An audit committee is a subcommittee of a public company’s board of directors that oversees financial reporting, monitors internal controls, and manages the company’s relationship with its outside auditors. Federal law requires every company listed on a U.S. stock exchange to maintain one, and the committee’s authority comes directly from the Sarbanes-Oxley Act of 2002 and the SEC rules built on it.1Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements The committee sits between management, the independent auditors, and shareholders, and its members carry real legal exposure if they fail to do the job.
What the Committee Actually Does
The committee’s work falls into five areas, each one tied to a specific federal requirement.
Reviewing Financial Statements Before They Are Filed
Members review the company’s audited financials before the annual 10-K goes to the SEC. The committee’s required report in the proxy statement must confirm that members reviewed and discussed the audited financials with management, discussed required matters with the independent auditors, received disclosures about the auditors’ independence, and recommended whether the audited financials should be included in the 10-K.2Securities and Exchange Commission. Audit Committee Disclosure
This isn’t a rubber stamp. The committee scrutinizes the accounting policies management chose, the significant estimates and judgments baked into the numbers, and the clarity of the disclosures. The review covers quarterly 10-Q filings, earnings releases, and other public financial communications as well.
Overseeing Internal Controls
Section 404 of the Sarbanes-Oxley Act requires management to assess the effectiveness of the company’s internal controls over financial reporting each year and include that assessment in the annual report, and the external auditor must attest to management’s evaluation.3Securities and Exchange Commission. Sarbanes-Oxley Disclosure Requirements The audit committee oversees that process and reviews both the management report and the auditor’s opinion on it. Effective committees receive updates on control deficiencies and remediation progress throughout the year, not just at the annual report stage.
Hiring and Supervising the External Auditor
One of the sharpest lines drawn by Sarbanes-Oxley is who controls the external auditor. The answer is the audit committee, exclusively. Federal law makes the committee directly responsible for appointing, compensating, and overseeing the independent auditing firm. The auditor reports to the committee, not to the CEO or CFO, and the committee resolves any disagreements between management and the auditor about how to report financial results.1Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements
The committee must pre-approve every engagement between the company and its auditing firm, including non-audit services like tax consulting. A narrow exception covers non-audit services totaling less than 5% of total fees paid to the auditor in a given year, so long as the company didn’t initially recognize them as non-audit services and they are promptly brought to the committee’s attention and approved before the audit wraps up.4U.S. Department of Labor. Sarbanes-Oxley Act of 2002 – Section 202
SEC independence rules also require the lead audit partner and the engagement quality reviewer to rotate off an engagement after five consecutive years, with other audit partners limited to seven.5eCFR. 17 CFR 210.2-01 – Qualifications of Accountants The rotation applies to the individual partners, not the firm; the same firm can keep the engagement indefinitely.
Supervising Internal Audit
The internal audit function is a separate team, employed by the company but designed to operate with independence from management. The audit committee maintains a direct reporting relationship with the head of internal audit so that if internal auditors find something management would rather keep quiet, they have a path to the board that doesn’t run through the CEO’s office.6The Institute of Internal Auditors. The Audit Committee – Internal Audit Oversight The committee reviews and approves the internal audit plan, ensures the function has adequate staffing and budget, and reviews the results of internal audit engagements.
Handling Complaints and Whistleblower Reports
Federal law requires every audit committee to establish procedures for two distinct channels: receiving and handling complaints about accounting, internal controls, or auditing matters from any source, and accepting confidential, anonymous submissions from employees who have concerns about questionable accounting or auditing practices.1Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements Separately, Sarbanes-Oxley prohibits companies from retaliating against employees who report suspected securities violations to federal regulators, Congress, or internal supervisors. Protected employees who are discharged, demoted, suspended, or harassed can file a complaint with the Department of Labor or bring a civil action in federal court.7Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
Who Sits on It
Every member of an audit committee must be a member of the company’s board of directors, and every one of them must be independent. Independence under federal law means the member cannot accept any consulting, advisory, or other compensatory fee from the company outside of normal director compensation, and cannot be an affiliated person of the company or any of its subsidiaries.1Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements
The SEC’s implementing rule extends the fee prohibition to indirect compensation received by a member’s spouse, minor children, or stepchildren living in the same household.8eCFR. 17 CFR Part 240 Subpart A – Reports Under Section 10A The point is to prevent situations where a director’s financial ties to management compromise their willingness to ask hard questions. Exchange listing standards layer additional requirements on top of the federal baseline, including look-back periods that keep former employees from serving as independent directors until several years after leaving the company.
