The responsibilities of a nonprofit audit committee center on independent oversight of financial reporting: hiring and managing the external auditor, reviewing the audited financial statements and the management letter, monitoring internal controls, overseeing the whistleblower and document retention policies, reviewing the Form 990 before it is filed, and scrutinizing related party transactions. The committee is made up of independent board members who do not run day-to-day operations, and its work is what gives donors, grantmakers, and regulators reason to trust the numbers.
What the Committee Actually Owns
Think of the committee as the board’s financial conscience. Management prepares the books. The auditor examines them. The audit committee sits between the two, making sure the examination is real and that what comes out of it gets acted on. That work breaks into a handful of concrete duties:
- Recommending which CPA firm to hire and approving the engagement
- Meeting privately with the auditor, without management in the room
- Reviewing the audited financial statements and the management letter
- Tracking whether management fixes what the auditor flags
- Overseeing internal controls and fraud risk year-round
- Maintaining the whistleblower channel and document retention policy
- Reviewing the Form 990 before it goes to the full board
- Vetting related party transactions and enforcing the conflict of interest policy
- Reporting findings back to the full board
Each of these deserves a closer look, because the difference between a committee that does its job and one that rubber-stamps the audit is in how these duties are carried out.
Who Belongs on the Committee
Independence is the whole foundation. If the people reviewing the financials have a stake in how those financials look, the review is theater. Committee members should not be employees, officers, or anyone who receives compensation from the organization beyond reimbursement of reasonable board expenses. A major vendor, a paid consultant, or a family member of the executive director all compromise objectivity.
The executive director and finance director do not sit on the committee. They attend meetings to present information and answer questions, and they leave the room when the committee needs to deliberate privately or meet with the external auditor.
The board treasurer is the harder case. The treasurer works closely with management on financial operations and often helps prepare the very documents the committee reviews, which cuts against the independent perspective the committee needs. Some governance experts recommend excluding the treasurer outright. Others allow it if the treasurer was not directly involved in preparing the statements under review. If your board is small enough that losing the treasurer leaves you short on financial knowledge, treat that as a recruitment problem rather than a reason to soften the independence standard.
The Financial Expert on the Committee
At least one member should have enough financial expertise to read nonprofit statements critically, understand generally accepted accounting principles as applied to tax-exempt organizations, and ask pointed questions about revenue recognition, non-cash contribution valuation, or grant accounting. Sarbanes-Oxley requires publicly traded companies to disclose whether their audit committees include a financial expert.1U.S. Securities and Exchange Commission. Disclosure Required by Sections 406 and 407 of the Sarbanes-Oxley Act of 2002 Nonprofits have no equivalent disclosure obligation, but the principle carries. A committee without someone who genuinely understands the numbers will default to accepting whatever the auditor presents.
This does not require a CPA license. A retired CFO, a banker with lending experience, or a director who has served on audit committees at other organizations can fill the role. What matters is whether the person can look at a statement of activities, spot an unusual trend in functional expenses, and know which follow-up question to ask.
Managing the External Auditor
The committee’s most visible duty is managing the relationship with the independent CPA firm. This is not an administrative task for the executive director. When management selects and manages its own auditor, the auditor has an incentive to keep management comfortable rather than flag uncomfortable findings.
Selecting and Engaging the Firm
The committee recommends to the full board which firm to hire, negotiates the fee, and approves the engagement letter that defines the scope of work. When evaluating firms, weigh nonprofit audit experience, the qualifications of the specific team members doing the fieldwork (not just the partner who signs the report), and how the firm communicates findings. Issuing a request for proposals to at least three qualified firms keeps the process competitive.
Periodically evaluate whether the current firm remains the right fit. No federal law requires nonprofits to rotate audit firms on a set schedule, and switching firms carries a real cost in lost institutional knowledge. A more practical test: has the engagement gone stale? If the same partner has led the audit for a decade and the management letter reads the same every year, that is a sign the relationship may benefit from fresh eyes, whether through a new firm or a different lead partner.
