Executing Audit Committee Oversight in Turbulent Times: Risk Management and Financial Reporting

1. When evaluating director independence and conflicts of interest, audit committees should:

• carefully evaluate the independence of committee members;
• even where committee members meet the technical definition of independence, identify and carefully evaluate areas where potential conflicts of interest may arise and develop procedures that would address conflicts; and
• obtain training on those procedures.

2. When evaluating risks, audit committees should:

• identify and evaluate potential risks that may arise from any significant change to operations, business strategy, accounting policy or significant judgements by management;
• obtain a thorough understanding of management’s reasons for implementing such changes and any need for disclosure;
• consider the propriety of changes in financial or accounting policies and processes, particularly those that may have an impact on management compensation; and
• follow up on other information that may raise a question regarding the company’s financial reporting.

3. To ensure that potential control deficiencies and other significant issues are timely communicated and properly evaluated, audit committees should:

• establish communication protocols to ensure that they receive timely notice from management of control deficiencies or other significant issues that may have broad impact;
• ensure that they fully understand the significant judgments and estimates used in deriving the company’s financial statements;
• insist on receiving a detailed report regarding the root cause of control deficiencies determined either individually or when aggregated to be significant deficiencies or material weaknesses;
• evaluate whether control deficiencies suggest an inadequate tone at the top; and
• discuss these issues with the company’s external auditors to obtain their perspective.

4. To ensure competence of key finance and accounting personnel, audit committees should:

• take steps to evaluate any talent risks posed by the company’s key finance and accounting personnel including the head of the Internal Audit Department (observation of subordinates can inform the board’s understanding of the competence of more senior management);
• consider conducting one on one meetings with key personnel at least on a yearly basis to gain management’s perspectives and insights and asking the company’s external auditors for their opinions on the competency and depth of the company’s finance and accounting team.

5. To ensure Compliance with SEC compensation clawback Rules, audit committees should:

• be familiar with the SEC’s new clawback rules, which went into effect October 2023;
• evaluate management’s clawback analysis upon the issuance of ether a “big r” or “little r” restatement; and
• if the clawback provision is triggered, retain outside legal and financial experts to assist with calculating the amount of any clawback and have in place a protocol for taking such action.

6. To ensure that the company’s policies and procedures meet the expectations of federal regulators and the DOJ, boards should understand the recent efforts by federal regulators and DOJ to impose additional oversight responsibilities on boards of directors such as restricting employee use of off-channel communications for company business.

7. To adequately address concerns over questionable management conduct, audit committees should:

• understand and oversee management’s fraud prevention and detection program and understand the company’s significant fraud risk areas;
• conduct investigations into evidence suggesting potential misconduct or incompetence by the company’s senior management;
• retain outside legal and financial experts that do not have any prior relationship with the company to ensure the investigation’s independence from management;
• ensure that any investigation into issues that may impact the company’s financial statements are promptly reported to the company’s external auditor; and
• consider self-disclosure of investigation and prompt remediation as a way to defer pending investigation by law enforcement and reduction of any resulting sanctions.