Audit Committee Responsibilities (2024)

US-EN Location: United States-English
Contact us

Audit Committee Guide:

Audit committee oversight responsibilities

Audit committee members have a critical role in overseeing many aspects of a company’s activities and performance. The audit committee has responsibility for overseeing financial reporting and related internal controls, risk, independent and internal auditors, and ethics and compliance.

The audit committee’s oversight responsibilities are described in rules of the Securities and Exchange Commission (SEC) and the exchanges on which a company’s shares are listed, notably the New York Stock Exchange (NYSE) and Nasdaq. Responsibilities may also fall to the audit committee indirectly resulting from requirements for independent auditors imposed by the Public Company Accounting Oversight Board (PCAOB). SEC, NYSE, Nasdaq, and PCAOB rules are highlighted throughout, where relevant. Common practices, tools, and resources to assist audit committee members in executing their responsibilities are highlighted throughout as well.

Increasingly, additional responsibilities are also falling to the audit committee, including cybersecurity and environmental, social, and governance (ESG) reporting. According to the Audit Committee Practices Report, a survey conducted by Deloitte and the Center for Audit Quality finds audit committees are being challenged by increased complexity in their core responsibilities as well as scope creep across other areas within their organizations.

Financial reporting

The audit committee, management (including the internal auditor), and the independent auditor each have a distinct role in financial reporting. Management is responsible for preparing the financial statements, establishing and maintaining adequate internal control over financial reporting (ICFR) as well as disclosure controls and procedures (DCPs) for items disclosed in Exchange Act reports, and evaluating the effectiveness of ICFR. The independent auditor is responsible for expressing an opinion on whether the financial statements fairly present, in all material respects, the financial position, results of operations, and cash flows in conformity with generally accepted accounting principles (GAAP), and, when applicable, evaluating the effectiveness of ICFR. In companies that have internal auditors, they have a role in providing objective assurance while acting as advisers to management.

The audit committee is responsible for overseeing the financial reporting process. To do so effectively, committee members should be familiar with the processes and controls that management has established and determine whether they are designed and operating effectively. In carrying out its role of oversight and monitoring, including obtaining the knowledge needed to provide appropriate oversight, the committee may rely on management, the independent auditor, the internal auditor (if any), and any advisers the committee might engage, provided its reliance is reasonable.

Audit committees should understand risk areas and related internal controls. Attention can be focused on a few important areas to remain vigilant in overseeing this, including:

Complex accounting and reporting areas and how management addresses them
Significant accounting policies, judgments, management estimates, and their impact on the financial statements
Any prior internal control issues and how they have been resolved
The design and components of the company’s antifraud and anticorruption compliance programs to confirm that those programs have sufficient oversight, autonomy, and resources
The company’s strategy for managing tax risk, tax controversy, and volatility in the effective tax rate and to consider potential reputational risks associated with tax positions
Uncertain tax positions taken by the company and their potential impact on financial reporting
Pending financial reporting and regulatory developments, with a focus on understanding how they may affect the company

NYSE requirements

NYSE listing standards require the audit committee to review major issues regarding accounting principles and the presentation of the financial statements.

Learn more

Nasdaq requirements

The Nasdaq listing standards approach is more general, requiring the audit committee to oversee the accounting and financial reporting processes of the company and audits of the financial statements.

Learn more

Nasdaq requirements

The Nasdaq listing standards approach is more general, requiring the audit committee to oversee the accounting and financial reporting processes of the company and audits of the financial statements.

Learn more

${column4-title}

${column4-text}

${column4-button-text}

Review of filings and earnings releases

The audit committee generally reviews earnings releases, SEC filings containing financial information, and other financial information and earnings guidance provided to analysts, rating agencies, and others. NYSE listing standards require that the audit committee meet to discuss the company’s annual audited financial statements and quarterly financial statements with management and the independent auditor. Nasdaq requirements are similar.

The standards require the audit committee to address the committee’s responsibility to discuss earnings press releases and the financial information and guidance provided to analysts and ratings agencies. This discussion may be in general terms, and the audit committee may discuss the types of information disclosed and presentations made. The discussion should highlight pro forma or adjusted non-GAAP financial information.

SEC rules regarding the use of non-GAAP financial measures require, among other things, that disclosure of any material information containing non-GAAP financial measures must include the most directly comparable GAAP financial measures, that the GAAP measures must be disclosed with equal or greater prominence, and that GAAP and non-GAAP measures must be reconciled. The SEC scrutinizes the use of non-GAAP measures in response to concerns about their use and prominence. As a result, companies and audit committees should consider examining their use of non-GAAP measures and related controls as well as the disclosure of those measures. Deloitte’s publication A Roadmap to Non-GAAP Financial Measures provides additional information, including ways for a company to assess the appropriateness of its non-GAAP measures and control considerations.

The committee should consider how it will execute these responsibilities to satisfy itself that all information is presented fairly and transparently. This should include a focus on consistency of information, tone, and messaging across all communications.

The audit committee should confirm that an appropriate legal review has been completed to verify disclosures are reasonable, including any obligation to report on known trends and uncertainties. This review should also consider compliance with the company’s policies on forward-looking statements and the completeness of any related disclaimers.

Audit committees should also ask questions about the issues raised in SEC comment letters received by the company and management’s response, and it should consider the nature of SEC comment letters issued to companies in similar industries.

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordionone'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "Review of filings and earnings releases: Questions to consider", itemText: "

How have changes in the business impacted accounting and disclosures, including estimates and judgments?
Where management has accounted for an estimate from a range of possibilities, why did management select the point in the range? If management selected another point in the range, how would that impact the financial statements?
Did the company record all known misstatements? If not, how did management consider materiality, as well as the control impact, of the misstatements?
If the company issues earnings guidance, how confident is management in its ability to forecast earnings accurately? Is the disclosure of a range of earnings estimates preferable to a specific target, and has management considered seeking input directly from shareholders regarding the types of forward-looking information they would find meaningful?
What DCPs are in place related to the disclosure of non-GAAP measures?
Is the non-GAAP measure prepared consistently from period to period in accordance with a defined policy, and is it comparable to that of the company’s peers? Is the measure balanced? For example, does it adjust not only for nonrecurring expenses but also for nonrecurring gains?
How clear is the audit committee’s understanding of how non-GAAP measures impact compensation? To what extent are the audit and compensation committees aligned on this?