Executive Sessions Without Management
This is where the committee earns its keep. Meeting privately with the auditor, without management present, gives the CPA firm a safe space to raise concerns about management cooperation, aggressive accounting positions, or internal control problems that management may be downplaying. These executive sessions should happen at least twice per engagement cycle: once before fieldwork begins, to discuss scope and risk areas, and once after the draft report is ready.
Reviewing the Report and the Management Letter
After fieldwork, the committee reviews the auditor’s opinion on the financial statements and scrutinizes the management letter, which details internal control deficiencies, operational findings, and recommendations. Some findings may be classified as significant deficiencies or material weaknesses, which are the two most serious categories. The committee should require management to produce a written response with specific corrective actions and deadlines for each finding, then track whether those fixes actually happen throughout the following year. A management letter that raises the same issue two years in a row is a red flag.
Federal Award Compliance
If your nonprofit spends $1,000,000 or more in federal awards during a fiscal year, federal regulations require a Single Audit (or a program-specific audit) in addition to the standard financial statement audit.2eCFR. 2 CFR 200.501 – Audit Requirements The threshold rose from $750,000 to $1,000,000 for fiscal years beginning on or after October 1, 2024, so it applies in full for 2026. The committee should confirm that the CPA firm has the qualifications and experience to perform this specialized compliance work, which goes well beyond a standard financial audit. Not all firms do it well, and mistakes in Single Audit compliance can jeopardize future federal funding.
The committee should review the Schedule of Expenditures of Federal Awards and confirm that the auditor’s scope covers all major programs identified under the risk-based approach required by the Uniform Guidance. If the auditor identifies compliance findings, the committee oversees management’s corrective action plan and monitors whether the organization resolves those findings before the next audit cycle.
Internal Controls and Risk Oversight Year-Round
The committee’s work does not stop when the audit report is signed. Between engagements, it provides ongoing oversight of the organization’s internal financial controls. The goal is straightforward: make it hard for errors or fraud to occur, and easy to detect them when they do.
The most fundamental control is segregation of duties. No single person should be able to initiate a transaction, approve it, and record it without someone else reviewing the process. In small nonprofits with limited staff, perfect segregation is impossible, so the committee should ensure that compensating controls exist. If the bookkeeper also signs checks, someone independent should review bank statements each month.
The committee should also review significant accounting policies for appropriateness. Functional expense allocation, where the organization divides costs among program services, management, and fundraising, is a perennial area of scrutiny. Donors and regulators watch how much of every dollar goes to programs versus overhead, and aggressive allocation methods can misrepresent efficiency. The committee should understand the methodology management uses and whether the auditor has flagged any concerns about it.
Risk oversight also covers exposure to fraud, misappropriation, and cybersecurity threats to financial systems. The committee does not investigate on its own, but it should be satisfied that management has identified the most likely risk scenarios and put reasonable safeguards in place.
Whistleblower Policy and Document Retention
Two provisions of Sarbanes-Oxley apply to every organization, tax-exempt or not. The first is the criminal prohibition on destroying, altering, or falsifying records to obstruct a federal investigation, which carries penalties of up to 20 years in prison.3Office of the Law Revision Counsel. 18 U.S. Code 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations The second protects whistleblowers from retaliation for reporting suspected fraud. These are federal criminal statutes, not best-practice suggestions.
The audit committee should ensure the organization maintains a written whistleblower policy that provides a confidential channel for employees, volunteers, and board members to report suspected financial misconduct. The policy should clearly prohibit retaliation and identify who receives reports. Ideally those reports go to someone outside the management chain, such as the audit committee chair or a designated board member, so employees feel safe reporting concerns about their supervisors. The IRS views whistleblower policies favorably and asks about them on Form 990.4Internal Revenue Service. Exempt Organizations Annual Reporting Requirements – Governance, Form 990, Part VI
Review the log of any reports received and the outcomes of investigations. A policy that exists on paper but has never been communicated to staff, or that routes all complaints to the executive director, is not really functioning.
On document retention, confirm the organization has a written policy covering how long financial records, audit workpapers, and committee minutes are preserved. Audit reports and final financial statements should be kept permanently. Meeting minutes and supporting documentation are generally retained for at least seven years. No one should destroy financial records when there is any reason to believe a federal inquiry might be pending.
