Today's audit committee members field questions about ransomware resilience, AI controls in financial reporting, and ESG disclosure consistency alongside the traditional work of managing external auditors and monitoring internal controls. According to NACD, 64% of S&P 500 companies now assign cybersecurity oversight to their audit committees — up from 59% the prior year.
This guide covers what an audit committee is, who qualifies to serve, what members are actually responsible for, and how effective committees operate in practice.
TL;DR
- Audit committees are legally required for U.S. public companies under SOX and must include at least three independent directors
- At least one member must qualify as a financial expert under SEC rules; all members must be financially literate
- Committee duties cover external auditors, financial reporting, internal controls, and risk and compliance oversight — not direct operations
- Boards are increasingly assigning cybersecurity, AI governance, and ESG reporting to audit committees rather than standalone committees
- S&P 500 audit committees meet an average of 8.1 times per year, with committee chairs earning a supplemental retainer averaging $30,648
What Is an Audit Committee?
An audit committee is a standing committee of the board of directors charged with independent oversight of financial reporting, internal controls, external auditors, and enterprise risk. It operates at arm's length from management — that independence is the whole point.
The legal foundation: The Sarbanes-Oxley Act of 2002 (SOX Section 301) directed the SEC to require national securities exchanges to prohibit listing companies that don't maintain compliant audit committees. Exchange Act Rule 10A-3 implements those requirements.
NYSE Section 303A and Nasdaq Rule 5605(c) layer on additional specifics about size, financial literacy, and committee responsibilities.
Nonprofits and regulated private companies also maintain audit committees. BoardSource describes them as the link between the independent auditor and the full board. FDIC regulations under 12 CFR Part 363 require audit committees for covered insured depository institutions above certain asset thresholds.
Key Facts at a Glance
| Requirement | Baseline |
|---|---|
| Minimum members | 3 (NYSE and Nasdaq) |
| Independence | All members must be independent directors |
| Financial expert | At least one required; publicly disclosed |
| Meeting frequency | Quarterly minimum; S&P 500 average is 8.1/year |
| Reports to | Full board of directors |
Audit Committee Membership Requirements
Independence and Eligibility
Every audit committee member must be an independent director. Under SEC Rule 10A-3, independence means no compensatory fees from the company beyond board retainers and no affiliated-person status. ISS 2025 proxy voting guidelines apply a five-year cooling-off period before former CEOs can serve — confirm current application details directly in the ISS policy before relying on this for governance decisions.
Every member — not just the financial expert — must meet the financial literacy standard. The exchanges define it differently:
- NYSE: Members must be "financially literate" as determined by the board
- Nasdaq: Members must be able to read and understand a balance sheet, income statement, and cash flow statement
This is a floor. Members can exceed it, and most effective committees do.
The Audit Committee Financial Expert
SOX Section 407 requires public companies to disclose whether at least one audit committee financial expert serves on the committee and, if not, why not. SEC Regulation S-K Item 407(d)(5) defines what qualifies:
- Understanding of GAAP and financial statement preparation
- Experience with comparable financial statements
- Experience with internal controls over financial reporting
- Understanding of audit committee functions
According to Spencer Stuart's 2024 U.S. Board Index, 65% of S&P 500 audit committee chairs have financial backgrounds, and 28% of all S&P 500 directors are identified as audit committee financial experts.
The chair doesn't have to be a CPA, and not every member needs deep accounting credentials. Committees now actively recruit for legal, operational, technology, and cybersecurity backgrounds to match their expanded oversight scope.
Committee Size and Composition
- Minimum of 3 independent members under NYSE and Nasdaq rules
- S&P 500 average is 4.5 members per committee
- Members generally cannot serve on more than three public-company audit committees simultaneously without board approval and public disclosure (NYSE requirement)
- Full board appoints members annually, typically on recommendation from the nominating/governance committee
Competency mapping against the committee charter has become standard practice for identifying gaps — technology and cyber risk literacy rank among the hardest seats to fill with qualified directors.
Core Duties and Responsibilities of Audit Committee Members
The audit committee's role is oversight, not execution. Members don't plan or conduct audits — they hold management and auditors accountable for the integrity of financial information and the effectiveness of internal controls.