", itemImage: "${item-1-image}", itemImageRight: "${item-1-image-right}", itemMoreText: "${item-1-read-more-text}", itemMoreURL: "${item-1-read-more-url}", itemVideoURL: "${item-1-video-url}", itemInfographicUrl: "${item-1-infographic-url}" }; //Item 2 daccordItems[1] = { itemOpen: "${item-2-open}", itemTitle: "${item-2-title}", itemText: "${item-2-text}", itemImage: "${item-2-image}", itemImageRight: "${item-2-image-right}", itemMoreText: "${item-2-read-more-text}", itemMoreURL: "${item-2-read-more-url}", itemVideoURL: "${item-2-video-url}", itemInfographicUrl: "${item-2-infographic-url}" } //Item 3 daccordItems[2] = { itemOpen: "${item-3-open}", itemTitle: "${item-3-title}", itemText: "${item-3-text}", itemImage: "${item-3-image}", itemImageRight: "${item-3-image-right}", itemMoreText: "${item-3-read-more-text}", itemMoreURL: "${item-3-read-more-url}", itemVideoURL: "${item-3-video-url}", itemInfographicUrl: "${item-3-infographic-url}" }; //Item 4 daccordItems[3] = { itemOpen: "${item-4-open}", itemTitle: "${item-4-title}", itemText: "${item-4-text}", itemImage: "${item-4-image}", itemImageRight: "${item-4-image-right}", itemMoreText: "${item-4-read-more-text}", itemMoreURL: "${item-4-read-more-url}", itemVideoURL: "${item-4-video-url}", itemInfographicUrl: "${item-4-infographic-url}" }; //Item 5 daccordItems[4] = { itemOpen: "${item-5-open}", itemTitle: "${item-5-title}", itemText: "${item-5-text}", itemImage: "${item-5-image}", itemImageRight: "${item-5-image-right}", itemMoreText: "${item-5-read-more-text}", itemMoreURL: "${item-5-read-more-url}", itemVideoURL: "${item-5-video-url}", itemInfographicUrl: "${item-5-infographic-url}" }; //Item 6 daccordItems[5] = { itemOpen: "${item-6-open}", itemTitle: "${item-6-title}", itemText: "${item-6-text}", itemImage: "${item-6-image}", itemImageRight: "${item-6-image-right}", itemMoreText: "${item-6-read-more-text}", itemMoreURL: "${item-6-read-more-url}", itemVideoURL: "${item-6-video-url}", itemInfographicUrl: "${item-6-infographic-url}" }; //Item 7 daccordItems[6] = { itemOpen: "${item-7-open}", itemTitle: "${item-7-title}", itemText: "${item-7-text}", itemImage: "${item-7-image}", itemImageRight: "${item-7-image-right}", itemMoreText: "${item-7-read-more-text}", itemMoreURL: "${item-7-read-more-url}", itemVideoURL: "${item-7-video-url}", itemInfographicUrl: "${item-7-infographic-url}" }; //Item 8 daccordItems[7] = { itemOpen: "${item-8-open}", itemTitle: "${item-8-title}", itemText: "${item-8-text}", itemImage: "${item-8-image}", itemImageRight: "${item-8-image-right}", itemMoreText: "${item-8-read-more-text}", itemMoreURL: "${item-8-read-more-url}", itemVideoURL: "${item-8-video-url}", itemInfographicUrl: "${item-8-infographic-url}" }; //Item 9 daccordItems[8] = { itemOpen: "${item-9-open}", itemTitle: "${item-9-title}", itemText: "${item-9-text}", itemImage: "${item-9-image}", itemImageRight: "${item-9-image-right}", itemMoreText: "${item-9-read-more-text}", itemMoreURL: "${item-9-read-more-url}", itemVideoURL: "${item-9-video-url}", itemInfographicUrl: "${item-9-infographic-url}" }; //Item 10 daccordItems[9] = { itemOpen: "${item-10-open}", itemTitle: "${item-10-title}", itemText: "${item-10-text}", itemImage: "${item-10-image}", itemImageRight: "${item-10-image-right}", itemMoreText: "${item-10-read-more-text}", itemMoreURL: "${item-10-read-more-url}", itemVideoURL: "${item-10-video-url}", itemInfographicUrl: "${item-10-infographic-url}" }; daccordItems = $.fn.daccordScrubData(daccordItems,properties); //render html within fragID for (i = 0; i < properties.numberOfItems; i++) { //add html var html = dcomAccordionItemTemplate(daccordItems[i]); $(accordionID).append(html); //add youtube vids if present if (daccordItems[i].itemVideoURL) { //check if one trust group 4 is enabled || if one trust isnt active display anyway if ((typeof OnetrustActiveGroups === 'undefined') || (OnetrustActiveGroups.indexOf(",4,") >= 0)) { $(accordionID + ' #' + properties.fragId + 'collapse' + daccordItems[i].itemNum + 'vid').player({ video: daccordItems[i].itemVideoURL, playerVars: { controls: 2, modestbranding: 0, rel: 0, color: 'white', showinfo: 0, theme: 'dark', autoplay: 0 }, events: { end: daccordVidEnd, play: daccordVidStart, pause: daccordVidStop } }); //show container ({{fragId}}collapse{{itemNum}}vid-cont) $(accordionID + ' #' + properties.fragId + 'collapse' + daccordItems[i].itemNum + 'vid-cont').show(); //hide fallback ({{fragId}}collapse{{itemNum}}vid-fallback) $(accordionID + ' #' + properties.fragId + 'collapse' + daccordItems[i].itemNum + 'vid-fallback').hide(); } } } //set open states if (properties.openItem > -1) { daccordSelected = (properties.openItem - 1); //set item index (minus 1) $(accordionID +' .daccord-collapse').eq(daccordSelected).slideToggle( daccordSpeed ); if (!properties.expandCollapseAll) { $(accordionID +' .daccord-header').eq(daccordSelected).toggleClass('daccord-header-open'); } else { $(accordionID +' .daccord-header').eq(daccordSelected).toggleClass('daccord-header-icon'); } } //set css options within fragID var css = accordionID + ' .daccord-header a {background-color: ' + properties.titlebarBackgroundColor + ' }'; css += accordionID + ' .daccord-header a {color: ' + properties.titlebarFontColor + ' }'; css += accordionID + ' .daccord-header-icon a { background-color: ' + properties.titlebarActiveBackgroundColor + ' }'; css += accordionID + ' .daccord-header-open a { background-color: ' + properties.titlebarActiveBackgroundColor + ' }'; css += accordionID + ' .daccord-header .daccord-header-bar-icon:after { color: ' + properties.titlebarBackgroundColor + ' }'; css += accordionID + ' .daccord-header-icon .daccord-header-bar-icon:after { color: ' + properties.titlebarActiveBackgroundColor + ' }'; css += accordionID + ' .daccord-header-open .daccord-header-bar-icon:after { color: ' + properties.titlebarActiveBackgroundColor + ' }'; $('head').append('

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordionone' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordionone"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Internal control over financial reporting

ICFR is intended to provide reasonable assurance that policies, processes, and procedures governing financial reporting help produce reliable and effective reporting and promote compliance with relevant reporting obligations. While management is responsible for designing, implementing, operating, and maintaining ICFR, the audit committee is responsible for overseeing the system of internal controls and confirming that management has an adequate and well-functioning system of controls. As part of its oversight responsibilities, the audit committee also plays an important role in promoting a culture of behavior that enables reliable and timely reporting.

Audit committees should have periodic interactions with management, the internal auditor, and the independent auditor to receive timely, accurate information regarding the functioning of internal controls. These reports should address the design and operating effectiveness of controls, ongoing monitoring activities, any failures or weaknesses in controls, root causes associated with these failures or weaknesses, and actions to remedy them. Audit committees should also understand the role of outside service providers, such as outsourced payroll, data centers, and others, that have a role in a company’s ICFR.

