Audit Committee Charter: Rule 10A-3, Independence, and Oversight

The requirements for an audit committee charter come from three layers of rules working together: Section 301 of the Sarbanes-Oxley Act, SEC Rule 10A-3, and the listing standards of the exchange where the company trades. Every U.S. public company must have a written charter that satisfies all three. At the federal floor, the charter must guarantee committee independence, direct oversight of the external auditor, whistleblower procedures, and the committee’s authority to engage advisors at company expense. On top of that, NYSE Section 303A.07 and NASDAQ Rule 5605(c) prescribe additional duties the charter must address by its text, not just in practice.¹

The Federal Floor Under Rule 10A-3

Section 301 of Sarbanes-Oxley, codified at 15 U.S.C. § 78j-1(m), directed the SEC to bar exchanges from listing any company whose audit committee falls short of specific structural standards.² Rule 10A-3 implements that directive and sets the non-negotiable core the charter must contain:

Every committee member must be independent.
The committee, not management, is directly responsible for appointing, compensating, and overseeing the external auditor, and the auditor reports to the committee.
The committee must have procedures for receiving and handling complaints about accounting, internal controls, and auditing matters, including a confidential and anonymous employee channel.
The committee must have authority to engage outside counsel and advisors.
The company must provide appropriate funding for the auditor, for any advisors the committee hires, and for the committee’s ordinary administrative expenses.³

A charter that fails to reflect any of these provisions puts the company’s listing at risk and exposes it to SEC cease-and-desist proceedings under Section 21C of the Exchange Act, which can result in orders to stop the conduct, disgorgement, and civil penalties.⁴

Independence for Every Member

Under Rule 10A-3, an independent member is one who accepts no consulting, advisory, or other compensatory fee from the company or its subsidiaries beyond board and committee compensation, and who is not an affiliated person of the company. Retirement plan payments for past service are generally allowed if they are not contingent on continued board service.³

The charter needs to state this standard clearly and treat it as an ongoing obligation. A member who accepts a consulting engagement with a subsidiary mid-term becomes disqualified the moment that fee is paid. A charter that treats independence as a one-time confirmation at appointment leaves the committee without a mechanism to catch changes in circumstances.

Foreign private issuers get some flexibility. Rule 10A-3 exempts companies that maintain a board of auditors or statutory auditors under home-country law if that body meets certain structural independence conditions. Domestic issuers do not have that option.

The Financial Expert Disclosure

Federal law requires the company to disclose whether at least one member of the audit committee qualifies as a financial expert, and, if not, to explain why not.⁵ Regulation S-K sets out what “financial expert” means. The person must have an understanding of GAAP and financial statements; the ability to assess how accounting principles apply to estimates, accruals, and reserves; experience preparing, auditing, analyzing, or evaluating financial statements comparable in complexity to the company’s own, or supervising someone who does; familiarity with internal control over financial reporting; and an understanding of audit committee functions. These attributes can come from work as a principal financial officer, controller, public accountant, or auditor, or from supervising someone in those roles.⁶

Because the disclosure is required either way, the charter should identify this requirement so the nominating process screens candidates against these criteria before the board vote.

External Auditor Oversight and Pre-Approval

The charter must make clear that the audit committee, not management, appoints, compensates, and oversees the external auditor, and that the auditor reports directly to the committee.² The whole design of the audit committee structure rests on that reporting line.

The committee must also pre-approve every audit and non-audit service the external auditor performs for the company. Section 202 of Sarbanes-Oxley carves out one narrow exception: non-audit services that account for no more than 5 percent of the auditor’s total fees from the company, were not initially recognized as non-audit services at the time of engagement, and are brought to the committee’s attention and approved before the audit is completed.⁷ The committee can delegate pre-approval to one or more independent members, provided those members report their decisions to the full committee at each scheduled meeting.

NYSE-listed companies must go further. The charter needs to require the committee to obtain, at least annually, a report from the independent auditor covering the firm’s internal quality-control procedures, any issues raised by recent quality-control reviews or regulatory inquiries, and all relationships between the auditor and the company that could bear on independence.⁸ Periodic private sessions with the auditor, separate from management, should also be built into the charter’s text.

Whistleblower Complaint Procedures

Rule 10A-3 requires the charter to establish procedures for handling complaints about accounting, internal controls, and auditing matters, with a separate confidential and anonymous channel for employees.³ The statute leaves the mechanics to the committee. Some companies use third-party hotlines; others use dedicated email addresses or web portals. What the law requires is a genuine anonymous path for employees, a commitment to receive, retain, and address complaints, and committee oversight of any resulting investigation independent of the executives whose conduct might be at issue.

