Audit Committee Responsibilities: A Guide for 2026

You've been invited to join an audit committee, or you're preparing to apply for one, and the charter lands in your inbox. It lists oversight of financial reporting, controls, internal audit and the external auditor, plus cybersecurity, AI and sustainability disclosures. What it doesn't tell you is where your job stops, what evidence you should ask to see, or how you challenge people without doing their work for them. That's the gap this guide closes, step by step.

Table of Contents

• What an Audit Committee Does and Why It Exists
  • Why the Role Became Direct Accountability
• The Core Duties and the Evidence Behind Each One
  • How to Read the Table
  • Where New Members Get Confused
• Managing the External Auditor Through the Year
  • The Six Phases and One Question for Each
• Challenging Management and Internal Audit Without Taking Over
  • Four Questions That Reveal Quality
  • Internal Audit Needs a Direct Line to You
• Where Technology, ESG and AI Oversight Starts and Stops
  • Build a Responsibility Map Instead
  • ESG and AI Disclosures Need an Evidence Chain
• Member Expectations and Financial Expertise Tests
  • Three Ideas People Mix Up
• Check Your Readiness Before Seeking an Audit Seat

What an Audit Committee Does and Why It Exists

A finance director and the external auditor disagree about a multi-year contract. The finance director wants revenue recognised early, when the contract is signed. The auditor says it should be spread as work is delivered. The chief executive prefers the earlier date because it improves this year's results.

That's where audit committee responsibilities become concrete. In one sentence, the committee oversees financial reporting, internal controls, internal audit and the external audit, but it doesn't prepare the accounts or perform the audit. It's the board's referee in that dispute, not the bookkeeper and not the auditor.

Think of an accountability chain. The board sets direction. Management runs the books and owns the numbers. The auditor gives an independent verdict. The committee checks that the whole chain works, and it steps in when links pull in different directions.

Why the Role Became Direct Accountability

After major corporate reporting failures, the U.S. Sarbanes-Oxley Act of 2002 formally defined an audit committee as a board committee responsible for overseeing an issuer's accounting and financial-reporting processes and audits of its financial statements. It made the committee directly responsible for appointing, compensating and overseeing the registered public accounting firm, including resolving disagreements between management and the auditor about financial reporting.

Two details changed behaviour. First, the external auditor must report directly to the audit committee rather than solely to management. Second, the committee must preapprove permitted services from that auditor, which protects independence. Together they moved the committee from a largely review-oriented function toward direct accountability for the audit relationship, financial-reporting oversight and internal-control supervision.

That U.S. framework became a reference point for reforms in other major capital markets. For anyone exploring board of directors positions, three tests now run through every appointment discussion. What are the duties, who owns each relationship in the chain, and what expertise proves you're ready?

The Core Duties and the Evidence Behind Each One

The pre-meeting pack lands in your inbox a week before your first audit committee session, and the charter inside it lists a dozen responsibilities. The fastest way to find your real duties is to ask one question of every line: what evidence would prove this was actually done?

The core duties cluster into five areas: financial reporting, internal controls, internal audit, the external auditor and whistleblowing procedures. Boards add scope through their charters, but the basics below stay constant.

Duty	What the committee does	Evidence it reviews
Financial statement integrity	Monitors the integrity of financial statements and results announcements	Draft statements, significant accounting judgments, policy changes
Annual report review	Advises whether the annual report is fair, balanced and understandable	Report drafts, disclosure checklists, management's review memo
Internal financial controls	Reviews internal financial controls and risk-management systems	Control deficiency logs, severity ratings, remediation status
Internal audit oversight	Monitors internal audit's plan, findings, resourcing and independence	Annual audit plan, closed and overdue findings, budget
External auditor appointment	Recommends appointment, reappointment or removal of the external auditor	Auditor quality assessment, tender results, team continuity
Auditor remuneration and terms	Approves audit fees and engagement terms	Fee proposals, engagement letter, scope changes
Auditor independence	Reviews independence and effectiveness, and preapproves permitted non-audit services	Independence declarations, non-audit service requests and fees
Accounting complaints	Oversees procedures for complaints about accounting and auditing matters	Complaint log, investigation outcomes, time to resolution

How to Read the Table

Read it from right to left. The evidence column is what separates an informed committee from one that only receives papers. Anyone can listen to a presentation about controls. A working committee asks for the deficiency log, checks severity ratings, and tracks whether remediation dates hold.

The duties themselves follow the UK Corporate Governance Code benchmark for audit committee duties, which covers monitoring statement integrity, advising on whether the annual report is fair, balanced and understandable, reviewing internal financial controls, monitoring internal audit, recommending auditor appointment or removal, approving remuneration and terms, and reviewing auditor independence and effectiveness. U.S. rules add the accounting-complaints duty in the final row.

Newer topics keep reaching committee agendas, and each one lands on top of this base. A committee that chases fresh subjects while the core duties go unexamined has the sequence backwards.

Notice also where each row sits in the accountability chain. Management prepares the statements and runs the controls. Internal audit tests them. The committee oversees both, reviews the evidence and recommends. The full board, and ultimately shareholders in the case of the auditor's appointment, decides. Your seat demands proof at the oversight stage, never ownership of the execution stage.

Practical rule: If a duty has no recurring evidence pack, no owner and no date for follow-up, it's a statement of intent, not oversight.

Where New Members Get Confused

• Whistleblowing isn't a policy on a shelf: Confirm the company runs a confidential channel for staff to raise accounting or auditing concerns, that you receive the complaint log at every meeting, and that each complaint closes with a recorded outcome and a date.
• Fair, balanced and understandable isn't proofreading: You're testing whether good and bad news get proportionate weight, and whether a non-specialist reader can follow the story the numbers tell.
• The annual calendar drives everything: Map each duty to specific meetings early, so year-end doesn't become a rush to cover twelve months of oversight in one session.

Treat the table as your minimum checklist for those checks. If your charter promises more, hold it to the same evidence test.

Managing the External Auditor Through the Year

Managing the auditor isn't a single year-end meeting. It's a six-phase cycle, and each phase belongs in a specific part of the annual calendar. Knowing which meeting covers which phase lets you prepare instead of reacting to papers.

The timeline below shows how the phases connect across the year.

The Six Phases and One Question for Each

1. Appointment or reappointment, before fees and plans are agreed: Assess quality, independence, team continuity and fees, then recommend to the board and shareholders. Ask, what would make you walk away from this engagement?
2. Engagement, before fieldwork starts: Agree scope, fee and the discussion around materiality. Ask, where do you expect the hardest judgments to sit this year?
3. Interim period, at each quarterly meeting: Preapprove permitted non-audit services and check each request against independence rules. Ask, could this service make you audit your own work later?
4. Year-end, before the annual report is approved: Review the auditor's view on estimates, impairments, going-concern assessments and revenue timing, and hold a private session without management present. Ask, what would you have done differently if management hadn't intervened?
5. Disagreements, whenever they arise: Hear both sides, decide, and record the reasoning. Ask each side, what's the strongest version of the other side's argument?
6. Close-out, after the management letter is issued: Track recommendations to completion and report unresolved items to the board. Ask, which of these points will you still be raising next year if nothing changes?

Phase five is where our opening contract dispute lands. Management presents its case for early revenue. The auditor explains why delivery matters. The committee doesn't split the difference for politeness. It tests the accounting reasoning, decides, and minutes why. That record protects everyone, including management, if the judgment is questioned later.

The video below walks through how this oversight relationship works in practice.

Time is the constraint new members underestimate most. Private sessions, pre-meeting calls with the audit partner and reading judgment papers all sit outside formal meeting hours. It's worth running your existing commitments through a board time commitment calculator before you accept, because phase four alone can dominate your calendar around year-end.