COSO framework

The 2013 Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission(COSO) provides a formal structure for designing and evaluating the effectiveness of internal controls. The SECrequires companies to use a “suitable framework” for management reporting on ICFR, and it says the COSO framework “satisfies our criteria and maybe used as an evaluation framework for purposes of management's annual internal control evaluation and disclosurerequirements.” The framework emphasizes the role of the board—and, by delegation or regulation, the role of theaudit committee—in overseeing internal control, which remains an essential aspect of effective governance. Theframework highlights:

The board’s role in the control environment, including clarification of expectations for integrity and ethics, conflicts of interest, adherence to codes of conduct, and other matters
The board’s assessment of the risk that management could override internal controls and careful consideration of the possibility that management may override such controls
The establishment and maintenance of open lines of communication between management and the board and the provision of separate lines of communication, such as whistleblower hotlines

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordiontwo'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "Internal control over financial reporting: Questions to consider", itemText: "

What is the committee’s level of understanding with respect to key risks and related controls identified by management, the independent auditor, and internal audit?
To what extent does the company rely on third-party service providers, and how are controls and processes over these relationships and data flows managed?
Have there been any changes in the design and monitoring of controls? How has management ensured that controls have been appropriately redesigned?
What new internal controls should be considered if there are shifts in the business operating model, such as a shift to more remote work?
How well resourced is the company to adequately perform internal control activities? Has the company engaged specialists, where applicable, in evaluating controls over complex or IT-dependent processes?
Has management defined and implemented remediation plans for deficiencies? If those remediation plans span a specific time frame, have temporary compensating controls been implemented to mitigate risk? How is management held accountable for timely remediation?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordiontwo' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordiontwo"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Related-party transactions

NYSE and Nasdaq listing standards require that an independent body of the board review and oversee related-party transactions. In some instances, this responsibility is assigned to the audit committee. Examples of related-party transactions include transactions between the company and a business affiliated with a director or members of a director’s immediate family. Transactions might also occur between an entity and trusts for the benefit of employees, such as pension or profit-sharing trusts that are managed by or under the trusteeship of the entity’s management.

While these types of transactions often occur in the normal course of business, transactions among related parties are sometimes associated with the risk of misstatement or omission in financial reporting, whether by error or fraud. Auditors are required to scrutinize related-party transactions that may pose an increased risk of fraud. These include transactions involving directors, executives, and their families; significant unusual transactions that are outside the normal course of business; and other financial relationships with the company’s executive officers and directors. Audit committees must be alert to these transactions as part of their oversight responsibilities.

Expand all

Collapse All

Proxy disclosures

Various SEC rules and exchange listing requirements address audit- and audit-committee-related information that must be disclosed in the proxy statement, including the audit committee report, and on company websites. SEC rules require companies to disclose the name of each audit committee member and include an audit committee report in the proxy statement. In the report, the audit committee must state whether it has:

Reviewed and discussed the audited financial statements with management
Discussed with the independent auditor all matters required under applicable auditing standards
Received required independence disclosures from the independent auditor
Recommended to the board that the audited financial statements be included in the company’s annual report on Form 10-K

Each issuer is required to disclose in any proxy or information statement pertaining to the election of directors whether the issuer has a standing audit committee, the number of audit committee meetings held during the last fiscal year, and the functions performed by the committee. The proxy statement must also disclose whether the board has adopted a written charter for the audit committee, and if so, include a copy of the charter as an appendix to the proxy statement at least once every three years. Alternatively, the company may post a copy of the charter on its website or reference the availability of the charter on the website by including a link; most companies fulfill this requirement in this fashion.

Companies whose securities are listed on the NYSE or quoted on Nasdaq must disclose whether the audit committee members are independent as defined in the applicable listing standards.

Beyond required disclosures, investors, policymakers, and regulators have shown interest in more detailed disclosure about audit committees, their activities, and their oversight of the relationship with the independent auditor. As these external parties request additional clarification about the related roles and responsibilities, audit committees should consider whether they should enhance disclosures in the proxy statement to take credit for the work they do. The Center for Audit Quality annually publishes an Audit Committee Transparency Barometer to highlight observations from disclosures of audit committee oversight in proxy statements.

In addition to voluntary disclosures, regulators may, in some instances, solicit views of audit committees with respect to industry- and company-specific knowledge and experience. Taking the time to engage in formal or informal communication with regulators, industry groups, and independent auditors on these topics could have a substantive impact on the development of standards and rules.

Fee disclosures

SEC rules require the disclosure of fees paid to the independent auditor for the current and prior years as well as a description of the services included in all categories other than audit fees for both years. (The audit committee’s duties in this area are further described in oversight of the independent auditor.) The audit committee’s preapproval policies and procedures must be described or reproduced. Such disclosures are required in the issuer’s Form 10-K as well as the proxy statement, but companies are allowed to incorporate the information into their Form 10-K from their proxy statement.

The disclosure is also required to include the percentage of services in the audit-related fees, tax fees, and all other fee captions that were approved by the audit committee pursuant to its preapproval policies and procedures. Many companies have opted to provide even more information. For instance, many companies subtotal the audit and audit-related fees so shareholders can easily quantify the portion of services that are audit and audit-related in nature.

Because certain institutional investors and proxy advisers have guidelines for proxy vote recommendations related to audit fees, many companies disclose not only the nature of services in the fee categories but also the amounts associated with specific services (for example, in the tax fee category, specifically noting the amount of tax compliance and preparation fees). Issuers should consult with legal counsel to determine the content of the fee disclosure. The SEC’s four fee categories are:

Audit fees

This includes fees for services that normally would be provided in connection with statutory and regulatory filings or engagements, including the audit of internal control over financial reporting.

Learn more

Audit-related fees

This includes fees for assurance and related services that are performed by the independent auditor.

Learn more

Tax fees

This includes fees for all tax services except those related to the audit, such as the review of the tax provision, which would be included in audit fees.

Learn more

All other fees

This includes all fees paid to the independent auditor for services other than audit, audit-related, or tax.

Learn more

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordionfour'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "Proxy disclosures: Questions to consider", itemText: "

How effectively does the proxy statement describe for investors and other stakeholders the audit committee’s oversight responsibilities?
How has the role of the audit committee evolved to include areas such as cyber, ESG, enterprise risk management, or others, and how are these changes being disclosed to stakeholders in the proxy statement?
To what extent are the qualifications, experiences, and diversity considerations of audit committee members disclosed?
How does the audit committee describe in the company’s proxy statement the committee’s oversight of and engagement with the independent auditor?
To what extent does disclosure address issues such as auditor independence, auditor performance, and other matters of interest to investors?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordionfour' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordionfour"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Risk

The SEC considers risk oversight a major responsibility of the board and requires disclosure of its role in this area. Disclosures include whether the entire board is involved in risk oversight, whether certain aspects are executed by individual board committees, and whether the employees responsible for risk management report directly to the board. Such disclosures inform shareholders’ understanding of the board’s process for overseeing risk.

In some instances, the audit committee may be delegated broad oversight responsibility for risk by the board. The audit committee’s primary risk oversight responsibilities are focused on the company’s financial risks, enterprise risk management (ERM), and risks related to ethics and compliance. At companies with risk committees, such as large financial institutions that are required to have such committees under the Dodd-Frank Act, the audit committee’s oversight responsibilities with respect to risk may differ.

In many companies, the audit committee’s risk oversight role has evolved to include additional responsibilities in areas such as cyber, mergers and acquisitions (M&A), and to varying degrees, ESG matters, among others.

With respect to financial risk, the audit committees should understand the company’s major financial risk exposures and how management monitors and controls such exposures. The committee can also ask business leaders to periodically provide an overview of their respective businesses, focusing on financial risks and other factors that may impact the financial statements.

Enterprise risk management

The board should prioritize having a well-defined, effective risk oversight function and should clearly define which risks the full board should discuss regularly versus those that can be delegated primarily to a board committee. Boards may have a defined risk governance structure in place, which should be assessed periodically as risks shift or new risks emerge, and consideration should be given to whether committee charters should be updated to align with the defined risk governance structures. The board or the committee tasked with overseeing the enterprise risk program should periodically review the company’s top risks with an eye on which board committee and member of management is responsible for each.

NYSE listing standards indicate the audit committee must discuss guidelines and policies to govern the process by which management assesses and manages the company's exposure to risk. This includes discussing the company’s major financial risk exposures and the steps management has taken to monitor and control such exposures. The standards acknowledge that many companies manage and assess their risk through mechanisms other than the audit committee and that audit committees should review these processes in a general manner.

