Audit committees have never felt so stressed and stretched. Everybody, from stock exchanges to boards of directors to investors, expects more from them, and the penalties for failure have never been more serious.As a result, audit committees are meeting more often, setting more serious agendas tilted more toward inquiry, demanding more of internal auditors, and calling for committee members with better qualifications.
"Audit committees are meeting more often and they're meeting longer," said David Richards, president of the Institute of Internal Auditors. "Some are meeting every month for two to four hours - a significant change from when the standard was four times a year, generally for only an hour and a half at most. They use the telephone for meetings more often, and they are more involved in looking at financial information before it's released."
Richards cited several reasons for the increase. The scope of audit committees has increased. They must do more control and risk assessment, and they are demanding more from management and auditors, both internal and external. At the same time, boards of directors are looking at audit committee performance as they do the self-assessments that major stock exchanges now require of listing companies.
Richards said that the biggest fear among audit committee members isn't legal exposure, but exposure of their reputations as business and community leaders. If an auditor finds their oversight and controls deficient, they themselves could be identified as a material weakness - the last thing any business leader wants to see.
Concerned with the changing environment around corporate governance, the IIA Research Foundation commissioned Big Four firm PricewaterhouseCoopers to write a third edition of a research report titled "Audit Committee Effectiveness - What Works Best." The first volume was published in 1993 and revised in 2000.
Catherine Bromilow, chief author of the report and a partner with PwC's corporate governance group, spoke with the audit committees of 219 public companies in 15 countries in search of problems and best practices. The report covered not just financial statements, risk management and internal control, but compliance and ethics, oversight of management, relationships with external auditors, improvement of meeting effectiveness, and special investigations.
The research focused mostly on large public companies that have already had to report under Section 404 of the Sarbanes-Oxley Act. Their audit committees have often gone through the adjustments needed to adapt to the new world of scrutiny and liability. The audit committees of smaller companies are just now beginning to deal with their huge new responsibilities, and Bromilow hopes the book-length, plain-language report will help them assess their own situations and apply the best practices devised by larger companies.
One indication of the difficulties that audit committees are going through is the reluctance of board members to serve on that committee. Bromilow found that one third of the companies she talked with had experienced difficulty in recruiting new audit committee members. The three main reasons were concerns with liability, the significant time commitment and heightened independence requirements.
The report recommended that audit committees resist trying to fix everything they find wrong. When they discover problems, the report said, they should not fail to challenge management to find solutions. Agendas should emphasize discussion and inquiry, rather than only the management presentations that have traditionally comprised agendas. Meetings should be planned so that the right people attend. Minutes of meetings should provide a high-level summary of discussions and follow-up actions.
Back to school
The research turned up an area that Bromilow thought was philosophically important but that few boards of directors focus on - training and education for audit committees.
"We're seeing more audit committees embracing orientation for their members, but we're still seeing them lag behind in the ongoing education and focus on what is happening outside and inside the company," Bromilow said.
She recommended that business unit managers provide education on changes in the business, and that financial officers explain the implications of new accounting rules. She also recommended outside training at conferences and "directors' colleges," where committee members can exchange experiences and ideas.
Eleanor Bloxham, chief executive officer of The Value Alliance and Corporate Governance Alliance, researches critical issues that affect audit committees, and her findings confirmed those of the IIA/PWC report. "Audit committees are very busy today," she said. "Those who have moved through the Section 404 process are now continuing to stabilize and reassess where they are in terms of the information they get. One of the hot issues for those who have worked through 404 is mergers and acquisitions and the due diligence associated with them, and getting the information they need to make better decisions on M&A transactions."
Bloxham also finds audit committees concerned about getting all of the information that is relevant to assessing enterprise risk management. They are also grappling with ongoing changes in accounting standards and a need for audit committee members with experience in finance and economics. At some companies, all members of the board of directors are sitting in on audit committee meetings.
Bloxham also identified a need to better understand the roles of internal and external auditors. "With the new promulgations by the Public Company Accounting Oversight Board on a more risk-based approach to 404, there's been a recognition that there needs to be more leeway in what internal audit brings to the table," she said. "But the other piece of that is making sure that the management team does its part in the internal control process, so that internal audit can act as an independent function."