Advisor Authority and Funding

Federal law gives the audit committee independent authority to engage outside counsel, accountants, and other advisors whenever it determines they are needed, and the company must provide appropriate funding for those advisors as well as for the auditor’s own compensation.² The committee decides what “appropriate” means. The CFO does not, and the full board does not. Without this provision in the charter, a committee that suspects fraud would have to ask the very management team it suspects for money to investigate. Federal law prevents that by making the funding obligation non-negotiable.¹

What the Exchanges Add on Top

NYSE Section 303A.07 requires the charter to address the committee’s purpose, an annual self-evaluation, and a specific list of minimum duties.⁸ Those duties, which must appear in the charter’s text, include:

Meeting with management and the auditor to review annual audited and quarterly financial statements, including the Management Discussion and Analysis disclosures.
Discussing earnings press releases and financial information provided to analysts and rating agencies.
Discussing policies related to risk assessment and risk management.
Meeting separately and periodically with management, the internal auditors, and the independent auditor.
Setting hiring policies for employees and former employees of the independent audit firm.
Conducting an annual performance evaluation of the committee.

NASDAQ Rule 5605(c) covers much of the same ground with a particular focus on the committee’s role in confirming auditor independence through a formal written statement from the auditor disclosing all relationships with the company.⁹

The Audit Committee Report in the Proxy Statement

NYSE rules require the charter to address the committee’s obligation to produce a report in the annual proxy statement. The report is not a narrative of the year’s activities. It is a set of specific representations that the committee has:

Reviewed and discussed the audited financial statements with management.
Discussed required matters with the independent auditor.
Received written disclosures from the auditor regarding independence and discussed the auditor’s independence.
Recommended to the board that the audited financial statements be included in the Form 10-K.

Each committee member’s name appears below the report.¹⁰ Signing these representations when the underlying work has not been done creates real legal exposure, which is why the charter should tie the year-round duties to the report explicitly.

Cybersecurity Oversight

The SEC’s cybersecurity disclosure rules, effective in late 2023, require companies to report material cybersecurity incidents on Form 8-K within four business days of determining materiality, and to make annual disclosures about board and management oversight of cybersecurity risk.¹¹ The SEC did not require audit committees to take on cybersecurity oversight, but many boards assign it there or to a dedicated risk committee, and the SEC’s 2026 examination priorities include cybersecurity governance, data loss prevention, access controls, and incident response.¹² If the board makes that assignment, the charter should say so and describe how the committee receives information on incidents, risk assessments, and the company’s overall cybersecurity posture.

Board Adoption, Public Posting, and Annual Review

The committee drafts the charter; the full board adopts it by resolution. Meeting minutes create the official record that the board reviewed and approved the document, which matters during regulatory examinations and in later litigation. The charter carries weight only once formal adoption occurs.

Regulation S-K requires the company to disclose whether a current copy of the charter is available on its website. If the charter is not posted online, the company must include it as an appendix to the proxy statement at least once every three fiscal years, and whenever it has been materially amended since the start of the last fiscal year.⁶ Most large public companies simply post the charter on their investor relations page and keep it current.

Both exchanges expect the charter to be reviewed at least annually, and the NYSE-required committee self-evaluation naturally prompts a parallel review of the charter itself.⁸ The review should compare the charter line by line against Rule 10A-3, the current exchange listing standards, and any new SEC guidance. Material amendments go back to the full board for approval, just as the original did, and trigger fresh disclosure obligations.

What Happens If the Charter Falls Short

Non-compliance does not trigger immediate delisting. Section 301 requires the exchanges to give companies an opportunity to cure defects before a listing prohibition takes effect.² Under NASDAQ Rule 5605(c)(4), if a member loses independence for reasons beyond the member’s control, that member can remain on the committee until the earlier of the next annual shareholders meeting or one year from the event that caused the deficiency, and the company must notify NASDAQ immediately.⁹ The NYSE generally provides a longer runway, giving companies 45 days after notice to submit a compliance plan, typically within an 18-month window. Failure to submit or gain acceptance of the plan triggers suspension and delisting.

Separately, the SEC can pursue cease-and-desist proceedings under Section 21C, resulting in orders to stop the conduct, disgorgement of gains, and civil monetary penalties.⁴ The reputational damage from an announced investigation often outweighs the financial penalty; share prices tend to react well before any order is issued.

1
U.S. Securities and Exchange Commission. Standards Relating to Listed Company Audit Committees
2
Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements
3
eCFR. 17 CFR 240.10A-3 – Listing Standards Relating to Audit Committees
4
Office of the Law Revision Counsel. 15 USC 78u-3 – Cease-and-Desist Proceedings
5
Office of the Law Revision Counsel. 15 USC 7265 – Disclosure of Audit Committee Financial Expert
6
eCFR. 17 CFR 229.407 – Corporate Governance
7
PCAOB. Sarbanes-Oxley Act of 2002
8
U.S. Securities and Exchange Commission. NYSE Section 303A.07 Audit Committee Additional Requirements
9
Nasdaq. Nasdaq Rule 5600 Series – Corporate Governance Requirements
10
U.S. Securities and Exchange Commission. Audit Committee Disclosure
11
U.S. Securities and Exchange Commission. Form 8-K
12
U.S. Securities and Exchange Commission. Cybersecurity