Many companies leverage COSO’s ERM framework, which promotes a principles-based approach to ERM by helping focus a program on five interrelated components of effective control: governance and culture; strategy and objective-setting; performance; review and revision; and information, communication, and reporting.

A common practice is for management to maintain a list of all enterprise-wide risks, which are then mapped to specific board committees with the expertise to oversee them as well as the respective risk owners in management. In many instances, the full board takes direct responsibility for and regularly discusses the company’s most strategic risks, which include risks that could disrupt and materially impact the company’s business strategy. While it may be appropriate for the audit committee to review the guidelines, processes, and policies management has in place to assess and manage risk, boards should take care not to overburden the audit committee with risk oversight responsibilities.

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordionfive'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "ERM: Questions to consider", itemText: "

To what extent do the board and its committees agree on where primary responsibility lies for overseeing the ERM program and related processes?
How clearly are oversight responsibilities for key risks delegated to the board and individual committees? How frequently is this delineation of responsibilities reassessed? How clearly is responsibility for key risks assigned to management, and does each risk have a member of management noted as the risk owner?
How often is ERM on the audit committee’s agenda, if appropriate, and what information is being provided in support of this? How does the audit committee confirm that new or emerging risks are considered and that board oversight responsibility is clearly defined?
How does internal audit’s plan align with the key risks identified in the ERM program?
How are management and internal audit staying ahead of emerging and evolving risk areas such as technology, cyber, and ESG?
How is management considering unlikely but potentially severe risks that could have a significant detrimental effect on the organization?
How are risks to the extended enterprise, including third-party risks, assessed?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordionfive' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordionfive"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Fraud risk

The audit committee should be satisfied that the company has programs and policies in place to deter and detect fraud. The committee should work with management to oversee the establishment of appropriate antifraud controls and programs and to take appropriate steps when fraud is detected.

The audit committee should also be satisfied that the organization has implemented an appropriate ethics and compliance program and established a reporting hotline. See codes of ethics and conduct and hotlines for more information.

Audit committee members should be aware of three main areas of fraud risk:

Financial statement fraud, which includes intentional misstatements in or omissions from financial statements
Asset misappropriation, which may include check forgery, theft of money, inventory theft, payroll fraud, or theft of services
Corruption, which may include schemes such as kickbacks, shell companies, bribes to influence decision-makers, or manipulation of contracts

The audit committee can help oversee the prevention and detection of financial statement fraud by monitoring management’s assessment of ICFR. The audit committee should also be aware of the US Foreign Corrupt Practices Act (FCPA) and other non-US anticorruption laws that may be applicable, such as the UK Bribery Act. As the SEC and Department of Justice note in the Resource Guide to the FCPA, anticorruption compliance “begins with the board of directors and senior executives setting the proper tone for the rest of the company.” To that end, the audit committee should:

Understand the company’s obligations and responsibilities regarding anticorruption laws to which it is subject
Determine whether the company has dedicated appropriate oversight, autonomy, and resources to its anticorruption compliance program
Understand specific policies and procedures in place to identify and mitigate corruption-related risks
Discuss with management corruption-related risks that have been identified, including allegations of corruption that may have been received through the company’s monitoring and reporting mechanisms, as well as management’s plans for responding to such risks
Monitor any violations, including management’s response

Depending on a company’s size, the determination of whether the company has dedicated appropriate oversight, autonomy, and resources could include an evaluation of whether an individual is specifically charged with anticorruption compliance and has a direct reporting line to the committee.

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordionsix'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "Fraud risk: Questions to consider", itemText: "

At what levels within the organization are fraud risk assessments performed? For example, are assessments performed at the entity level, at significant locations or business units, on significant account balances, or at the major process level?
How do management and the board consider the risk of management override of controls?
How has management considered the potential for emerging fraud risks, and what has been the process for developing and assessing the appropriate internal controls?
How have shifts in the organization’s talent model and the associated job responsibilities affected whether there is an appropriate segregation of duties?
How does the company map or link identified fraud risks to control activities designed to mitigate the fraud risks?
To what extent has management designed and implemented preventive controls to stop fraud from occurring as well as detective controls to identify the fraud if it occurs?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordionsix' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordionsix"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Cyber risk

Rapid advancements in digital technology and interconnectivity have significantly escalated cyber risk, making it a high priority for management and boards at companies of all sizes and in all industries. The pervasiveness of cyber risk significantly increases concerns about financial information, internal controls, and a wide variety of risks, including reputational risks that can result from a cyber incident. Oversight of a successful cyber risk management program requires proactive engagement and is frequently the responsibility of the full board. In some organizations, a level of oversight may be delegated to the audit committee, or to a risk committee or technology committee, if either exists.

Cyber-related regulatory requirements that are relevant to audit committees are evolving. In early 2022, the SEC issued proposed requirements to enhance and standardize disclosure regarding cyber risk management, strategy, governance, and incident reporting by public companies. The amendments would require current reporting about material cyber incidents and periodic reporting to provide updates about previously reported cyber incidents. It would also require reporting about policies and procedures to identify and manage cyber risks, the company’s board oversight of cyber risk, management’s role and expertise in assessing and managing cyber risk, and the board’s cyber expertise, if any.

Until the final rules are issued, SEC guidance from 2018 presents the SEC’s view on how its existing rules should be interpreted in connection with cybersecurity threats and incidents. The guidance highlights earlier rules to expand on concepts and focus on cyber policies and controls, most notably those related to cyber escalation procedures and the application of insider trading prohibitions. The guidance also addresses the importance of avoiding selective disclosure and considers the role of the board of directors in risk oversight. The release applies to public operating companies, including foreign private issuers, but does not address the specific implications of cyber for other regulated entities under the federal securities laws, such as registered investment companies, investment advisers, brokers, dealers, exchanges, and self-regulatory organizations.

SEC guidance includes the SEC’s view on the role of the board in overseeing cyber risk. If the risk is material to a company’s business, the discussion of the board’s role in risk oversight should include the nature of its responsibilities for overseeing the management of this risk. In the guidance, the SEC says “disclosures regarding a company’s cyber risk management program and how the board of directors engages with management on cyber issues allow investors to assess how a board of directors is discharging its risk oversight responsibility in this increasingly important area.”

In companies where the audit committee holds some responsibility for cyber risk oversight, the committee should obtain a clear understanding of the specific areas it is expected to oversee. In the audit committee’s capacity of overseeing financial risks and monitoring management’s policies and procedures, it may have expertise and be asked to play a significant strategic role in monitoring management’s preparation for and response to cyber threats, coordinating cyber risk management initiatives and policies, and confirming their efficacy. Those audit committees may take the lead in overseeing cyber threat trends, regulatory developments, and major threats to the company. Other responsibilities may include setting expectations and accountability for management as well as assessing the adequacy of resources, funding, and focus on cyber risk management activities.

For audit committees charged with this oversight, engaging in regular dialogue with C-suite leaders responsible for information technology and security can help the committee determine where attention should be focused. Although cyber risk is frequently on the full board’s agenda, audit committees are increasingly receiving regular updates from relevant technology leaders, with technology risk-related topics appearing on almost every meeting agenda. The audit committee chair can be a particularly effective liaison with other groups in enforcing and communicating expectations regarding cyber and financial risk mitigation.

The AICPA’s cybersecurity risk management attestation reporting framework is a resource for expanding cyber risk reporting to help address the marketplace need for greater stakeholder transparency. This reporting framework establishes a standardized reporting mechanism for providing a broad range of users with useful information about an entity’s cyber risk management program to support informed and strategic decision-making. Leveraging a unified approach for performing and reporting on an entity’s cyber risk management program and related controls could help boards and audit committees effectively execute their oversight responsibilities with respect to cyber risk. See Deloitte’s cybersecurity risk management examination resources for more on cyber reporting and risk management.

