Audit Committee Definition: Members, Authority, and Oversight

An audit committee is a subcommittee of a company’s board of directors that oversees financial reporting, monitors internal controls, and manages the relationship with the outside auditor. Federal law requires every company listed on a U.S. stock exchange to have one, and its authority comes from the Sarbanes-Oxley Act of 2002 and the SEC rules built on top of it.¹ The committee sits between management, the independent auditors, and shareholders, and its members carry real legal exposure if they don’t do the job.

Which Companies Must Have One

Sarbanes-Oxley directed the SEC to bar any stock exchange from listing a company without a compliant audit committee.¹ The SEC put that into effect through Rule 10A-3, which applies on both the NYSE and Nasdaq.² A listed company that falls out of compliance risks delisting, though the rules give issuers a chance to fix defects first.

Private companies have no federal obligation to form one. The SEC’s framework was designed for public companies whose securities trade on national exchanges.³ Many large private companies and nonprofits still set one up voluntarily because lenders, investors, or state regulators expect it. Some states require nonprofits above a revenue threshold to obtain independent audits, and an audit committee is the natural governance structure for handling that.

Who Sits on an Audit Committee

Every member has to be a director of the company, and every one of them has to be independent. Independence under federal law means the member cannot accept any consulting, advisory, or other compensatory fee from the company beyond normal director pay, and cannot be an affiliated person of the company or its subsidiaries.¹

The SEC’s rule extends the fee ban to indirect compensation paid to a member’s spouse, minor children, or stepchildren sharing the household.⁴ The point is to keep financial ties to management from softening a director’s willingness to ask hard questions. Exchange listing standards add further requirements on top of that federal baseline, including look-back periods that keep former employees out of independent director roles for several years after leaving the company.

Size and Financial Literacy

The NYSE requires at least three members on each audit committee, and every member must be financially literate or become so within a reasonable time after appointment.⁵ Financial literacy means the ability to read and understand balance sheets, income statements, and cash flow statements. The board itself decides whether a director meets the standard, using its own business judgment.

The Financial Expert

Beyond general literacy, federal law requires each company to disclose whether the audit committee includes at least one “audit committee financial expert.” If it does not, the company must explain why.⁶ The SEC defines the term through five attributes:

An understanding of generally accepted accounting principles and financial statements.
The ability to assess how those principles apply to estimates, accruals, and reserves.
Experience preparing, auditing, or evaluating financial statements of complexity comparable to the company’s own.
An understanding of internal control over financial reporting.
An understanding of audit committee functions.⁷

The SEC built a safe harbor into the designation. Being named the financial expert doesn’t create additional legal duty or liability beyond what any other member already bears, and it doesn’t reduce the duties of the other members.⁷ Without it, qualified directors would refuse the label.

Overseeing Financial Reporting

The committee reviews the company’s financial statements before they get filed with the SEC. Its proxy statement report has to confirm that members reviewed and discussed the audited financials with management, discussed required matters with the independent auditors, and received disclosures about the auditors’ independence.³ The report also has to state whether the committee recommended that the board include the audited financials in the 10-K.

This isn’t a rubber stamp. The committee scrutinizes the accounting policies management chose, any significant estimates or judgments baked into the numbers, and the clarity of the disclosures. The goal is to catch material misstatements or aggressive accounting before investors ever see the filing. Review covers both the annual 10-K and the quarterly 10-Q, along with earnings releases and other public financial communications.

Monitoring Internal Controls

Section 404 of Sarbanes-Oxley requires management to assess the effectiveness of the company’s internal controls over financial reporting each year and include that assessment in the annual report. The external auditor then attests to management’s evaluation.⁸ The audit committee oversees the whole process, reviewing both management’s report and the auditor’s opinion on it.

Internal controls are the systems, policies, and procedures that keep financial data accurate and assets protected. When those controls break down, you get restatements, fraud, and investor losses. An effective committee stays close enough to the control environment to catch weaknesses early, receiving updates on deficiencies, remediation progress, and changes throughout the year rather than reading a single report once annually.

Authority Over the External Auditor

One of the sharpest lines drawn by Sarbanes-Oxley is who controls the external auditor. The answer is the audit committee, exclusively. Federal law makes the committee directly responsible for appointing, compensating, and overseeing the auditing firm. The auditor reports to the committee, not to the CEO or CFO, and the committee resolves any disagreements between management and the auditor about how to report financial results.¹

Before Sarbanes-Oxley, management typically controlled the auditor relationship. The people being audited were the same people choosing and paying the auditors. The current structure was designed to fix that.

