First 90 Days as Audit Committee Chair: A Strategic Onboarding Guide for Effective Oversight
For audit and assurance professionals stepping into the critical role of Audit Committee Chair, the initial 90 days are paramount for establishing a strong foundation for effective oversight. This article outlines a strategic approach focused on deep understanding rather than immediate change, emphasizing the importance of reviewing governance frameworks, risk profiles, control environments, and assurance activities. By prioritizing information gathering and independent assessment, new Chairs can gain crucial insights into an organization's strengths, weaknesses, and areas requiring focused attention, ultimately leading to more informed decision-making and robust governance.
Laying the Groundwork: Understanding Governance and Risk
The initial 90 days for a new Audit Committee Chair are not about implementing immediate changes but rather about building a comprehensive understanding of the organization's operational landscape. A key priority is to thoroughly review the existing governance framework, including how responsibilities are structured, authority is delegated, and decisions are made. This also extends to assessing the organization's GRC maturity and its approach to emerging areas like AI governance, ensuring that the use of artificial intelligence aligns with ethical principles, regulatory obligations, and the organization's risk appetite. Concurrently, the Chair should delve into the Enterprise Risk Management (ERM) register to grasp the principal strategic, operational, financial, compliance, and emerging risks, including those related to cybersecurity and AI. Understanding the organization's risk appetite, tolerance thresholds, and the controls in place to mitigate these risks is crucial for effective oversight.
Assessing the Control Environment and Assurance Mechanisms
A critical step involves evaluating the organization's control environment through a detailed review of policy and procedure manuals. The Chair should ascertain if a comprehensive inventory exists for key risk areas such as financial reporting, cybersecurity, and regulatory compliance, noting their last review dates and accessibility. This provides insight into management's commitment to maintaining robust controls. Furthermore, understanding the assurance mechanisms in place is vital. This includes reviewing the Audit Committee Charter and the Internal Audit Charter to confirm the scope, independence, and reporting lines of the internal audit function. Examining outstanding internal audit recommendations and the external auditor's management letter will highlight recurring issues and significant control deficiencies, indicating areas where corrective actions may be lagging.
Strategic Information Gathering and Stakeholder Engagement
To ensure a holistic understanding, the new Chair must strategically gather information and engage with key stakeholders. Mapping the financial calendar and reviewing previous committee minutes and action trackers will provide context on past discussions, significant accounting matters, and unresolved issues. This helps align oversight activities with critical reporting obligations. Crucially, the Chair should conduct private one-on-one meetings with both the Head of Internal Audit and the External Auditors. These candid discussions offer invaluable independent assessments of the control environment, the 'tone at the top,' and any resource constraints or emerging concerns that might not be fully captured in formal reports. Establishing a regular, private communication protocol with these independent assurance providers reinforces the Audit Committee's oversight role and facilitates the identification of issues that require deeper scrutiny.
Read more