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordionseven'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "Cyber risk: Questions to consider", itemText: "

Where does the primary oversight responsibility for cyber risk reside on the board? If responsibility is delegated to the audit committee, has the board considered calling this risk out specifically in the audit committee charter?
To what extent does management understand where its most sensitive information is kept and how it is stored, used, and protected?
To what extent do management and the board leverage cyber simulations to assess the effectiveness of the organization’s cyber response plan and make improvements?
How are cyber assessments conducted on the organization’s operational technology? Do assessments highlight the business impact of an operational technology breach?
How have cyberattacks escalated, and what controls have been reassessed as a result, including those related to an evolving talent model (for example, with a remote or hybrid workforce)?
How does the organization assess its cyber risk profile internally or externally to identify areas where digital finance transformation, ESG, and other new or quickly shifting requirements and initiatives may pose risks?
How do leadership, structure, capabilities, and resources support a comprehensive focus on cyber risks?
How effectively would an enterprise response plan and a ransomware playbook or checklist be implemented quickly if needed?
How proactive is management in identifying and complying with all the laws and regulations that govern data capture, use, retention, security, and disposal?
How has internal audit considered cyber risk in the development of the internal audit plan?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordionseven' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordionseven"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Mergers and acquisitions

The audit committee has an important role in M&A transactions, both before a transaction in overseeing due diligence and after a transaction in integrating controls and reporting. The audit committee should also review SEC reporting with respect to acquisitions and the accounting for acquisitions in financial statements.

Due diligence

Although due diligence is largely management’s responsibility, the audit committee can provide oversight in areas such as risk analysis, internal controls, and the basic financial information on which the terms are based.

Learn more

Post-merger integration

SEC rules require public companies to integrate disclosure controls as well as controls over financial reporting following a merger or acquisition.

Learn more

Nasdaq requirements

The Nasdaq listing standards approach is more general, requiring the audit committee to oversee the accounting and financial reporting processes of the company and audits of the financial statements.

Learn more

${column4-title}

${column4-text}

${column4-button-text}

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordioneight'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "Mergers and acquisitions: Questions to consider", itemText: "

How does the deal affect the future returns on equity and assets as well as the projected growth trajectory of the newly combined entity following the transaction?
How has the due diligence preceding a transaction considered risks and compliance associated with environmental, health, safety, legal, and regulatory standards that might affect financial statements of the combined new entity following the transaction?
How is management relying on qualified subject matter experts and other advisers as appropriate through the deal process?
To what extent has management adopted a post-merger plan for integrating the newly combined business units and processes?
To what extent has management considered the importance of the culture and the control environment as part of its integration plan?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordioneight' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordioneight"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Environmental, social, and governance

Rising focus on climate change, social justice, and shareholder activism in recent years has led to a greatly increased focus on ESG issues in corporate boardrooms. Regulation in these areas is evolving. The SEC issued a proposal in 2022 to require public companies to include extensive climate-related disclosures in their registration statements and periodic reports soon after it issued proposed cyber disclosure requirements. If finalized as proposed, these disclosures would include information about climate-related risks that are reasonably likely to have a material effect on the business, results of operations, or financial condition, as well as certain climate-related financial statement metrics in a note to audited financial statements. Under the proposed rule, certain filers would be required to include an attestation report from an independent attestation service provider covering certain emissions disclosures. This issue of Heads Up outlines the proposed requirements, which are intended to enhance and standardize climate disclosures.

Audit committees are increasingly engaging in the ESG agenda due to the growing reliance by investors and other stakeholders on ESG disclosures. Additionally, audit committees may have a growing role in overseeing ESG-related activities and metrics. While regulation might formalize the role of the audit committee in the ESG arena, audit committees should engage on whether appropriate internal controls and DCPs exist underlying the ESG information and metrics that companies disclose, whether the audit committee has reviewed disclosures, how management considers ESG strategies and their impact on financial statements, and whether the organization is obtaining assurance on its reporting.

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordionnine'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "ESG: Questions to consider", itemText: "

Where does the primary oversight responsibility for ESG reside on the board, both overall and in terms of its various components (for example, climate, diversity, talent, cyber)? Is there consistent understanding of where and when these elements are being discussed at the board and committee level?
How is the organization kept aware of developments in ESG legislation and regulations in relevant jurisdictions for the business?
How is management considering the organization’s environmental goals and related activities for SEC reporting purposes (for example, the business, risk factors, and results of operations sections in SEC filings)?
What climate-related information is currently gathered and reported? What level of assurance is currently obtained over this information? What additional information (if any) would need to be developed or gathered (including for disclosure in the audited financial statements)?
How does the company evaluate the materiality of climate-related disclosures? What systems and processes are in place for gathering the necessary information for determining whether such disclosures are material?
If the company issues a sustainability report, to what extent has the audit committee reviewed the report prior to issuing, and how has management walked through the key assumptions made and the basis for the metrics and goals disclosed?
If the organization discloses climate-related information in the annual report that contains or accompanies the financial statements, such as in the management discussion and analysis section, how consistent are those disclosures with the audited financial statements? What internal controls over financial reporting are in place to address the disclosure that would be required in the audited financial statements?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordionnine' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordionnine"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Audit

Oversight of the independent auditor, as well as the internal auditor at companies that have this function, is among the audit committee’s most important oversight responsibilities. Audit committees are responsible for overseeing the performance and quality of the audit as well as the independence of auditors.

Oversight of the independent auditor

Audit committees of listed companies are directly responsible for the appointment, compensation, and oversight of the independent auditor, including the resolution of any disagreements with management. The audit committee, management, the independent auditor, and the internal auditor should work together in a spirit of mutual respect and cooperation.

Audit committees are required to own the relationship with the independent auditor, focusing on qualifications, performance, independence, and compensation. Expectations should be clear regarding the nature and method of communication and the exchange of insights. An annual meeting with the independent auditor and regular dialogue beyond audit committee meetings can promote effective interaction.

The audit committee and the independent auditor typically meet at least quarterly to thoroughly discuss a wide variety of matters, including the company’s financial reporting, internal controls, and the audit, from planning to report issuance. Audit committees should proactively engage with the lead audit partner and meet periodically with specialists in areas such as tax, information technology, and others, as needed. These discussions should also include educational topics and sharing of insights beyond the audit. The audit committee can provide the independent auditor with formal evaluations and regular feedback.

The NYSE corporate governance rules require the audit committee to participate in periodic private sessions with management, independent auditors, and internal audit. Executive sessions with the independent auditor facilitate open communication and help to identify concerns. Although executive sessions are not explicitly required for Nasdaq-listed companies, it is common practice for audit committees to hold these sessions.

Auditor independence

SEC and PCAOB rules govern the independence of accountants who audit or review financial statements and prepare attestation reports filed with the SEC. The rules recognize the critical role of audit committees in financial reporting, their unique position in monitoring auditor independence, and their direct responsibility for the oversight of the independent auditor. Although most audit firms are rigorous in monitoring and enforcing these independence requirements, it is important that audit committee members be cognizant of them and understand that independence is a dual responsibility with the auditor. The SEC independence rules address the following issues related to registrants:

Auditor communications

The NYSE, Nasdaq, and PCAOB indicate communications that are required between the audit committee and the independent auditor. Many of these communications focus on the responsibility of the audit committee to oversee the independent auditor.

NYSE requirements

The audit committee is required to communicate with the independent auditor in several ways.

