The responsibilities of a nonprofit audit committee center on independent oversight of the organization’s financial reporting: hiring and managing the external auditor, reviewing the audited financial statements and management letter, monitoring internal controls, overseeing the whistleblower and conflict of interest policies, reviewing related party transactions, and vetting the Form 990 before it is filed. The committee exists so that the people reviewing the numbers are not the same people who produced them.
Managing the External Audit
The committee’s most visible job is owning the relationship with the independent CPA firm. That means recommending the firm to the full board, negotiating the fee, and approving the engagement letter that sets the scope of work. When management picks and manages its own auditor, the auditor has an incentive to keep management comfortable rather than surface uncomfortable findings.
When evaluating firms, the committee should prioritize nonprofit audit experience, the qualifications of the specific team members doing the fieldwork (not just the partner who signs the report), and how the firm communicates findings. A request for proposals to at least three qualified firms keeps the process competitive. No federal rule forces nonprofits to rotate audit firms on a set schedule, and switching carries real costs in lost institutional knowledge. The practical test is staleness: if the same partner has led the audit for a decade and the management letter reads identically every year, it is time for fresh eyes, whether through a new firm or a different lead partner.
Executive Sessions With the Auditor
Meeting privately with the auditor, without management in the room, is where the committee earns its keep. These executive sessions give the CPA firm a safe space to raise concerns about management cooperation, aggressive accounting positions, or internal control problems that management may be downplaying. Schedule them at minimum twice per engagement cycle: once before fieldwork begins to discuss scope and risk areas, and once after the draft report is ready.
Acting on the Management Letter
After fieldwork, the committee reviews the auditor’s opinion on the financial statements and scrutinizes the management letter, which details internal control deficiencies, operational findings, and recommendations. Some findings may be classified as significant deficiencies or material weaknesses, the most serious categories. The committee should require management to produce a written response with specific corrective actions and deadlines for each finding, then track whether those fixes actually happen through the following year. A management letter raising the same issue two years running is a red flag.
Internal Controls and Risk Oversight
Beyond the annual audit, the committee provides year-round oversight of internal financial controls. The goal is simple: make errors and fraud hard to commit and easy to detect.
The most fundamental control is segregation of duties. No single person should be able to initiate a transaction, approve it, and record it without someone else reviewing the process. In small nonprofits with limited staff, perfect segregation is impossible, and the committee should instead confirm that compensating controls exist. If the bookkeeper also signs checks, someone independent should review bank statements monthly.
Significant accounting policies deserve the committee’s attention too. Functional expense allocation, the way the organization divides costs among program services, management, and fundraising, is a perennial area of scrutiny. Donors and regulators watch how much of every dollar goes to programs versus overhead, and aggressive allocation methods can misrepresent efficiency. The committee should understand the methodology management uses and whether the auditor has flagged concerns about it.
Risk oversight also covers exposure to fraud, misappropriation, and cybersecurity threats to financial systems. The committee does not run investigations itself. It should be satisfied that management has identified the likely risk scenarios and put reasonable safeguards in place.
Reviewing the Form 990
The Form 990 is the most publicly visible document a nonprofit produces. The IRS does not legally require the board to review it before filing, but the agency has stated that board review “may reflect good governance” and correlates with more accurate filings.1Internal Revenue Service. Form 990, Part VI and Schedule L – Board Review of Return In practice, the audit committee is the natural body to handle this review before the 990 goes to the full board for approval.
Pay particular attention to Part XII, which reports on the financial statements and audit process; the executive compensation disclosures; the schedule of functional expenses; and any related party transactions disclosed on Schedule L. Grantmakers and state regulators scrutinize these sections most closely, and inconsistencies between the 990 and the audited financial statements erode credibility quickly.
Related Party Transactions and Conflicts of Interest
The committee reviews transactions between the organization and its insiders, including board members, officers, their family members, and entities they control. These transactions are not automatically prohibited, but they require careful scrutiny to make sure the nonprofit is not overpaying for services or providing improper private benefit.
The IRS recommends, though does not require, that nonprofits adopt a written conflict of interest policy.2Internal Revenue Service. Form 1023 – Purpose of Conflict of Interest Policy The committee should confirm the policy is followed in practice: that board members disclose conflicts annually, that conflicted members recuse themselves from relevant votes, and that the organization documents how it determined any insider transaction was at fair market value. When the auditor flags a related party transaction, the committee should independently verify that proper procedures were followed.
Whistleblower Policy and Document Retention
Two provisions of the Sarbanes-Oxley Act apply to all organizations, not just publicly traded companies. The first is the criminal prohibition on destroying, altering, or falsifying records to obstruct a federal investigation, which carries penalties of up to 20 years in prison.3Office of the Law Revision Counsel. 18 U.S. Code 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations The second protects whistleblowers from retaliation for reporting suspected fraud. These are federal criminal statutes, not best practices.
The committee should ensure the organization maintains a written whistleblower policy that provides a confidential channel for employees, volunteers, and board members to report suspected financial misconduct. The policy should clearly prohibit retaliation and identify who receives the reports. Ideally, reports go to someone outside the management chain, such as the audit committee chair or a designated board member, so that employees feel safe reporting concerns about their supervisors. The IRS views whistleblower policies favorably and asks about them on Form 990.4Internal Revenue Service. Exempt Organizations Annual Reporting Requirements – Governance, Form 990, Part VI A policy that exists on paper but has never been communicated to staff, or that routes every complaint to the executive director, is not functioning. The committee should periodically review the log of reports received and the outcomes of investigations.
