Finance and Audit Committee: Duties, Members and Oversight

If a finance title were enough, why do so many finance and audit committees still struggle once cyber incidents, privacy complaints and climate disclosures land on the same agenda? A former CFO can read a balance sheet and still be a poor match if the unresolved risk sits outside that person's oversight record. Fit is evidence of judgment, not a job title.

Table of Contents

• What a Finance and Audit Committee Is For
• Core Oversight Duties Mapped to Each Area
  • What the committee owns after the statements are drafted
  • A checklist for the first few meetings
• Who Can Sit on the Committee and Qualify as an Expert
  • The UK test
  • The U.S. layered model
  • Literate is not the same as expert
• How Auditor Independence Is Kept in Check
  • What the committee does with the letter
• How the Remit Stretches Beyond Accounting
  • Oversight is not ownership
• Confirm the Seat Fits Before You Apply

What a Finance and Audit Committee Is For

A finance and audit committee is a board committee that oversees how the company reports its finances, how it controls that reporting, and how it works with the external auditor. It sits as an independent check between management and shareholders.

Management writes the scorecard. The committee checks that the scorecard is accurate and that the referee was independent.

The committee does not prepare the numbers. It tests whether the people who do can defend them, and whether the auditor who signs them is free of management's influence.

That model was rebuilt after corporate collapses. The U.S. Securities and Exchange Commission describes how the Sarbanes-Oxley Act of 2002, enacted after Enron and WorldCom, required audit committees of companies listed on U.S. exchanges to consist entirely of directors independent from management. The law moved direct responsibility for the external-auditor relationship from executives to the committee. The committee must oversee the auditor's appointment, compensation, retention and work, and the auditor reports directly to it.

The same framework added procedures for receiving and handling accounting and auditing complaints, including confidential or anonymous employee submissions. It also gave the committee authority to engage independent advisers using company-funded resources. Those powers matter when management's story and the auditor's story don't match. A committee that can't hire its own counsel or forensic accountant is dependent on the people it is supposed to challenge.

This is not an administrative subcommittee that rubber-stamps a pack the CFO already finished. It is the control point between management, the financial statements, internal controls and the external audit. The name says finance and audit, but the day-to-day remit also covers internal control over financial reporting and the internal audit function that tests those controls. Directors who want this work should look at how board of directors positions describe committee duties before they treat every finance seat as the same job.

Core Oversight Duties Mapped to Each Area

The committee connects three control layers. Management prepares the financial statements. Internal control over financial reporting is the system that is supposed to make those statements reliable. The independent external audit examines the statements and, for many issuers, the controls. If any layer is weak, the other two can't carry the load.

Use the six rows below as a working map. Each row is an oversight area, what the committee does, and one question worth putting to management in the room.

Oversight area	What the committee does	Question to put to management
Financial statements	Reviews annual and interim statements before release and challenges key estimates and judgments	Which estimates changed most this year, and what evidence supports them?
Internal control over financial reporting	Oversees the design and testing of controls and reviews deficiencies	Which control deficiencies remain open, and who owns each fix?
External auditor	Appoints, pays, retains and oversees the auditor and resolves reporting disagreements	Did management and the auditor disagree on any judgment this year?
Internal audit	Reviews the audit plan, findings and resourcing of the internal audit function	Does internal audit have direct access to the committee without management present?
Complaints and whistleblowing	Oversees confidential and anonymous procedures for accounting and auditing concerns	How many concerns were received this year, and how were they closed?
Ethics relating to reporting	Reviews codes of conduct and conflicts that could affect financial reporting	Which conflicts of interest were disclosed, and how were they managed?

What the committee owns after the statements are drafted

Reviewing a finished set of accounts is the visible part of the job. It is not the whole job. The PCAOB explains that, following Sarbanes-Oxley, audit committees of U.S. public companies became directly responsible for appointing, compensating and overseeing the independent auditor. They also became responsible for resolving disagreements involving financial reporting, and for overseeing and monitoring employee complaints about those matters. The PCAOB treats auditor independence as a shared responsibility of management, the audit committee and the auditor. Independence is a committee function, not a personal quality you assume the firm already has.

A short briefing on how chairs run that challenge is worth watching before a first meeting.

