Should a Not-For-Profit Form an Audit Committee?
by Andrew Lotts, member, CJBS
With the Sarbanes-Oxley Act (SOX) of 2002, there has been limited direct impact on nonprofits, remembering that SOX is law for publicly traded companies only. However, many forward-thinking not-for-profits are asking themselves what parts of the SOX they should consider enacting as a part of best-practices. In fact, the Attorney Generals of several states have already implemented some Sarbanes-like reforms. Others are still in the study stage.
A recent trend among nonprofits is to adopt an audit committee structure. There are some pros and cons to this: If implemented correctly, an audit committee should provide the Board with a clear, independent voice to address financial matters. It also establishes that the auditors are neither engaged by nor report to management, but rather, the Board, through its audit committee. On the down-side, the committee members will need to devote the time and develop the expertise to effectively monitor increasingly complex financial practices.
Some of the duties of an audit committee are as follows:
- Engage the auditing firm
- Review the audit with the auditor
- Present the audit to the Board
- Provide an outlet for confidential reporting of any impropriety suspected by an employee with fear of management’s retribution (whistleblowers)
- Review the appropriateness of major accounting and internal control policies
- Protection of assets
Some major characteristics of an audit committee:
- Should have at least one member of the Board (preferably more than one)
- Should have a least one “expert” in the field on non-profit accounting/auditing (you may consider engaging such an individual if none are available from your volunteer base)
- Should meet several times a year
- Staff members normally do not serve on the committee
- Boards with high turnover may consider longer terms to retain institutional memory
Many nonprofits will find it difficult to populate such a committee with qualified individuals. If you create an audit committee, it has to actually do what it is designed for. Also, members of an audit committee face strong fiduciary responsibilities, though its presence does not diminish those of the Board itself; it’s important to remember that the creation of an audit committee does not absolve the individual directors on the Board from their director responsibilities.
Another alternative to consider is to augment the mission of an already standing finance committee. Such a committee may already possess individuals with the knowledge necessary. If this is the direction you wish to take, the Board would need to pass a resolution empowering the committee to do such work and the committee name should have “audit” in it; for example, “finance and audit committee.” The drawback to this approach is that if the finance committee makes major financial recommendations, the same committee would not be able to independently review these decisions. However, your existing finance committee is distinct from employee management so there is already a checks and balance system in place to a degree.
The bottom line is that people expect more from audit committees today, and the summary information below provides insight into audit committee leading practices that can help committees meet those expectations.
1. Financial Reporting and Disclosures
Financial reporting disclosure requirements have been steadily increasing for a number of years, in tandem with the complexity of accounting standards. Regulators and financial statement users continue to press companies for more information and to get that information sooner. This environment makes the audit committee’s responsibility to oversee the company’s financial reporting more difficult. The committee must be aware of the financial reporting risks to focus its attention appropriately. And it cannot lose sight of the need to maintain its skepticism.
2. Risk Management and the System of Internal Control
Given how many risks — known and unknown — a company faces, it’s a challenge for a board or audit committee to be assured that the organization is addressing risk appropriately. One of the difficulties facing the audit committee is clearly defining its risk responsibility relative to that of the entire board. While the company’s system of internal control is designed to help mitigate risk, the audit committee focuses particularly on controls relating to financial reporting, fraud, and compliance. Most existing finance committees have a history of handling these matters.
3. Oversight of Management and Internal Audit
The audit committee needs to oversee management while taking care not to step into management’s role. Establishing an effective relationship with management is essential — it allows the committee to effectively monitor the company’s financial reporting practices and evaluate management’s competence. Similarly, the committee relies heavily on internal audit or the external auditors to provide an objective view on how the company is handling a number of key risks, including those relating to financial reporting and compliance. (Traditionally, non publicly traded entities and not-for-profits do not specifically have controls tested as this is typically outside the scope of a financial audit.)
4. Relationship with External Auditors
The audit committee has to select the right external auditors to conduct a quality audit. As part of executing their audit plan, the external auditors provide the audit committee with assurance regarding the company’s financial reporting. Additionally, external auditors are in a unique position to provide unfiltered and unbiased feedback to the committee about management and the company’s processes.
5. What to Do When Things Go Wrong — Financial Statement Errors and Fraud Investigations
At times, breakdowns in financial reporting processes lead to potential errors in previously issued financial statements. Management and the audit committee have to assess whether an error is material and, if it is, take steps to resolve the situation. The situation can become more complex if the error results from fraud.
6. Committee Composition
Composition and leadership are critical in supporting the audit committee’s ability to carry out its responsibilities effectively. The committee needs the right combination of skills and experience. It also needs a chair with the knowledge and commitment to drive the committee’s work.
7. Meetings
To ensure committee meetings run well, the committee needs to have the right agenda and receive the right materials beforehand. The attendees, and how they interact with committee members, also influence the success of meetings. Given how many responsibilities the committee has, it needs to ensure it is meeting often enough and at the right points during the year.
8. Supporting Committee Effectiveness — Charter, Evaluations, Resources, and Training
The audit committee’s charter helps distinguish the committee’s responsibilities from those of the full board of directors. An audit committee that periodically evaluates its performance will be able to identify ways to improve its effectiveness. Orientation training for new members and ongoing development for all members are essential, particularly given the velocity of changes to financial reporting and governance standards.
We have found that maintaining a sub-committee for dealing specifically with auditor level matters and other potentially sensitive areas has been an effective tool for many of our not-for-profit clients. The rigid audit committee structure, separate charter and additional layer of communication are often just too much to maintain effectively for many of our clients. The key still gets back to effective communication and efficient dissemination of important information, responsive management and implementation of controls within the organization to ensure successful outcomes.
In general, we find that larger not-for-profits, typically greater than $25 million in gross receipts, with complex programs, multiple sites, and relatively large volumes of transactions have audit committees. We believe that the relative complexities found at the larger organizations necessitate the use of an audit committee because it enhances communication and strengthens the organizations that have these characteristics.
Once again, having an audit committee is not a requirement for nonprofits, but in today’s marketplace, with its heightened scrutiny, everyone should explore all alternatives to best safeguard the resources they have been entrusted with. This is only a snapshot of some of the considerations involved. To discuss any of these issues or for more information, please feel free to contact me.
Best regards,
More News & Insights