Learn more

Nasdaq requirements

Nasdaq listing standard requires the audit committees of listed companies to obtain a formal written statement from the independent auditor describing all relationships between the auditor and the company.

Learn more

PCAOB requirements

The PCAOB’s requirements encompass items the independent auditor is required to communicate to the audit committee as described in SEC Regulation S-X.

Learn more

${column4-title}

${column4-text}

${column4-button-text}

Evaluation of the independent auditor

Inherent in the audit committee’s duty to appoint, compensate, and oversee the independent auditor is an expectation that the audit committee will evaluate the auditor. The NYSE listing standards require the audit committee to review a report by the independent auditor describing its quality controls, results of investigations, and independence. After reviewing the report and the independent auditor’s work throughout the year, the audit committee is expected to be in a position to evaluate the auditor’s qualifications, performance, and independence. The evaluation is expected to include a review and evaluation of the lead partner of the independent auditor, considering the opinions of management and the company’s internal auditor or other personnel responsible for the internal audit function.

Evaluation factors

Practices for evaluating the independent auditor range from highly formalized processes with extensive documentation to more informal assessments. Factors the audit committee may consider in developing the evaluation process include:

Frequency and timing of the evaluation

Many audit committees performthe evaluation annually,immediately following theissuance of the Form 10-K and inconjunction with their decision toreappoint the independentauditor.

Learn more

Parties involved in the assessment

The SEC does notexplicitly require the auditcommittee to formally evaluatethe independent auditor.

Learn more

Form and nature of the assessment

Some independent auditorsprovide assessmentquestionnaires for evaluatingclient service.

Learn more

Assessment criteria

The criteria for evaluating the independent auditor vary. Audit committees may consider characteristics of the audit firm and the engagement team.

Learn more

The Center for Audit Quality has issued an External Auditor Assessment Tool for audit committees. The tool can be used by audit committees to inform their evaluation of the independent auditor.

Audit innovation

With advances in technology, many auditors are turning to innovation to enhance quality and add value to the audit. In understanding how the independent auditor is innovating, the audit committee may consider several issues, including how the independent auditor is leveraging innovation to enhance audit execution, what investments the independent auditor is making in audit innovation, and how those investments translate to enhanced audit quality and value for the company. Audit committees can ask auditors to explain what insights auditors are able to provide about the company and its financial and internal controls processes through the use of new technologies, including audit analytics.

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordionten'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "Oversight of the independent auditor: Questions to consider", itemText: "

Does the independent auditor have sufficient knowledge and experience to address the risks and types of transactions managed by the company, and are the auditor’s specialists engaged where applicable?
Does the independent auditor communicate to the committee in a clear, succinct, and timely manner? Is communication focused and prioritized on the right areas?
Is the committee engaging in an ongoing dialogue, both formal and informal, with the independent auditor to discuss topics beyond required communications? Does dialogue include, for example, perspectives on management and tone at the top, business trends, and the regulatory environment in financial reporting and standard setting?
In instances where the company’s needs are evolving, is the independent auditor also evolving with appropriate talent to serve the company?
How does the independent auditor evaluate the reasonableness of significant estimates made by management? How does the auditor challenge these estimates?
What top three areas did the independent auditor spend the most time discussing with management during the reporting period? How satisfied is the committee that management is cooperative and forthcoming with requested information and documentation in these areas and that management was able to produce the information requested?
Does the independent auditor use technology such as automation, data analytics, and machine learning to improve the effectiveness and efficiency of its audits?
Is the independent auditor delivering value and insights to management and the committee beyond the audit?
Does the committee meet separately with the independent auditor outside the presence of management? With individual members of management? With the internal auditor?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordionten' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordionten"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Oversight of internal auditors

Most public companies have an internal audit function, whether in-house, co-sourced, or outsourced. An internal audit function is not required by the SEC or Nasdaq, but it is required by NYSE listing standards. Whether a company staffs its own internal audit function or outsources it to a third party, audit committees are responsible for providing effective oversight.

NYSE requirements

NYSE listing standards require companies to have an internal audit function. Audit committees are required to oversee the internal audit function and to note this responsibility in their charters.

Learn more

Nasdaq requirements

Although Nasdaq companies are not required to have an internal audit function, for those that do, oversight of internal audit is often one component of overseeing accounting and financial reporting.

Learn more

Nasdaq requirements

The Nasdaq listing standards approach is more general, requiring the audit committee to oversee the accounting and financial reporting processes of the company and audits of the financial statements.

Learn more

${column4-title}

${column4-text}

${column4-button-text}

Expectations of internal audit functions have evolved dramatically over time, with internal audit often asked to offer an advisory perspective. The expectations for internal audit functions vary by organization but may include:

Objectively evaluating whether risks relating to the achievement of the company’s strategic objectives are appropriately identified and managed
Monitoring and reporting on the health of the company’s controls covering financial, operational, regulatory, reputational, technological, and governance risk, including offering guidance regarding the internal/compliance controls aligned with these risk areas
Evaluating whether results of operations or programs are consistent with established goals and objectives and acting as a catalyst for positive change in processes and controls
Providing insight in the areas of controls and risk management to assist in the audit committee’s assessment of the efficacy of programs and procedures
Coordinating activities and sharing perspectives with the independent auditor

An effective relationship between the audit committee and internal auditors is fundamental to the success of the internal audit function. Internal audit should have direct access to the audit committee, optimally with the chief audit executive (CAE) reporting directly to the audit committee and administratively to senior management. In this reporting structure, internal auditors can remain structurally separate from management, enhancing independence and objectivity. This also encourages the free flow of communication on issues and promotes direct feedback from the audit committee on the performance of the CAE. The audit committee should confirm that internal auditors have appropriate independence and stature and are visibly supported by senior management throughout the organization. The audit committee should support the CAE, providing guidance and assistance when the CAE reports potential management lapses.

The audit committee and the CAE should have a strong relationship characterized by regular and open communication. The audit committee should challenge the CAE and the internal audit department by setting high expectations, communicating those expectations clearly, and holding the department accountable for meeting them. Holding regular executive sessions with the CAE is common, and it is required for NYSE-listed companies. The audit committee should actively participate in discussing goals and evaluating the performance of the CAE. These responsibilities should not be delegated solely to the CEO or CFO.

It is important for the audit committee to assess whether internal audit’s priorities, such as monitoring critical controls and developing an audit plan focused on risks identified in the ERM program, are aligned with those of the audit committee. At some companies, internal audit evaluates and considers suggestions to improve operations and processes. The audit committee should play a role in helping determine the balance between compliance and operational audits, as appropriate.

The audit committee should understand and approve the internal audit plan and determine if the CAE has a sufficient budget and related resources to execute against it. As part of this review, the committee should evaluate the enterprisewide ERM program and the alignment of risks with the internal audit plan. The audit committee should also evaluate the progress and results of the internal audit plan against the original plans, the extent to which the plan benefits from emerging technology, and how it adapts to changes in risks.

The committee can perform annual evaluations of the CAE and understand internal audit staffing, funding, succession planning, and adequacy of resources. In determining adequacy of resources, audit committees often consider the structure (for example, whether the group is in-house, co-sourced, or outsourced), and whether the CAE and staff are adequately compensated. The committee can consider performing peer benchmarking of the company’s internal audit function to compare relevant metrics.