Pre-Approval of Auditor Services

The committee has to pre-approve every engagement between the company and the auditing firm, including non-audit services like tax consulting. There’s a narrow exception for non-audit services that total less than 5% of total fees paid to the auditor in a given year, that the company didn’t initially recognize as non-audit services, and that are promptly brought to the committee’s attention and approved before the audit wraps up.⁹ The committee can delegate pre-approval authority to one or more independent members, but those decisions must be reported to the full committee at the next scheduled meeting.

Partner Rotation

SEC independence rules require the lead audit partner and the engagement quality reviewer to rotate off an engagement after five consecutive years. Other audit partners on the engagement are limited to seven consecutive years. After rotating off, lead partners and engagement quality reviewers face a five-year cooling-off period before they can return to the client; other partners face a two-year cooling-off period.¹⁰ Rotation applies to the individual partners, not the firm. The same firm can remain the auditor indefinitely, but the people leading the engagement have to change on a set cycle.

Oversight of Internal Audit

Internal audit is a separate function from the external auditor, staffed by company employees but designed to operate independently of management. The audit committee oversees it by maintaining a direct reporting relationship with the head of internal audit. That reporting line protects the team’s objectivity: if internal auditors find something management would rather keep quiet, they have a path to the board that doesn’t run through the CEO’s office.¹¹ The committee reviews and approves the internal audit plan, makes sure the function has adequate staffing and budget, and reviews the results of engagements.

Complaint and Whistleblower Channels

Federal law requires every audit committee to set up procedures for two distinct channels: receiving and handling complaints about accounting, internal controls, or auditing matters from any source, and accepting confidential, anonymous submissions from employees who have concerns about questionable accounting or auditing practices.¹ The anonymous channel matters because employees are the people most likely to spot fraud early, and they won’t come forward if they fear retaliation.

Separately, Sarbanes-Oxley prohibits companies from retaliating against employees who report suspected securities violations to federal regulators, Congress, or internal supervisors. Protected employees who are discharged, demoted, suspended, or harassed can file a complaint with the Department of Labor or bring a civil action in federal court.¹²

The Charter and the Committee’s Budget

The SEC itself doesn’t require a written charter, but the major exchanges do. The NYSE, Nasdaq, and AMEX listing standards all require a formal written charter approved by the full board that spells out the committee’s responsibilities, structure, processes, and membership requirements. The charter has to be reviewed and reassessed for adequacy every year.³ It defines the committee’s scope of authority in concrete terms and typically covers oversight of external and internal auditors, review of financial statements, monitoring of risk management and compliance programs, and handling of whistleblower complaints. Many companies publish it on their investor relations pages.

An audit committee without resources is an audit committee in name only. Federal law addresses that directly: the company has to provide whatever funding the committee determines is appropriate to pay the external auditor, hire independent legal counsel, and retain other outside advisers the committee considers necessary.¹ Management doesn’t get to veto the budget. A committee that has to ask the CFO for permission to hire a forensic accountant is not truly independent.

Liability for Committee Members

Serving on an audit committee carries real legal exposure. The SEC treats audit committee members as gatekeepers and has pursued individual members who ignored warning signs. On the shareholder litigation side, directors face what courts call oversight liability: a plaintiff must show that directors either completely failed to implement any reporting or control system, or that they implemented one and then consciously failed to monitor it, leaving themselves unable to spot problems that required their attention. Courts have described this as one of the hardest claims in corporate law to win, though the bar has lowered in recent years as courts have allowed more of these cases to survive early dismissal.

The practical takeaway is straightforward. Document your work, follow up on red flags, and engage outside experts when something looks wrong. The cases that end in personal liability almost always involve willful blindness rather than honest mistakes.

1
Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements
2
Securities and Exchange Commission. Standards Relating to Listed Company Audit Committees
3
Securities and Exchange Commission. Audit Committee Disclosure
4
eCFR. 17 CFR Part 240 Subpart A – Reports Under Section 10A
5
NYSE. NYSE Listed Company Manual Section 303A FAQ
6
Office of the Law Revision Counsel. 15 USC 7265 – Disclosure of Audit Committee Financial Expert
7
eCFR. 17 CFR 229.407 – Item 407 Corporate Governance
8
Securities and Exchange Commission. Sarbanes-Oxley Disclosure Requirements
9
U.S. Department of Labor. Sarbanes-Oxley Act of 2002 – Section 202
10
eCFR. 17 CFR 210.2-01 – Qualifications of Accountants
11
The Institute of Internal Auditors. The Audit Committee – Internal Audit Oversight
12
Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases