Writing an Audit Committee Charter That Actually Gets Used

At minimum, the charter should define the committee's composition and independence requirements, its authority to engage outside advisors without needing separate board approval each time, its role in selecting and evaluating the outside auditor, and its responsibility for overseeing financial reporting and the internal control environment. Vague language like the committee shall oversee financial matters as needed accomplishes nothing; specify what oversight actually means in practice, like reviewing the auditor's findings before they go to the full board, not after.

Consider the difference between two versions of the same clause. One says the committee will oversee related-party matters as needed. The other says management will bring every related-party transaction to the committee before signing, a named person will prepare the list, and the committee's decision will be recorded in the minutes. The second version can be followed, and it can be checked against your minutes later. When you review your charter, look for any sentence that describes a vague intention and rewrite it so it names a trigger, an owner and a recorded outcome. That small change is what separates a charter that gets used from one that sits in a folder.

The audit committee, not management, should be the one that hires, evaluates, and if necessary replaces the outside auditor, and the auditor should report findings to the committee directly rather than having management filter what the committee hears. This sounds obvious on paper but breaks down constantly in practice at smaller companies, where the CFO who's being audited also happens to be the one scheduling and attending every conversation with the auditor, effectively controlling what the committee actually learns.

A charter that promises quarterly meetings but produces two a year in practice isn't a governance failure on paper; it's one in practice, and it's exactly the kind of gap that surfaces during diligence.

• Review quarterly financials and any significant accounting judgments before they're finalized
• Meet privately with the outside auditor at least once a year without management present
• Review any whistleblower or internal complaint related to accounting or financial reporting
• Approve any significant related-party transaction independently of management

A committee member technically independent by title but financially or personally entangled with the CEO in practice doesn't provide real oversight, even if the charter's independence language is satisfied on paper. If your board is small enough that finding genuinely independent members is hard, be honest about that limitation with investors and lenders rather than papering over it with a technically compliant but practically toothless committee.

During diligence, expect a request for actual meeting minutes, not just the charter itself, and a comparison of what the charter promises against what the minutes show actually happened. A charter that says the committee meets quarterly and reviews the auditor's management letter, backed by minutes showing exactly that happened on schedule, is worth far more in diligence than a longer, more elaborate charter with no minutes to support it.

A charter written when the company was two people and a bank account stops fitting once you have a real controller, an outside auditor, and institutional investors on the cap table. Revisit it at least once a year, not to make it longer, but to check whether the committee's actual composition, authority, and cadence still match what's written down. A charter that hasn't been touched since it was first adopted is itself a signal that governance isn't being actively managed, which is exactly the kind of thing a sharp-eyed investor's diligence team will notice. Put the review itself on the calendar as a recurring agenda item, tied to your annual board meeting, so it happens by default rather than by memory.