Charta is on Google Play: practise on the go. Get the app
Charta

Assess the part played by a firm's audit committee and the responsibilities it carries.

FRM® Part I · Foundations of Risk Management · The Governance of Risk Management · FRM1.FR.3.f

The idea

The audit committee is a board committee made up, under common good practice and in many listed-company regimes, of independent directors, at least one with financial expertise. The requirements vary by jurisdiction. Its core duties are overseeing the integrity of financial statements, the effectiveness of internal controls over financial reporting, the internal audit function and the external auditor. In many jurisdictions it appoints and pays the external auditor. It typically also judges the auditor's independence and pre-approves non-audit services. It receives internal audit reports directly, since in good practice internal audit reports functionally to it. It also meets auditors without management present and handles whistleblower complaints. It oversees compliance with law and regulation, and tracks management's remediation of audit findings. It does not set risk appetite or run risk models. That is for the board and its risk committee, and for management. Confusing audit committee and risk committee duties is the typical exam trap.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which description of the composition of an audit committee reflects good practice?

  1. The CEO and CFO, who know the firm's accounts bestWhy not: Executives who prepare the accounts cannot independently oversee them; the committee must be independent.
  2. Independent directors, with at least one member who has financial expertise - correct
  3. Senior executives from the business lines, so that the committee understands risk-takingWhy not: Business-line executives would oversee themselves, destroying the committee's independence.
  4. The head of internal audit as chair, with the remaining members drawn from managementWhy not: Internal audit reports to the committee and is not a director; a committee drawn from management lacks independence.

Audit committees must be independent of management and include financial expertise, so that they can challenge reporting, controls and the auditors.

A harder one

To preserve its independence, to whom should the internal audit function report functionally?

  1. The chief financial officerWhy not: The CFO is responsible for the financial reporting that internal audit tests, creating a conflict.
  2. The chief risk officerWhy not: The CRO is within the second line, which internal audit independently assesses.
  3. The head of the largest business lineWhy not: A business head is part of the first line audited by internal audit, which would be a conflict.
  4. The audit committee of the board - correct

Internal audit reports functionally to the audit committee (administratively to the CEO) so that it can assess all functions, including finance and risk, without management pressure.

The hardest tier

Internal audit reports to the audit committee that the validation of a key credit model has been inadequate for 18 months and that management has not acted. Which response best fits the audit committee's responsibilities?

  1. Ask internal audit to rebuild and validate the model itself, to speed up resolutionWhy not: Doing the validation work would make internal audit audit its own work and compromise its independence.
  2. Accept management's position, since managing model risk is a management responsibilityWhy not: Management owns the risk, but the committee must oversee that identified control gaps are fixed, not just accept inaction.
  3. Ask the external auditor to approve the model, because the auditor is independentWhy not: The external auditor opines on the financial statements and should not validate management's models, which would impair its independence.
  4. Require a remediation plan with deadlines, track it to closure, challenge management and escalate to the board if it remains unresolved - correct

The audit committee monitors management's response to audit findings. It does not perform the controls itself, but it must make sure significant weaknesses are fixed and escalate if they are not.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in The Governance of Risk Management