Overseeing the Independent Auditor
SOX Section 301 is explicit: the committee — not management — is directly responsible for the appointment, compensation, retention, and oversight of the external auditor. The auditor reports to the committee, not to the CFO.
Key obligations include:
- Pre-approving all audit and permissible non-audit services
- Confirming auditor independence annually
- Monitoring lead partner rotation — SOX Section 203 limits the same lead or reviewing partner to five consecutive fiscal years
- Evaluating whether non-audit services undermine the auditor's objectivity
Financial Reporting and Internal Controls
The committee reviews financial statements, MD&A disclosures, earnings releases, and SEC filings before publication. When management and auditors disagree on an accounting treatment, the committee resolves it.
On internal controls, the committee reviews management's assessment of control effectiveness under SOX Section 302. That statute requires principal executives and financial officers to certify periodic reports and disclose significant deficiencies or material weaknesses directly to auditors and the committee.
Tracking remediation of those weaknesses is ongoing work, not a one-time checkbox.
Risk, Compliance, and Internal Audit Oversight
Risk and compliance responsibilities:
- Discussing major risk exposures with management and reviewing the enterprise risk management framework
- Establishing and monitoring whistleblower procedures (required under SOX Section 301)
- Reviewing compliance with the code of ethics and applicable regulations
- Overseeing the Chief Compliance Officer and legal matters with financial implications
Internal audit oversight:
- Reviewing and approving the internal audit charter and annual audit plan
- Reviewing significant findings from internal audits
- Maintaining authority over the appointment and performance evaluation of the head of internal audit — keeping this function independent from management pressure
Expanded Oversight: Cybersecurity, AI, and ESG
Boards have increasingly routed technology and sustainability oversight to audit committees because the existing risk and controls infrastructure is already there. The committee already knows how to ask hard questions about controls, reporting integrity, and escalation procedures — the same skills apply to new domains.
Cybersecurity Risk Oversight
NACD's 2025 reporting found that 93% of audit committee members rank cybersecurity as a top-three priority, and 71% include it on quarterly agendas. The SEC's 2023 cybersecurity disclosure rules require registrants to describe board oversight of cybersecurity risks and identify which committee carries that responsibility.
Effective cybersecurity oversight for audit committee members doesn't require becoming technical experts. It requires consistent briefings, stable metrics, and the right questions.
Questions every audit committee member should ask management:
- Who declares an incident, and who has authority to shut down systems if needed?
- What is the escalation path to the audit chair and full board, and what triggers it?
- Who speaks to customers, regulators, and investors during an incident — and have those roles been rehearsed?
- Who decides on ransom payments, and what's the policy?
- How fast can we restore critical services, and when did we last prove it with an actual test?
Boards that need independent translation of cyber risk into governance-grade reporting sometimes engage external advisors. Tyson Martin's practice, for example, is built specifically around giving audit committees directional reporting: structured dashboards, monthly summaries of what changed and what needs a decision, and quarterly deep dives on areas like ransomware readiness or third-party vendor concentration. The goal is showing whether risk is improving or deteriorating, not delivering raw data that requires technical interpretation.
AI Governance and Technology Risk
Audit committee oversight of AI is still developing. NACD's 2025 survey data shows roughly 21.8% of boards have assigned AI oversight to the audit committee — far lower than cybersecurity. The framework for what that oversight should look like is still maturing.
Where committees do carry AI responsibility, the focus areas include:
- Whether AI systems used in financial reporting or internal controls have adequate controls and auditability
- Bias checks in AI-assisted decision-making
- Escalation procedures when AI outputs are materially wrong or inconsistent
NACD and SEC guidance are the most current reference points as governance frameworks evolve. Audit committees shouldn't wait for perfect standards before asking questions — the right starting point is whether management can explain what AI is being used for, what controls exist, and who owns accountability for failures.
ESG Reporting Oversight
The SEC's climate disclosure rules, adopted in March 2024, are currently stayed pending judicial review, and the SEC voted in March 2025 to end its legal defense of those rules. Audit committees should not treat SEC climate disclosures as currently effective requirements.
Where ESG oversight does land on the audit committee's agenda — either through the company charter or stakeholder expectations — the focus should mirror financial reporting oversight. That means asking:
- Are disclosures consistent and verifiable?
- Do they align with applicable standards?
- Are the underlying controls adequate to support what's being reported?