The NYSE requires at least three members on each audit committee, and every member must be financially literate or become so within a reasonable time after appointment.9NYSE. NYSE Listed Company Manual Section 303A FAQ Financial literacy means the ability to read and understand balance sheets, income statements, and cash flow statements. The board itself decides whether a director meets that standard.
The Financial Expert Designation
Beyond general literacy, federal law requires each company to disclose whether its audit committee includes at least one “audit committee financial expert.” If none does, the company must explain why.10Office of the Law Revision Counsel. 15 USC 7265 – Disclosure of Audit Committee Financial Expert The SEC defines the term with five attributes: an understanding of generally accepted accounting principles and financial statements; the ability to assess how those principles apply to estimates, accruals, and reserves; experience preparing, auditing, or evaluating financial statements of comparable complexity to the company’s own; knowledge of internal control over financial reporting; and an understanding of what audit committees do.11eCFR. 17 CFR 229.407 – Item 407 Corporate Governance
The SEC built a safe harbor into the designation. Being named the financial expert does not create any additional legal duty or liability beyond what any other committee member already bears, and it does not reduce the duties of the other members.11eCFR. 17 CFR 229.407 – Item 407 Corporate Governance Without that safe harbor, qualified directors would be reluctant to accept the label.
Authority and Funding
An audit committee that lacks resources is an audit committee in name only. Federal law addresses this directly: the company must provide whatever funding the audit committee determines is appropriate to pay the external auditor, hire independent legal counsel, and retain other outside advisers the committee considers necessary to do its job.1Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements Management does not get to veto the committee’s budget. The provision exists because an audit committee that has to ask the CFO for permission to hire a forensic accountant is not truly independent.
The major stock exchanges also require the committee to maintain a formal written charter approved by the full board that spells out the committee’s responsibilities, structure, processes, and membership requirements.2Securities and Exchange Commission. Audit Committee Disclosure Many companies publish their charter on the investor relations section of their website.
Liability for Serving
Serving on an audit committee carries real legal exposure. The SEC views audit committee members as gatekeepers and has pursued enforcement actions against individual members who ignored warning signs. In 2014, the SEC brought an action against the audit committee chair of AgFeed Industries, alleging he learned the company maintained two sets of books to inflate revenue by $239 million and failed to disclose the fraud to auditors or take meaningful steps to investigate. In a separate 2014 action, the SEC charged the former audit committee chair of L&L Energy with withholding information about false executive officer representations and signing an annual report she knew or should have known contained misleading certifications.
On the shareholder litigation side, directors face what courts call oversight liability. Under Delaware case law, a plaintiff must show that directors either completely failed to implement any reporting or control system, or implemented one but then consciously failed to monitor it. Courts have described that as one of the hardest claims to win in corporate law, but the bar has lowered in recent years as courts have allowed more of these cases to survive early dismissal.
The practical takeaway for committee members is straightforward: document your work, follow up on red flags, and engage outside experts when something looks wrong. The cases that lead to personal liability almost always involve willful blindness rather than honest mistakes.
A Note on Private Companies
Private companies have no federal obligation to create an audit committee. The SEC’s framework was designed for public companies whose securities trade on national exchanges.2Securities and Exchange Commission. Audit Committee Disclosure Many large private companies and nonprofits still establish one voluntarily because lenders, investors, or state regulators expect it, and some states require nonprofits above certain revenue thresholds to obtain independent audits that an audit committee is well suited to oversee.