Audit Committee Responsibilities and Best Practices

An audit committee is a subcommittee of the board of directors charged with overseeing the organization’s financial reporting, internal controls, and external audit process. Its core audit committee responsibilities include appointing and overseeing the independent auditor, reviewing financial statements before they are issued, monitoring the effectiveness of internal controls, and serving as the primary channel of communication between the board and the external audit team. These responsibilities apply across public companies, private companies, and nonprofit organizations, though the regulatory requirements differ by entity type.

What Are Audit Committee Responsibilities?

At its most fundamental level, an audit committee provides independent oversight on behalf of shareholders, donors, or other stakeholders who cannot directly monitor management. The committee does not manage the business or perform audits itself. Its job is to ask hard questions, evaluate the answers, and ensure that the financial picture presented to stakeholders is accurate and complete.

The specific duties that fall under audit committee responsibilities cluster into four broad areas: financial reporting oversight, auditor oversight, internal controls and risk, and ethics and compliance. Each area is described in detail below.

Financial Reporting Oversight

The committee reviews the annual audited financial statements and, for public companies, quarterly financial reports before they are filed with the SEC. Members discuss significant accounting policies, material estimates, and any areas where management has applied judgment. The goal is to confirm that management’s choices reflect economic reality rather than a preferred narrative.

Key activities include:

• Reviewing management’s discussion and analysis (MD&A) for consistency with the audited financials
• Evaluating the appropriateness of critical accounting estimates (e.g., revenue recognition, asset impairment, reserves)
• Confirming that disclosures are complete and fairly presented
• Reviewing earnings press releases before public release, including any use of non-GAAP metrics

Auditor Oversight

The audit committee, not management, is responsible for appointing, compensating, and overseeing the independent auditor. This structural separation is the cornerstone of auditor independence: the auditor reports to the committee rather than to the CFO or CEO.

Under PCAOB Auditing Standard AS 1301, the external auditor must communicate with the committee on a range of required topics before issuing its report. These include an overview of the overall audit strategy and timing, critical accounting policies and practices, significant unusual transactions, and any material weaknesses or significant deficiencies in internal control.

Audit committee responsibilities related to the external auditor include:

• Approving the scope of the annual audit engagement
• Pre-approving all audit and permissible non-audit services
• Evaluating the auditor’s independence annually, including reviewing the firm’s most recent PCAOB inspection report
• Conducting a formal auditor evaluation and deciding whether to recommend reappointment or pursue a competitive RFP
• Holding private executive sessions with the auditor, without management present, at least once per year

Internal Controls and Risk Management

The audit committee is not the only risk body on a board, but it typically owns oversight of internal controls over financial reporting (ICFR) and the broader internal audit function. For public companies subject to Sarbanes-Oxley Section 404, management must assess ICFR effectiveness and the external auditor must opine on it. The committee reviews both assessments and follows up on any identified deficiencies.

Risk oversight has expanded considerably. Most audit committee charters now assign responsibility for enterprise risk management (ERM) either to the full board or to the audit committee. At minimum, the committee should understand how management identifies and monitors risks that could affect financial reporting, including cybersecurity risks, third-party concentrations, and significant business model changes.

Ethics and Compliance

Audit committees establish and oversee procedures for the anonymous receipt and handling of complaints regarding accounting, internal controls, or auditing matters (sometimes called whistleblower procedures). Under the SEC’s listing standard rules, these procedures must be in place as a condition of exchange listing.

The committee also oversees the organization’s code of ethics and monitors compliance with laws and regulations affecting financial reporting.

The Audit Committee Charter

The audit committee charter is the governing document that defines the committee’s purpose, composition, authority, and responsibilities. Every audit committee should have a written charter, and for NYSE- and Nasdaq-listed companies it is a listing requirement.

A well-drafted audit committee charter should address:

• Composition requirements. Minimum number of members (typically 3 for listed companies), independence standards, and financial literacy requirements.
• Financial expert designation. Section 407 of Sarbanes-Oxley directed the SEC to require disclosure of whether at least one audit committee member qualifies as an “audit committee financial expert.” The definition now lives in SEC rules (Item 407(d)(5) of Regulation S-K) and requires attributes such as an understanding of GAAP and financial statements, experience preparing or auditing financial statements of comparable complexity, experience with accounting estimates and reserves, and an understanding of internal controls and audit committee functions.
• Meetings. Minimum meeting frequency and requirements for private sessions with the auditor, management, and internal audit.
• Auditor relationship. Explicit authority to appoint, evaluate, compensate, and dismiss the external auditor, and to pre-approve services.
• Charter review. Most governance frameworks call for the charter to be reviewed and updated at least annually.

The charter should be disclosed publicly. NYSE and Nasdaq rules require it to be posted on the company’s website, and it must be appended to the proxy statement at least once every three years.

Board Financial Oversight: Public vs. Private vs. Nonprofit

Public Companies

For SEC-reporting companies, audit committee responsibilities carry the greatest regulatory weight. Exchange listing standards (NYSE Rule 303A.06 and Nasdaq Rule 5605) require a minimum of 3 independent directors, at least one financial expert, and a formal charter. The committee must file an audit committee report in the annual proxy confirming that it reviewed and discussed the audited financials with management and the independent auditor.