The private session isn't a courtesy. It's where the auditor can tell you what they can't say comfortably in front of the people whose numbers they're auditing.

Challenging Management and Internal Audit Without Taking Over

The most common new-member mistake is re-performing management's work. You start rechecking calculations, drafting disclosures in the margins, or designing controls yourself. It feels diligent. In practice, it blurs accountability, because once you've built the answer, you can't independently challenge it.

The principle is simple. Management owns controls, estimates and remediation. The committee tests the evidence behind them. Your tool isn't a spreadsheet. It's a well-aimed question, asked early enough to change the outcome.

Four Questions That Reveal Quality

• Which accounting estimates changed this year, and why: A change isn't wrong, but an unexplained change near year-end deserves pressure. You're listening for new information versus a preferred result.
• Which control deficiencies were found, and when was each fixed: Dates matter more than descriptions. A deficiency found early and fixed promptly tells a different story from one discovered by the auditor in the final week.
• Did you consult the auditor on any unusual judgment: Early consultation signals a healthy relationship. Surprises at year-end signal the opposite.
• How much pressure did the close timetable place on the team: Rushed closes produce errors. If the finance team is stretched thin, that's a control issue, not just a staffing one.

Internal Audit Needs a Direct Line to You

Internal audit should report to the committee, and its head should meet you in private session, just like the external auditor. You approve the audit plan, budget and resourcing, then review findings and overdue actions at each meeting. A quick self-check against a board role fit checklist can help you judge whether your experience matches this kind of challenge-based oversight before you take the seat.

Watch for four red flags. Remediation dates keep moving. Management sees internal audit reports before the committee does. Internal audit headcount falls while the plan stays the same. Year-end provisions release just enough to hit targets.

For each one, the response follows the same pattern. Request the underlying evidence rather than a summary. Ask for an independent view, from internal or external audit. Then record the follow-up, with an owner and date, in the minutes. You haven't taken over. You've made it impossible for the issue to slip away unnoticed.

Where Technology, ESG and AI Oversight Starts and Stops

A ransomware attack shuts down the company's billing system on a Friday afternoon. Who owns what? Management runs the incident response and repairs the weakness. Internal audit later tests whether the controls really worked. The audit committee asks whether the risk information reaching the board was reliable. The full board decides how much risk the company will accept in the first place. Hold that chain in mind, because it tells you where every new oversight topic starts and stops.

New topics keep arriving at the committee's link in that chain. In the 2025 KPMG Belgium audit committee survey, 90% of audit committees reported primary or significant responsibility for cybersecurity and 73% for data privacy, while 62% expressed at least some concerns about committee composition and skills. Among those concerned members, 33% pointed to insufficient cybersecurity or technology expertise, meaning the committee carrying the responsibility often doubts it has the bench to carry it well.

The diagram below maps where the committee's remit sits on these topics, and where it stops.

Adding a topic to the committee isn't automatically good governance. Without matched expertise, time and reporting lines, it creates concentration risk, shallow challenge and unclear escalation.

Build a Responsibility Map Instead

• Management owns controls and remediation: They run incident response, fix weaknesses and produce the data.
• Internal audit provides independent assurance: They test whether those controls work in practice.
• The audit committee challenges reporting: You test the reliability of financial, control and technology-risk information reaching the board.
• The full board retains accountability: Enterprise risk appetite and strategy stay with the board, not one committee.

ESG and AI Disclosures Need an Evidence Chain

A separate study, the 2025 global KPMG audit committee survey report, shows how shallow oversight can run on these topics. 44% of members said their committees oversee ESG and climate-related disclosures, yet only 10% were engaged in management's preparedness for emerging global ESG disclosure frameworks, and 14% reported their committees considered data ethics and AI bias. A committee can look active on ESG while remaining unprepared for assurance.