On document retention, the committee should confirm the organization has a written policy covering how long financial records, audit workpapers, and committee minutes are preserved. Audit reports and final financial statements should be kept permanently. Meeting minutes and supporting documentation are generally retained for at least seven years. The critical point: no one should destroy financial records when there is any reason to believe a federal inquiry might be pending.
Federal Award Compliance
If your nonprofit spends $1,000,000 or more in federal awards during a fiscal year, federal regulations require a Single Audit (or a program-specific audit) in addition to the standard financial statement audit.5eCFR. 2 CFR 200.501 – Audit Requirements This threshold rose from $750,000 to $1,000,000 for fiscal years beginning on or after October 1, 2024. The audit committee needs to confirm that the CPA firm has the qualifications to perform this specialized compliance work, which goes well beyond a standard financial audit. Not all firms do it well, and mistakes can jeopardize future federal funding.
The committee should review the Schedule of Expenditures of Federal Awards and make sure the auditor’s scope covers all major programs identified under the risk-based approach required by the Uniform Guidance. If the auditor identifies compliance findings, the committee oversees management’s corrective action plan and monitors whether findings are resolved before the next audit cycle. Organizations below the $1 million threshold are not subject to the Single Audit requirement.
Who Should Sit on the Committee
Independence is the entire foundation. If the people reviewing the financial statements have a stake in how those statements look, the review is theater. Members should not be employees, officers, or anyone who receives compensation from the organization beyond reimbursement for reasonable board-related expenses. A major vendor, a paid consultant, or a family member of the executive director all compromise objectivity.
The executive director and finance director should not sit on the committee, though they will attend meetings to present information and answer questions. They leave the room when the committee needs to deliberate privately or meet with the external auditor.
The board treasurer is a trickier case. The treasurer works closely with management on financial operations and often helps prepare the very documents the committee reviews, which can undermine the independent perspective the committee needs. Some governance experts flatly recommend excluding the treasurer. Others allow it if the treasurer was not directly involved in preparing the financial statements under review. If your board is small enough that losing the treasurer would leave you short on financial knowledge, that is a composition problem to solve through recruitment rather than by compromising independence.
A Member With Real Financial Expertise
At least one member should have enough financial expertise to read nonprofit financial statements critically, understand generally accepted accounting principles as they apply to tax-exempt organizations, and ask pointed questions about areas like revenue recognition, non-cash contribution valuation, or grant accounting. A committee without someone who genuinely understands the numbers will default to rubber-stamping whatever the auditor presents.
Not every member needs a CPA license. A retired CFO, a banker with lending experience, or a board member who has served on audit committees elsewhere can fill the role. What matters is whether the person can look at a statement of activities, spot an unusual trend in functional expenses, and know which follow-up question to ask.
Charter, Meetings, and Documentation
Every audit committee should operate under a written charter approved by the full board. The charter defines the committee’s purpose, authority, composition requirements, and specific responsibilities, and at minimum should cover the committee’s role in selecting the auditor, reviewing financial statements and the management letter, overseeing internal controls and the whistleblower policy, and reviewing related party transactions. A well-drafted charter also spells out the committee’s right to meet privately with the auditor and to access any organizational records it needs. The board should review and reaffirm the charter annually.
A committee that meets once a year to rubber-stamp the audit report is not providing real oversight. Schedule quarterly meetings at minimum, with the most critical sessions timed around the audit cycle: one before fieldwork begins, one after the draft report arrives, and additional meetings to review interim financial statements, monitor corrective actions, and handle emerging issues.
Detailed minutes are not optional. They are the official record that the committee did its job and should document what was reviewed, what questions were raised, what the auditor reported in executive session, and what decisions were made. If a regulator or state attorney general ever questions the organization’s governance, these minutes are the evidence of due diligence. The committee should formally report its findings and its approval or concerns regarding the audited financial statements to the full board, which cannot fulfill its fiduciary duty on financial matters if the audit committee operates as a black box.
When a Separate Committee Is Required
No federal law requires every nonprofit to have an audit committee. The Sarbanes-Oxley Act of 2002, which created detailed audit committee rules for publicly traded companies, does not directly impose those requirements on tax-exempt organizations.6U.S. Securities and Exchange Commission. Disclosure Required by Sections 406 and 407 of the Sarbanes-Oxley Act of 2002 The real mandates come from state law. Several states require nonprofits above certain revenue levels either to form a dedicated audit committee of independent directors or to have the full board (with only independent members voting) oversee the audit. Thresholds vary, but commonly fall between $1 million and $2 million in annual gross revenue. If your nonprofit is registered to solicit donations in multiple states, you may be subject to the strictest applicable rule.
Even where no law compels one, Form 990, Part XII asks whether a committee assumes responsibility for overseeing the audit and selecting the independent auditor.7Internal Revenue Service. 2025 Instructions for Form 990 Return of Organization Exempt From Income Tax Answering “no” does not trigger a penalty, but grantmakers and state regulators reviewing the 990 will notice. For smaller organizations, the full board or the finance committee can handle audit oversight. Once annual revenue consistently exceeds $2 million, separating the audit function from the finance committee is the stronger practice, because the people reviewing financial statements should not be the same people who prepared the budget.