Reviewing the Form 990
The Form 990 is the most publicly visible document your nonprofit produces. Anyone can look it up on GuideStar or ProPublica’s Nonprofit Explorer. The IRS does not legally require the board to review the 990 before filing, but the agency has stated that board review “may reflect good governance” and correlates with more accurate filings.5Internal Revenue Service. Form 990, Part VI and Schedule L – Board Review of Return The audit committee is the natural body to handle this review before the return goes to the full board for approval.
Pay particular attention to Part XII, which reports on financial statements and the audit process; the executive compensation disclosures; the schedule of functional expenses; and any related party transactions disclosed on Schedule L. These are the sections journalists, grantmakers, and state regulators scrutinize most closely. Part XII also asks specifically whether a committee assumes responsibility for overseeing the audit and selecting the independent auditor.6Internal Revenue Service. 2025 Instructions for Form 990 Return of Organization Exempt From Income Tax Errors or inconsistencies between the 990 and the audited financial statements erode credibility quickly.
Related Party Transactions and Conflicts of Interest
The committee reviews transactions between the organization and its insiders, including board members, officers, their family members, and entities they control. These transactions are not automatically prohibited, but they require scrutiny to ensure the nonprofit is not overpaying for services or providing improper private benefit.
The IRS recommends, though does not require, that nonprofits adopt a written conflict of interest policy.7Internal Revenue Service. Form 1023 – Purpose of Conflict of Interest Policy The audit committee should confirm the policy is followed in practice: board members disclose conflicts annually, conflicted members recuse themselves from relevant votes, and the organization documents how it determined that any insider transaction was conducted at fair market value. When the auditor flags a related party transaction in the financial statements, the committee should independently verify that proper procedures were followed.
Meetings, Minutes, and the Committee Charter
An audit committee that meets once a year to approve the audit report is not providing real oversight. Schedule quarterly meetings at minimum, with the most critical sessions timed around the audit cycle: one before fieldwork begins, one after the draft report arrives, and additional meetings to review interim financial statements, monitor corrective actions, and handle any emerging issues.
Detailed minutes are not optional. They are the official record that the committee did its job. Minutes should document what was reviewed, what questions were raised, what the auditor reported in executive session, and what decisions the committee made. If a regulator or state attorney general ever questions the organization’s governance, those minutes are your evidence of due diligence.
The committee formally reports its findings and its approval or concerns regarding the audited financial statements to the full board. The board cannot fulfill its fiduciary duty on financial matters if the audit committee operates as a black box.
The Charter That Governs the Committee
Every audit committee should operate under a written charter approved by the full board. The charter defines the committee’s purpose, authority, composition requirements, and specific responsibilities. It should cover the committee’s role in selecting the auditor, reviewing financial statements and the management letter, overseeing internal controls and the whistleblower policy, and reviewing related party transactions. A well-drafted charter also spells out the committee’s right to meet privately with the auditor and to access any organizational records it needs. The board should review and reaffirm the charter annually.
When a Separate Committee Is Required
No federal law requires every nonprofit to have an audit committee. Sarbanes-Oxley’s detailed audit committee rules apply to publicly traded companies, not tax-exempt organizations, though the document destruction and whistleblower protections described above do reach nonprofits directly.1U.S. Securities and Exchange Commission. Disclosure Required by Sections 406 and 407 of the Sarbanes-Oxley Act of 2002
The mandates come from state law. Several states require nonprofits above certain revenue levels to either form a dedicated audit committee of independent directors or have the full board, with only independent members voting, oversee the audit. Thresholds vary, but commonly fall between $1 million and $2 million in annual gross revenue. If your nonprofit is registered to solicit donations in multiple states, the strictest applicable rule may govern.
For smaller organizations, the full board or the finance committee can handle audit oversight. Once annual revenue consistently exceeds $2 million, separating the audit function from the finance committee is the stronger practice. The people reviewing financial statements should not be the same people who prepared the budget.