The Board Committee Series | Part 1: The Audit Committee

This is the first in a four-part series examining the core board committees that every well-governed organization needs. Last month, we explored why every committee must have a current, board-approved Terms of Reference. That article is the foundation for this series - find it here.

Of all the committees a board can establish, the Audit Committee carries the heaviest accountability. It sits at the intersection of financial integrity, regulatory compliance, and board oversight. When it is not functioning properly, the consequences are rarely quiet.

In Kenya, the CMA Code of Corporate Governance Practices for Issuers of Securities to the Public 2015 mandates the establishment of an Audit Committee for listed companies. The Public Finance Management Act 2012 requires it for all public entities, including county governments. The CBK Prudential Guidelines mandate it for licensed banks. And the Mwongozo Code makes it a governance expectation for all state corporations.

What the Audit Committee Is Actually For

The Audit Committee exists to provide independent oversight of three interconnected areas:

Financial reporting Ensuring that the organization’s financial statements present a true and fair view, that accounting policies are appropriate, and that management's judgements in preparing the accounts are sound.

Internal controls Reviewing the adequacy and effectiveness of the systems that prevent error, fraud, and financial mismanagement. The committee is the primary interface between the board and the internal audit function.

External audit Managing the board's relationship with the external auditor. This includes recommending the auditor's appointment or reappointment, reviewing audit findings, ensuring audit recommendations are implemented, and safeguarding auditor independence by monitoring and approving any non-audit services the auditor provides.

Compliance It also oversees compliance with financial regulations, legal requirements, and the organization’s own governance policies. In regulated sectors like banking, insurance, SACCOs, this compliance oversight is both broader and more detailed.

Composition: Who Must Sit on the Audit Committee

The CMA Code explicitly provides that the Audit Committee shall comprise of at least three independent and non-executive directors. A director who has a financial, personal, or professional relationship with management that could compromise their objectivity does not qualify, regardless of their formal designation.

The chair of the Audit Committee must have financial expertise. The committee's work - reviewing financial statements, interrogating audit findings, assessing the adequacy of internal controls - demands someone who can read and challenge a set of accounts with genuine understanding.

The CEO and CFO do not sit on the Audit Committee, though they attend by invitation to respond to queries. This distinction matters enormously, the committee's independence from executive management is what gives its oversight value.

The Relationship with Internal Audit

One of the most important and most frequently misunderstood aspects of the Audit Committee's role is its relationship with the internal audit function.

Internal audit reports functionally to the Audit Committee, not to management. In practice, many organizations structure internal audit as a management function, with the head of internal audit reporting to the CFO or CEO. This creates a fundamental independence problem: the function responsible for monitoring management cannot credibly do so if it is managed by the people it is supposed to monitor.

Best practice requires the Audit Committee to approve the internal audit charter, review and approve the annual internal audit plan, receive all internal audit reports directly, and evaluate the performance and independence of the head of internal audit. Where the internal audit function is outsourced, the committee should also oversee the procurement and performance of the service provider.

Common Failures and Their Consequences

The Audit Committee failures that create real governance risk are usually not dramatic. They are quiet and cumulative.

· A committee that meets only to receive management-prepared papers - without independent challenge or follow-up on prior findings. This provides the appearance of oversight without the substance.

· An audit chair without financial expertise - who defers to the CFO on every technical matter. Such a chair has inverted the oversight relationship the committee exists to provide

· A committee that approves external auditors without assessing independence -particularly where the auditor also provides significant consulting services. This creates the conditions for conflicts of interest to go undetected

· Audit recommendations that are noted but not implemented - This pattern that signals to external auditors, regulators, and investors that the committee lacks the authority or will to enforce accountability.

What a Strong Audit Committee TOR Must Include

Referencing last month's TOR article, a fit-for-purpose Audit Committee TOR must specifically address:

1. The committee's authority to commission independent investigations without management approval

2. The scope of its oversight of both internal and external audit functions

3. The process for reviewing and approving non-audit services provided by the external auditor

4. Whistleblowing. How concerns raised under the organization’s whistleblowing policy are escalated to and reviewed by the committee

5. The minimum financial qualifications required of the committee chair

The Audit Committee as the Board's First Line of Assurance

A well-functioning Audit Committee does not protect organizations from fraud or financial failure by catching every problem. It protects organizations by creating the conditions in which problems are harder to hide, faster to surface, and more certain to be addressed.

That is the standard worth holding. And it begins with a committee that is genuinely independent, genuinely skilled, and genuinely empowered to ask the questions that management would sometimes prefer not to answer.

Next week: The Board Committee Series | Part 2: The Risk Committee

For support establishing or reviewing your Audit Committee's structure, Terms of Reference, and effectiveness, Azali CPS provides governance advisory services across Africa. admin@azali.co.ke | +254 707 456 140