The PCAOB actively engages with audit committee chairs as part of its inspection process and provides resources specifically for committees, including inspection reports on audit firms and guidance on auditor communications. Strong board financial oversight at this level means the committee is an active, well-informed counterpart to the auditor, not a passive approver.

Private Companies

Private companies are not subject to SEC or exchange listing rules, but audit committee best practices still apply, particularly for companies preparing GAAP financial statements for lenders, private equity sponsors, or prospective acquirors. Many private company boards form audit committees voluntarily to signal governance maturity and to give independent directors a structured forum for financial oversight.

For companies with institutional debt or PE backing, lenders and sponsors often expect an audit committee with at least one financially literate independent member, a written charter, and documented procedures for auditor oversight. A properly structured audit and assurance engagement is easier to manage and deliver when the audit committee is engaged and prepared.

Nonprofits

Nonprofit audit committee responsibilities are defined primarily by state law, grant requirements, and the organization’s bylaws rather than federal securities law. Many states require nonprofits above a certain revenue threshold to have an audit committee or designate the full board to carry out those functions.

For nonprofits receiving federal awards, the Single Audit threshold is $1,000,000 in federal expenditures for fiscal years beginning on or after October 1, 2024, under the revised 2 CFR Part 200. A single audit requires robust audit committee oversight of the auditor’s compliance findings, questioned costs, and corrective action plans.

The National Council of Nonprofits recommends that nonprofit audit committees include members with financial expertise, maintain independence from executive staff, and review the Form 990 before filing. For nonprofits in need of board financial oversight support, a well-structured audit engagement provides a framework for accountability. Learn more about how Modus supports nonprofit organizations through financial statement audits and single audits.

Audit Committee Best Practices

Meeting the minimum listing or statutory requirements is a starting point, not the goal. The following practices mark high-functioning audit committees.

Meet Regularly and Independently

Most leading governance frameworks call for at least 4 committee meetings per year, with additional meetings as needed around the audit cycle. Private executive sessions with the auditor, internal audit, and management (separately) should be a standing part of the agenda, not an afterthought.

Stay Current on Accounting Standards

Significant accounting standards changes require the committee to invest time understanding their financial statement impact before they take effect. Members should receive regular briefings from management and the auditor on upcoming standards and their implementation status.

Conduct an Annual Auditor Evaluation

A formal, documented evaluation of the external auditor is increasingly viewed as a governance standard, not just a best practice. The evaluation should address audit quality, communication effectiveness, industry expertise, responsiveness, and the value of insights delivered during the engagement. The results inform the reappointment decision.

Use the Pre-Approval Process Deliberately

The pre-approval of non-audit services is not a rubber stamp. The committee should understand what services are being proposed, confirm they are permissible under independence rules, and assess whether the incremental fees could create any appearance of dependency.

Address Cybersecurity and Emerging Risks

Audit committees in 2026 are increasingly responsible for overseeing cybersecurity risk as it affects financial reporting integrity and SEC disclosure obligations. The committee should confirm that management has clear accountability for cybersecurity, understand the escalation path for material incidents, and review disclosure controls around cyber events.

Related reading: Financial Statement Audit: What It Is and What to Expect

Frequently Asked Questions

What is the primary responsibility of an audit committee?

The primary responsibility of an audit committee is independent oversight of the financial reporting process, the external auditor, and the organization’s internal controls. The committee ensures that financial statements are accurate, that the auditor is independent and effective, and that management’s judgments and estimates are reasonable.

How many members should an audit committee have?

NYSE and Nasdaq listing standards require a minimum of 3 members for listed companies. All members must be independent, and at least one must qualify as an audit committee financial expert under the SEC’s definition. Private companies and nonprofits are not subject to these rules but should aim for at least 2 to 3 financially literate, independent members.

What is an audit committee charter?

An audit committee charter is a formal written document that defines the committee’s purpose, membership requirements, authority, and specific duties. It is adopted by the full board and should be reviewed at least annually. For listed companies, it must be publicly disclosed and posted on the company’s website.

Does a private company need an audit committee?

Private companies are not required to have an audit committee by federal law, but forming one is considered a governance best practice, particularly for companies with institutional debt, private equity investors, or significant external stakeholders. Lenders and sponsors often expect one as a condition of their investment or lending relationship.

What is an audit committee financial expert?

An audit committee financial expert (ACFE) is a person the board has determined possesses the financial sophistication required under SEC rules, including experience preparing or auditing financial statements of comparable complexity, understanding of internal controls and audit committee functions, and familiarity with the application of GAAP. Public companies must disclose whether they have an ACFE and, if not, explain why.

How often should the audit committee meet with the external auditor?

The audit committee should meet with the external auditor at least twice per year: once during the planning phase to discuss the audit scope and approach, and once upon completion to review findings, required communications under PCAOB AS 1301, and the auditor’s report. Additional meetings are appropriate when significant issues arise, and at least one private session without management present should occur each year.