A checklist for the first few meetings

In meeting one, walk the financial-statement and control rows. Ask which estimates moved and which deficiencies are still open. In meeting two, meet the external auditor and internal audit without management in the room for part of the session. In meeting three, review the whistleblowing log and any conflicts that touch reporting. If a row has no owner, no paper and no answer, that gap is the committee's problem, not a staff detail to park.

A practical way to rehearse those questions before you accept a seat is a board role fit checklist that forces you to match your evidence to each row, rather than to a generic finance biography.

Who Can Sit on the Committee and Qualify as an Expert

Membership rules are not one global standard. U.S. listing practice and the UK Corporate Governance Code 2024 use different tests for size, independence, the board chair, individual finance skill and collective sector knowledge. Treat them as separate gates.

Requirement	U.S.-listed companies	UK Corporate Governance Code 2024
Minimum size	At least three members	At least three members; two allowed in smaller companies
Independence	All members independent under listing rules and Rule 10A-3	All members independent non-executive directors
Chair of the board	Not excluded by the cited exchange financial-literacy rules	Board chair cannot serve as a committee member
Individual financial expertise	Every member financially literate; at least one with accounting or financial-management expertise	At least one member with recent and relevant financial experience
Collective sector competence	Not a stated requirement in the cited U.S. listing rules	Committee must collectively have competence relevant to the company's sector

The UK test

The UK Corporate Governance Code 2024 requires a board to establish an audit committee of independent non-executive directors. The committee must have at least three members, though smaller companies may have two. The board chair cannot sit as a member. At least one member needs recent and relevant financial experience. The committee as a group must have competence relevant to the company's sector. A bank committee and a retailer committee can both pass the finance test and still fail if nobody understands that sector's reporting.

The U.S. layered model

For U.S.-listed companies, the SEC's exchange-approval release describes a layered model, not a vague "finance experience" label. SEC-approved exchange requirements generally require at least three members, independence under the listing rules and Rule 10A-3, and financial literacy for every member. At least one member must have accounting or related financial-management expertise. Nasdaq treats prior finance or accounting employment, an accounting certification, or comparable sophistication, including service as a CEO, CFO or other senior officer with financial oversight, as qualifying evidence.

That still leaves a board to map each candidate to real tasks: balance sheets, income statements, cash-flow statements, estimates, internal controls and auditor judgments. A committee can clear the minimum and stay weak if the expertise sits in one person. The other members still need enough literacy to challenge management, follow audit adjustments and assess control deficiencies.

Say a former CFO of a regulated lender knows the reporting cycle cold. Credit reserves and liquidity covenants may still need a colleague who has overseen those judgments, not just signed a management representation. Titles don't split that work for you.

Literate is not the same as expert

Financially literate is the baseline for every member. Audit committee financial expert is a separate designation for at least one member.

Under SEC rules implementing Sarbanes-Oxley Section 407, a registrant must disclose whether at least one member qualifies, and if so name that person and state whether they are independent. If nobody qualifies, the company explains why. The definition has three parts:

• GAAP and the statements: an understanding of generally accepted accounting principles and financial statements.
• Judgment accounts: the ability to assess accounting for estimates, accruals and reserves.
• Comparable experience: experience preparing, auditing, analyzing or evaluating financial statements of a breadth and complexity comparable to what is reasonably expected for that registrant.

The SEC also states that naming someone a financial expert does not create duties, obligations or liability beyond those the person already has as a committee member and director. The label is a disclosure, not a higher legal standard of care.

Practical rule: Ask the candidate how they would challenge a reserve estimate or an impairment assumption. A strong answer cites the evidence, the alternative the auditor preferred, and what would change the number. A weak answer recites a policy.

Candidate papers should separate the two labels, show issuer complexity that matches the company, and explain independence and conflicts. A board CV grader is useful here because it pushes a biography toward oversight evidence instead of a list of finance titles. Passing the listing test is the floor. A committee that can't question the one expert in the room has already failed the job those rules were written to protect.

How Auditor Independence Is Kept in Check

Independence is shared. Management supplies facts, the auditor tests its own relationships, and the committee judges what it receives. The committee does not run the firm's independence checklist. It decides whether the evidence is good enough to keep the engagement.

PCAOB standards define an audit committee as the board committee set up to oversee the entity's accounting and financial-reporting processes and its financial-statement audits. Where no such committee exists, the entire board takes that role. The standards also give the committee a concrete sequence for conflicts.