So don't just approve narrative disclosures. Test who owns data definitions, controls, supplier evidence, scenario assumptions and assurance readiness, and what happens when information is incomplete. Coordinate with internal audit, external assurance providers, risk, legal and relevant board committees. For prospective members, readiness evidence means overseeing incident response, third-party risk, privacy controls, model governance or technology assurance, not merely holding a finance title.

Member Expectations and Financial Expertise Tests

Independence comes first. A member should have no material relationship with the company, such as consulting fees or recent employment, that could compromise judgment. The table below compares two major benchmarks side by side.

Requirement	UK Corporate Governance Code 2024	NYSE listed companies
Minimum members	At least three, or two in smaller companies	At least 3 members, all independent
Board chair as member	Not permitted	Independent directors only, chair role constrained by independence rules
Financial expertise	At least one member with recent and relevant financial experience	At least one member with accounting or related financial-management expertise
Financial literacy	Expected through independence and experience tests	Each member must be financially literate, or become so within a reasonable period after appointment
Sector competence	Committee collectively must have competence relevant to the company's sector	Not stated as a collective sector test
Relationship to SEC definition	Not applicable under the UK regime	A director meeting the SEC audit committee financial expert definition satisfies the NYSE expertise requirement; the reverse is not always true

The UK Corporate Governance Code 2024 composition requirements make independence, financial capability and sector knowledge distinct tests, not interchangeable credentials. Under NYSE standards, each member must be financially literate or become so within a reasonable period, and at least one member needs accounting or related financial-management expertise, as set out in the NYSE guidance on audit committee financial literacy and expertise.

Three Ideas People Mix Up

Financial literacy means you can read a balance sheet, cash flow statement and audit findings, and ask sharp questions about them. Every member needs this. It's the entry ticket, not the headline credential.

Financial expertise goes further. It's an accounting or financial-management background, such as a former CFO, controller or audit partner, plus the judgment to evaluate estimates. Note the asymmetry in the table. Meeting the SEC expert definition satisfies NYSE, but meeting NYSE alone may not satisfy the SEC.

Sector competence belongs to the committee as a whole, not each member. A former bank chief risk officer may bring strong sector knowledge to a bank's committee, but they'd still need to show accounting judgment before being named its financial expert. If you're drafting application materials, test how clearly that distinction comes across with a board CV grader before a nomination committee reads it.

Keep the tests separate in your own pitch: independence proves you can judge freely, literacy proves you can follow the numbers, expertise proves you can challenge them, and sector knowledge proves you understand the business behind them.

Check Your Readiness Before Seeking an Audit Seat

A common miss at this stage is strong boardroom stories that still read like management work. Audit readiness means showing you can sit in the accountability chain, challenge the numbers, and know where your duty ends.

Run each item as evidence. For every line, name one artifact a nomination committee can test: an independence note, a challenged estimate, a minutes-level question, an incident review, or a gap you filled that management still owns.

• Clean independence: no conflicting relationships; show it in an independence note.
• Financial literacy: proof you can read and challenge accounts; cite a judgment you questioned.
• Clear expertise claim: an accounting or financial-management role, or prior audit committee service.
• Technology, ESG or AI oversight: incident response, privacy, model governance or assurance exposure where the board has added those topics.
• Enough time: count existing seats first with SeatSignal's free Board Role Fit Checklist and Board Time Commitment Calculator.
• Sector knowledge the committee needs: name the gap you fill, and where management still owns execution.
• Constructive challenge: a record of pressing management while keeping working relationships intact.

Score yourself with the free Board Readiness Assessment before a chair sees the file. If the gap is presentation rather than substance, SeatSignal hand-picks board roles checked by a person, prepares a director-grade packet for each board, and trains you for each interview; its placement team runs each stage while you review, approve and send applications in your own name. Decisions and due diligence remain yours, and results aren't guaranteed. Visit SeatSignal to start with the free readiness tools and see which audit seats fit your expertise.