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordioneleven'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "Oversight of internal auditors: Questions to consider", itemText: "

How is the internal audit plan aligned to the primary risks of the organization and other assurance activities? To what extent are internal audit’s risk assessment processes linked to the company’s ERM activities?
How flexible and dynamic is internal audit in addressing new risks promptly and meeting the needs of the audit committee? How does the mix of experience and capabilities in the internal audit team—for example, in areas such as technology and emerging risks—meet the current needs of the company?
How effective is internal audit in using advanced technologies, such as data analytics, to improve audit quality?
How does internal audit organize or perform peer reviews or self-assessments and report the results to the audit committee?
How does the internal audit function comply with the International Standards for the Professional Practice of Internal Auditing as issued by the Institute of Internal Auditors?
To what extent does the internal audit function have and demonstrate the level of independence needed to execute its responsibilities properly? How does internal audit’s reporting structure within the company support independence and enable internal audit to perform effectively?
How timely does internal audit report issues and address them with management? How are issues identified and reported by internal audit highlighted for the audit committee? To what extent are they actionable, and how is the progress of remediation tracked and reported?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordioneleven' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordioneleven"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Ethics and compliance

The audit committee can promote a strong focus on tone at the top, maintaining a positive culture, and adherence to the company’s code of ethics, thus promoting a culture of compliance. The committee should meet periodically in executive sessions with those responsible for overseeing ethics and compliance matters and work with management to confirm that the company’s code of ethics or conduct complies with the applicable requirements. Companies may update the code in response to new issues or situations. Legal counsel should be consulted on modifications to the code.

Communication and training are critical to fostering an ethical culture. The code should be available to everyone in the organization, perhaps through inclusion on the company’s intranet site and in the employee orientation program and manual. Some companies require individuals, including directors, to sign an annual certification noting that they have read, understood, and complied with the code. If an employee refuses to sign the certification, committees should encourage companies to take prompt and appropriate disciplinary action, up to and including termination. Communication of disciplinary actions taken in response to code violations is a common way of communicating to employees that violations are taken seriously.

As part of its oversight of ethics and compliance, the committee should also pay close attention to the risk of management override of controls as well as risk mitigation mechanisms. In addition, the committee can prioritize initiating internal or independent investigations on matters within the committee’s scope of responsibility.

Codes of ethics and conduct

The SEC, NYSE, and Nasdaq require companies to have a code of ethics or a code of conduct. Each code of conduct must provide for prompt and consistent enforcement, protection for individuals who make good faith reports of questionable behavior, clear and objective standards for compliance, and a fair process for addressing violations. Both the NYSE and Nasdaq listing standards permit companies to have more than one code of conduct as long as all directors, officers, and employees are covered by a code. For example, some companies have developed a separate code for directors, whose roles and responsibilities differ from those of officers and other employees.

SEC requirements

The SEC requires registrants to disclose whether they have written codes of ethics that apply to their principal executive officers, principal financial officers, principal accounting officers or controllers, or individuals performing similar functions.

Learn more

NYSE requirements

NYSE listing standards require a code of conduct that covers not only senior financial officers but all employees. The websites of NYSE-listed companies must disclose the code of conduct applicable to employees, directors, and officers.

Learn more

Nasdaq requirements

Nasdaq listing standards require public disclosure of a code of conduct applicable to all employees, officers, and directors. Nasdaq’s criteria for the code of conduct are consistent with the SEC’s requirements.

Learn more

${column4-title}

${column4-text}

${column4-button-text}

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordion-twelve-q'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "Codes of ethics and conduct: Questions to consider", itemText: "

How does the reporting process keep the audit committee informed of ethics and compliance issues as well as the actions taken to address them? How regularly does the committee discuss ethics and compliance?
How frequently does the committee hear directly from the person who has day-to-day responsibility for ethics and compliance matters? To what extent does the committee consider holding these discussions in an executive session?
How systematically does the company scrutinize the sources of ethics and compliance failures and respond to them?
How does management act on reports? What evidence is captured regarding prompt, appropriate, and consistent disciplinary measures?
How does the audit committee engage external advisers to conduct independent investigations?
What ongoing monitoring and auditing processes are in place to assess the effectiveness of the ethics and compliance program?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordion-twelve-q' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordion-twelve-q"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Hotlines

A thorough, independent, and objective process should be established by management and the audit committee for investigating complaints related to ethics and compliance. SEC regulations and the NYSE and Nasdaq listing standards require the audit committees of listed companies to establish procedures for:

Receiving, retaining, and addressing complaints regarding accounting, internal controls, or auditing matters, whether from internal or external sources who wish to remain anonymous, as well as reporting a range of compliance matters, including violations of the code of conduct and allegations of management fraud or corruption
The confidential, anonymous submission of employee concerns regarding questionable accounting or auditing matters

Companies use various procedures, but the most common method of receiving tips from both inside and outside the organization is through a telephone and web-based hotline administered by an internal department or a third party. If the hotline is administered internally, operators should be trained on where to direct questions or complaints, including those related to human resources, with continuous coverage provided. An anonymous reporting option should be available. Telephone operators working in human resources, customer service, and investor relations should be prepared to answer questions on how to submit concerns and complaints regarding financial reporting.

Employees should be made aware of reporting channels and encouraged to report known or suspected violations of laws or company policy. This information can be included in the code of ethics, the employee handbook, human resources orientation, ethics training, and periodic communications. Instructions for submitting questions or complaints can be posted in company facilities and on intranet sites. The company’s public website is a natural vehicle for communicating ethics and compliance procedures to individuals outside the organization.

The audit committee should work with management to confirm that the appropriate members of management are aware of questions or complaints received from internal sources and third parties, including vendors, through the various reporting methods available. Responsibility for investigating questions or concerns and reporting back to the audit committee often falls on individuals in the ethics and compliance, internal audit, legal, or risk management departments.

The audit committee should also establish expectations with respect to the type of complaints that will be reported to the committee and how complaints will be communicated. Some complaints may warrant immediate communication, such as those involving senior management, significant reputational issues, or significant dollar amounts. In addition to these immediate reporting situations, the audit committee should receive a regular summary of complaints with root-cause analyses, their resolution, and the steps taken to enhance internal controls and avoid similar violations in the future. Reporting can include trends, such as any increase in reports on a specific topic, department, or person. The audit committee should also determine which complaints warrant a discussion with the full board.

Under the SEC’s whistleblower programs, employees with knowledge of potential securities fraud who report original information to the government or a self-regulatory organization can receive 10% to 30% of monetary sanctions if the enforcement action results in fines of at least $1 million. Whistleblowers are not required to report issues first through internal company channels; however, those who do are still eligible for the reward if the company reports the problem to the government or if the whistleblower does so within 120 days of notifying the company.

Companies with operations in different countries should be careful to comply with those countries’ laws, as they may impose requirements, restrictions, and prohibitions different from those applicable in the United States.

Expand all

Collapse All

') $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').on('click',function () { if ( $(this).index() == 0) { //expand $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + ' .daccord-collapse').slideDown(daccordSpeed); $(accordionID +' .daccord-header').addClass('daccord-header-icon'); } if ( $(this).index() == 1) { //collapse $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + ' .daccord-collapse').slideUp(daccordSpeed); $(accordionID +' .daccord-header').removeClass('daccord-header-icon'); } }); } //if a valid var from url exists override open item setting. var daccordUrlVar = $.getUrlVar('accordionthirteen'); if ($.fn.daccordIsInt(daccordUrlVar)) { var urlInt = parseInt(daccordUrlVar); daccordUrlVar = urlInt; properties.openItem = daccordUrlVar; } //Build item object from AEM Vars var daccordItems = []; //Item 1 daccordItems[0] = { itemTitle: "Hotlines: Questions to consider", itemText: "

Does the committee understand how hotlines are evaluated, tested, and audited? To what extent do hotline processes and controls confirm that calls are received, recorded, and managed in a consistent, confidential, accurate, and timely manner?
Has the hotline and whistleblowing process been evaluated and benchmarked by an independent third-party expert or consultant?
Has the audit committee, directly or through the internal audit function, made an anonymous report to the whistleblower system alleging financial reporting fraud or other wrongdoing by senior management, to test the integrity of the flow of communications directly to the audit committee without management intervention?
Does the level of alleged or suspected fraud and other violations of organization policies reported through the whistleblower system or other channels suggest that the tone at the top or the tone communicated by management may need strengthening?
Are there regular companywide trainings and communications in place for employees to learn about code of ethics, hotlines, and whistleblower functions?

