Short of a crisis, the issues on the audit committee's radar don't change dramatically from year to year (and they probably shouldn't); but sometimes small shifts tell a big story.
In our 2015 Global Audit Committee Survey, it comes as little surprise to see all four top concerns carried over from last year: economic and political uncertainty and volatility, regulation and public policy initiatives, legal/regulatory compliance, and operational risk. Clearly, a slowing global economy, the flare-up of geopolitical hotspots, and the proliferation of major cyber breaches have intensified the spotlight on these issues. But for many audit committees today, these headline risks are also driving a slower-moving — yet critically important — trend potentially impacting the audit committee's
effectiveness: agenda overload.
Audit committee members, by and large, continue to express confidence in their oversight of the company's financial reporting and audit quality. But the increasing complexity of the business and risk environment is stretching and straining many audit committee agendas with new or more-challenging risks to oversee in the areas of compliance, IT, cybersecurity, and more. Of the 1,500 audit committee members responding to our global survey, three out of four said the time required to carry out their responsibilities has increased, and half said it is increasingly difficult for the audit committee to effectively oversee the range of risks on its agenda.
In a positive development, more boards are reallocating risk oversight responsibilities among their committees and the full board — which bodes well for audit committees. But heavy agendas are probably here to stay. In addition to reassessing their responsibilities for risk, what more can audit committees do to tackle their heavy agendas? Here are a few suggestions we're hearing from audit committee members:
• It's the 80-20 rule: Focus on those few things with the greatest impact. The audit committee needs to determine what really matters and make sure the committee focuses on those issues and devotes the proper time and attention to them. If you try to do everything equally, you will get overwhelmed. Clearly, financial reporting and related internal control risks is job No. 1 for the audit committee; however, to address these issues efficiently (and free up time for more substantive issues facing the business), the audit committee needs to develop a high level of comfort with both management and the external auditor that the basic mechanics of the company's financial reporting and controls are, in fact, under control.
• Make sure the committee is getting “information” and not just data — from business and functional leaders as well as internal and external auditors. With real “information,” the committee will be in a position to discuss and provide insight regarding the critical issues facing the business, and probe whether everyone at the table understands the risks, how the risks are being mitigated, what controls are in place, and whether the controls are working.
• Consider how the committee might improve its efficiency and make the most of its meetings. To streamline committee meetings — and allow more time for discussion and questions — insist on quality pre-meeting materials (and expect pre-read materials to be read), and limit management “presentations” and the use of PowerPoint. Conclude (and sometimes begin) each meeting with an executive session so that members have an opportunity to discuss important matters privately.
• Understand that it can't all be done at the formal committee meetings — “between meeting” work is essential. One of the biggest changes in audit committee service in recent years is the degree of engagement. Today, the depth and breadth of audit committee engagement has made oversight a much more time consuming job, particularly at larger, more complex, global companies. As one audit committee chair said, “To be truly effective, the audit committee needs to get up and out of the corporate headquarters,” seeing things and talking to people in their own offices and workplaces. It's entirely appropriate and even desirable for audit committee members — particularly the chair — to meet with members of management and the outside auditor between regularly scheduled meetings, to have more in-depth discussions on some of the issues that are developing.