1. The registered firm identifies relationships with the audit client, or with people in financial-reporting oversight roles, that could reasonably bear on independence.
2. It communicates those relationships to the committee in writing.
3. The firm and the committee discuss the potential effects.
4. The firm affirms its independence in writing.
5. The discussion is documented.

What the committee does with the letter

Read the letter against the people who influence the numbers, not only against the legal entity name. Ask which non-audit services were sold, at what fee level relative to the audit fee, and whether those services put the firm in the position of auditing its own advice. Check that the engagement partner is inside the required rotation. If a relationship is described and nobody can explain the safeguard, escalate it before the opinion is signed. An unresolved concern is a reason to pause, not a footnote for the next quarter.

Say the finance director previously worked at the audit firm. The committee should ask when that person left, which engagements they touched, and how the firm walled them off before this audit started. A clean written affirmation that ignores that history is not a clean affirmation.

The committee judges the evidence. It does not perform the independence test in the firm's place.

How the Remit Stretches Beyond Accounting

Complexity is now the agenda setter. In its 2025 audit committee research, KPMG found that 88% of audit committees see increasing business and risk complexity as the greatest influence on their agenda. 90% have primary or significant cybersecurity oversight, and 73% have similar responsibility for data privacy. Generative-AI oversight remains limited for many of those committees.

The skills gap is just as plain on disclosure topics. A separate 2025 KPMG survey found that 36% of respondents identified a shortage of ESG expertise at board level, while only 10% said audit committee members were involved in overseeing management's preparedness for emerging global ESG-disclosure frameworks.

Risk area	Typical committee role	Evidence to request
Cybersecurity	Primary or significant oversight for 90% of committees	Incident response test results and open security findings
Data privacy	Primary or significant oversight for 73% of committees	Privacy audit findings and breach log reviews
Generative AI	Oversight remains limited for many committees	Inventory of AI use cases and the control policy covering them
ESG and climate disclosure	Oversight of readiness for emerging ESG-disclosure frameworks reported by only 10% of committees	Disclosure controls, data sources and the assurance plan
Enterprise risk	Shared with the full board or risk committee	Risk register owners and escalation thresholds

Oversight is not ownership

The committee asks who decides, which control was tested, and what would trigger an escalation to the full board. It does not run the security operations center, the privacy office or the sustainability team. When the skill is missing, the options are an independent adviser, a scoped internal-audit review, committee education, or a new director whose evidence matches the gap. Adding another traditional finance expert does not close a cyber or climate hole. Cross-domain judgment does, and only when the charter says who owns the decision.

Finance, audit and risk leaders aiming at these seats in banks, lenders, payments firms and investment businesses can compare that split against our financial services board guidance before they claim a risk they have never overseen.

Confirm the Seat Fits Before You Apply

A credible application starts with a gap list, not a polished title. Each check below tests the same thing a nomination committee will: whether your evidence covers the charter, and who carries what it misses.

1. Map the duties. Match your experience to each oversight area and mark the gaps in plain language.
2. Test independence. List past or present ties to the company, its auditor and its executives.
3. Count the seats. Add current audit-committee and public-company roles and ask whether preparation time still exists. Our board time commitment calculator is built for that arithmetic.
4. Name the hard risk. If the committee is stuck on cybersecurity, ESG or reporting complexity, your evidence has to speak to that risk.
5. Read the charter. Note meeting frequency and the preparation the chair expects.
6. Split the competence. Decide which gap you can fill and which a colleague must cover.

Work through the list and one line usually comes out weak. That weak line is often the answer to the first question the chair asks, so write the evidence for it before you write the cover letter.

SeatSignal is built for first-time directors, C-suite executives, portfolio directors, finance, audit and risk leaders, exiting founders, and nonprofit and community leaders. The program hand-picks board roles checked by a person, drafts a director-grade packet for each board, and rehearses you against the questions that board's chair is most likely to ask. Appointment decisions rest with boards, nomination committees and recruiters, and no seat is guaranteed. The program's terms include a refund policy and a results disclaimer.

---

If you want a finance and audit committee seat judged on evidence rather than a finance title, SeatSignal matches you to open seats, prepares the director packet for that board, and rehearses you for the chair's questions. Start with your sector, committee interest and independence position, then let the placement team test the fit before you apply. Visit SeatSignal to see how the program works.