'); //set click events //accordions $(accordionID + ' .daccord-header').on('click',function() { var index = $(this).parent().prevAll().length; //stop (pause) all vids var daccordVidPlayers = $(accordionID + ' iframe.daccord-video'); $.each(daccordVidPlayers, function () { var daccordStopVid = YT.get($(this).attr('id')); daccordStopVid.pauseVideo(); }); if (!properties.expandCollapseAll) { //close open if (daccordSelected > -1) { $(accordionID + ' .daccord-collapse').eq(daccordSelected).slideUp(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).removeClass('daccord-header-icon'); } if (daccordSelected != index ) { //open selection - add selected state; daccordSelected = index; $(accordionID +' .daccord-collapse').eq(daccordSelected).slideDown(daccordSpeed); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-open'); $(accordionID +' .daccord-header').eq(daccordSelected).addClass('daccord-header-icon'); } else { daccordSelected = -1; } } else { //set selected if collapse all daccordSelected = index; $(accordionID +' .daccord-collapse').eq(index).slideToggle( daccordSpeed ); $(accordionID +' .daccord-header').eq(index).toggleClass('daccord-header-icon'); //check number of items open/closed and set ui //daccord-header-icon var daccordOpenItems = $(accordionID +' .daccord-header-icon').length; //expand if 0 if (daccordOpenItems == 0) { $(accordionID + '-controls .daccord-expandcollapse li').eq(0).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(1).hide(); } //collapse if all opens if (daccordOpenItems == properties.numberOfItems) { $(accordionID + '-controls .daccord-expandcollapse li').eq(1).show(); $(accordionID + '-controls .daccord-expandcollapse li').eq(0).hide(); } } }); //CTA analytics var elementClicked = false; $('#daccord-' + 'accordionthirteen' + " a.daccord-header-bar").click(function(e) { try { var FragType = "FRG-048"; var FragID = "accordionthirteen"; var ActionType = "click"; var ctaText = e.currentTarget.textContent.replace(/\s+/g, '-'); s.linkTrackVars = "prop1,prop2,prop3,prop4,prop5,eVar72"; s.eVar72 = PubID+FragType+":"+ActionType+":"+ctaText+":"+FragID; s.eVar72 = s.eVar72.toLowerCase(); s.prop1 = sc_country; s.prop2 = sc_language; s.prop3 = sc_country + ";" + sc_language; if(elementClicked != true) { s.linkTrackEvents = "event71,event72,event23"; s.events = "event71,event72,event23"; elementClicked = true; } else { s.linkTrackEvents = "event71,event23"; s.events = "event71,event23"; } s.tl(this, "o", s.eVar72); } catch(error) { console.error(error); console.log('analytics suite unavailable?'); } }); // hide html frag title/description var hideFragTitleDesc = "${hide-title-description}"; if (hideFragTitleDesc == "title") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } else if (hideFragTitleDesc == "description") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); } else if (hideFragTitleDesc == "yes" || hideFragTitleDesc == "true" || hideFragTitleDesc == "both") { $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").siblings("p").remove(); $(accordionID).closest(".htmlfragment").find("h3.secondary-headline").remove(); } // add top padding back for topic pages var templateType = dataLayer.page.attributes.pageTemplate; if (templateType == "Deloitte_Full_Topic_Page") { $(accordionID).closest(".standard-white-component").css("padding-top","20px"); } }; daccord(); });

Audit Committee Guide

Whether you’re a new member of an audit committee or a seasoned veteran, our Audit Committee Guide oﬀers practical considerations and resources to help you fulﬁll your responsibilities.

${unordered-list}

${second-image-title-copy}

Download the full guide

Questions for audit committees to consider

Throughout the sections available on this site, you’ll ﬁnd questions committee members can consider asking related to speciﬁc requirements, responsibilities, and eﬀectiveness. For your ease, all questions are included in this downloadable PDF.

${unordered-list}

${second-image-title-copy}

Download the questions

Krista Parsons

Managing Director, Audit Committee Program Leader

Center for Board Effectiveness

Deloitte & Touche LLP

kparsons@deloitte.com

+1 646 912 4381

Carey Oven

National Managing Partner

Center for Board Effectiveness

Deloitte & Touche LLP

coven@deloitte.com

+1 313 919 5865

Maureen Bujno

Managing Director, Audit & Assurance Governance

Leader

Center for Board Effectiveness

Deloitte & Touche LLP

mbujno@deloitte.com

+1 917 301 6036

Paul Wellener

US Industrial Products & Construction Leader

pwellener@deloitte.com

+1 216 830 6609 | LinkedIn

${fifth-leader-name}

${fifth-leader-title}

${fifth-leader-email}

${fifth-leader-additional-info}

Modal fragment - Do not delete. This box/component contains code that is needed on this page. This message will not be visible when page is activated.

Insert Custom HTML fragment. Do not delete! This box/component contains code that is needed on this page. This message will not be visible when page is activated.
+++ DO NOT USE THIS FRAGMENT WITHOUT EXPLICIT APPROVAL FROM THE CREATIVE STUDIO DEVELOPMENT TEAM +++

FAQs

What are the responsibilities of the audit committee? ›

The role of the audit committee is to support council in fulfilling its governance and oversight responsibilities in relation to financial reporting, internal control structure, risk management systems, internal and external audit functions and ethical accountability.

Learn More ›

Which of the following are the activities and responsibilities of the audit committee? ›

This function, directed by a general auditor, is responsible for assessing the adequacy and effectiveness of the controls over (1) financial reporting, (2) efficiency and effectiveness of operations, and (3) compliance with laws and regulations.

What are the disadvantages of an audit committee? ›

Disadvantages of Committee

Executive directors may perceive it as a threat to their authority.
Finding non executive directors with appropriate expertise may be difficult.
Additional costs will be involved.
Too much detail may be thrust upon non executive directors.

Find Out More ›

Which of the following are responsibilities of the audit committee? ›

Audit Committee Responsibilities

Financial Auditing Reporting. ...
Internal Control and Risk Management. ...
Compliance and Regulatory Matters. ...
Whistleblower and Ethics Programs.

May 30, 2023

Know More ›

Who reports directly to the audit committee? ›

The audit committee is responsible for the appointment, compensation and oversight of the work of the auditor. As such, CPAs report directly to the audit committee, not management.

Who sits on an audit committee? ›

These may include the finance director, company secretary, external auditor and head of internal audit.

Learn More ›

What are the responsibilities of the audit? ›

The auditor's objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor's report that includes the auditor's opinion.

Discover More Details ›

Which of the following is the responsibility of an audit committee quizlet? ›

Audit committees are often considered the most important board committee, with the responsibility to mitigate the risk of corporate theft and financial statement fraud through oversight of internal controls and financial disclosures.

Get More Info Here ›

What are the duties and responsibilities of the audit committee of the cooperative? ›

The audit committee is responsible for assisting the board's oversight of the integrity of the company's financial statements, the performance of the company's internal audit function and the company's compliance with legal and regulatory requirements.

Show Me More ›