reports were received and the accounts recommended.

The six areas below are where the committee is most consistently tested — by the board it reports to, by the auditors on either side of it, and by the event it did not expect. Each is stated as the questions a sound committee can answer. A hesitation on a question is the finding.

The financial statements and the estimates inside them#

• Can the committee name the judgements inside these financial statements — the provisions, the valuations, the revenue recognised on unfinished work, the assumed asset lives — without being told by management or the auditor?
• For each, does the committee know who in management made the judgement, what evidence it rests on, and how it moved since the last statements?
• Has the committee ever changed an estimate, or asked for one to be changed, rather than accepting the range management proposed?
• Does the committee know which single estimate, if wrong, would most change the result — and has it spent its time there?

External audit and its independence#

• Does the committee, not management, own the relationship with the external auditor: the appointment, the fee, the scope and the private session?
• Has the committee tested the auditor’s independence rather than assumed it — what else the firm does for the institution, how long the partner has held the engagement, and what the auditor was reluctant to say in front of management?
• Does the committee know where the auditor and management disagreed this year, and how each disagreement was resolved?
• Has the committee ever asked the auditor a question the auditor had not prepared for?

Internal audit and the third line#

• Does the head of internal audit report to the committee in substance — appointment, assessment, removal — and not only on the organisation chart?
• Has the committee changed the internal audit plan in the last year: added an area management did not propose, or removed one that served management’s comfort rather than the committee’s?
• When internal audit rates a finding as serious, does the committee track it to closure, and does anyone in management answer for a finding that stays open?
• Does the third line have teeth — meaning that a management area rated poorly has felt a consequence — or does it produce reports the committee receives?

Whistleblowing and fraud response#

• Does the committee know how a whistleblowing report reaches it, who sees it first, and what happens in the interval — or does it assume the channel works because it exists?
• When a report arrives that names a senior manager, does the committee have a way to investigate that does not run through the person named or the people who report to them?
• Has the committee agreed, before any case, who decides whether to inform the board, the auditor, the regulator and the press, and in what order?
• Does the committee know what happened to the last report — its investigation, its outcome and its consequences — and whether the person who raised it is still employed?

A hesitation on a question is the finding.

The sessions no one rehearses#

• Has the committee ever rehearsed the session in which the auditor declines to sign, or qualifies the opinion — who speaks, what the committee asks, what it tells the board?
• Has it rehearsed the session in which management asks for a change to an estimate late in the process, under time pressure, with a plausible reason?
• Has it rehearsed the fraud that is discovered after the statements were approved, and what the committee says about the statements it recommended?
• Does the committee chair know, before these sessions, which decisions are the chair’s alone and which the committee must take together?

The committee’s own working#

• Does the committee receive its papers early enough to read the estimates, and does it read them — or does it read the covering paper and the auditor’s summary?
• Does the chair run private sessions with the external auditor, the head of internal audit and, separately, the chief financial officer, and does anything said there change what the committee does?
• Does the committee’s record show the questions it asked and the challenge it made, or only the reports received and the accounts recommended?
• Does the committee report to the board in a way that tells the board what it should worry about, rather than that the committee met?
• Can each member say what they personally answer for on this committee, and what the questions asked afterwards would be if the statements were wrong?

How to use it#

Run the checklist against the last set of financial statements before running it across the committee’s year. Most of what is weak will show in the first area, while it is still cheap to correct: a committee that cannot name the estimates has found its work for the next cycle. Then take one session from the fifth area and rehearse it, with the auditor in the room, before the year in which it happens. The Audit Committee in Practice masterclass in The Helm works all six areas with members and chairs, taught by practitioners who have sat on, reported to and audited for these committees.