Audit Committee Best Practices
Meeting Structure and Cadence
The NYSE requires audit committees to meet separately with management, internal auditors, and independent auditors — and these executive sessions matter. Issues that don't surface in joint meetings often emerge when parties speak privately. Most experienced chairs also conduct brief calls between formal meetings to stay current on developing issues.
The S&P 500 average is 8.1 meetings per year. Quarterly is the governance floor; most active committees exceed it, particularly in years with regulatory changes or material risk events.
Annual Self-Evaluation
Meeting cadence only matters if the committee periodically tests whether those meetings are working. Effective committees evaluate their own performance annually against the charter, applicable exchange standards, and governance best practices. That evaluation does three things:
- Identifies skill gaps before they surface as governance failures
- Updates the charter to reflect expanded responsibilities
- Reports findings transparently to the full board
Information Architecture That Enables Real Oversight
The difference between a committee that receives information and one that can act on it comes down to reporting format. Useful audit committee reporting includes:
- Trend-based dashboards with stable metrics over time — not one-off snapshots
- Direction of travel on key risk indicators (improving, stable, deteriorating)
- Decision memos that present options with cost, time, operational impact, and residual risk
- Clear owners and due dates on every open item
- Escalation triggers set in advance so the committee isn't making real-time calls about what constitutes a material issue
Raw data dumps give the committee volume without visibility. Trend-based reporting gives them something they can actually act on.
How to Become an Audit Committee Member
Most audit committee members reach the role through board nomination processes. The path typically looks like this:
- Establish independent director credentials — audit committee service requires independence, which means no material relationship to the company
- Demonstrate relevant expertise — financial expert roles require prior CFO, public accounting, or financial oversight experience; technology and cyber expertise addresses an oversight need few committees have adequately filled
- Engage in governance networks — NACD membership is frequently cited as a signal of board-readiness; active participation in governance communities puts candidates in front of nominating committees
- Complement existing committee composition — boards use competency gap analysis to identify what they're missing; candidates who can fill a specific gap have a clear value proposition
For directors building cybersecurity or technology credentials, active contribution through NACD, industry CISO councils, or regulatory advisory roles directly influences nominating committee decisions.
Compensation
Audit committee members are compensated as part of their overall director pay package. Retainers vary by role — chairs earn meaningfully more than members. According to Spencer Stuart's 2024 data:
| Compensation Component | S&P 500 Average |
|---|---|
| Total director compensation | $327,096 |
| Annual cash retainer | $144,077 |
| Audit committee chair supplemental retainer | $30,648 |
| Audit committee member retainer | $14,618 |
| Pay mix | 37% cash, 58% stock awards |
These are large-cap benchmarks. Mid-market company compensation will vary — the NACD director compensation survey provides sector- and size-specific ranges for more relevant comparisons.
Frequently Asked Questions
What are the duties of an audit committee member?
Audit committee members oversee financial reporting integrity, manage the relationship with the external auditor, monitor internal controls, and oversee risk and compliance processes. The role is oversight, not operations. Members hold management accountable rather than performing the work themselves.
Who is required to be on an audit committee?
For U.S. public companies, all members must be independent directors with no material relationship to the company. At least one must qualify as a financial expert under SEC rules. The full board appoints members, typically on recommendation from the nominating/governance committee.
How do you become an audit committee member?
Candidates typically serve first as independent board directors, selected based on financial literacy or relevant domain expertise (legal, operational, technology, cybersecurity). Most are sourced through governance networks and identified through competency gap assessments the nominating committee conducts to identify board skill needs.
How much do audit committee members get paid?
Members receive standard director compensation (cash retainer plus equity), with chairs typically receiving an additional committee retainer. Spencer Stuart's 2024 S&P 500 data reports an average audit chair supplemental retainer of $30,648 and a committee member retainer of $14,618 on top of base director fees.
What is the difference between an audit committee and the full board?
The full board holds overall governance responsibility. The audit committee is a delegated body focused specifically on financial oversight, external audit, internal controls, and risk — reporting its findings and recommendations back to the full board for final action where required.
How often does an audit committee typically meet?
Audit committees must meet at minimum quarterly, usually aligned with earnings filings and SEC reporting cycles. Most active committees meet six to ten times per year — the S&P 500 average is 8.1 — supplemented by executive sessions and interim calls between formal meetings.
