EY Audit Committee Guide 2026

Page 1

EY Audit Committee Guide 2026

International considerations for audit committees

EDITION

PRIMARY AUDIENCE

CORE PURPOSE

February 2026

Audit committee members, chairs and

governance leaders

Practical oversight and effectiveness

At a glance

Audit committees are a board-level governance mechanism responsible for oversight rather than day-to-day management.

Their remit commonly includes corporate reporting, risk management, internal controls and the external audit, with

additional responsibilities shaped by jurisdiction, sector and the organization’s governance structure.

The guide’s organizing framework

Dimension

Focus

Practical question

Who

Right individuals at the right time

Do members have the independence, skills, experience and

capacity required?

How

High-performing leadership team

Does the committee receive the right information and

encourage challenge?

What

Oversight that supports long-term

value

Is the committee focusing on reporting, risk, controls,

stakeholders and audit quality?

Constraints

Operating environment

Are laws, regulations, ownership structures and local

expectations reflected?

Core principle

The audit committee should preserve objectivity and constructive challenge. Its role is to oversee, question and

evaluate, not to step into management’s operational responsibilities.

Guide map

Introduction •

About the guide •

Who •

How •

Tone & stakeholders •

Risk & controls •

Corporate

reporting •

External audit •

Other responsibilities •

Effectiveness

EY Audit Committee Guide 2026

Page 2

01. Introduction to Audit Committees

Audit committees are subcommittees of the board or supervisory board, depending on the governance structure. Their

purpose is closely linked to confidence in corporate information and the quality of oversight provided to stakeholders.

Evolution of the remit

Historically, audit committees were strongly associated with financial reporting and the appointment and oversight of

auditors. Modern organizations face more complex technology, risk, sustainability, data and regulatory environments. As a

result, audit committee agendas can extend beyond traditional financial reporting while remaining anchored in governance

and oversight.

Public and private organizations

Requirements vary significantly by jurisdiction, sector and ownership structure. Listed companies may face statutory, listing

and governance-code requirements. Private organizations may choose a different level of formalization according to their

needs, risks, ownership and stage of development.

Oversight, not management

Even where the committee has a broad remit, it should avoid becoming operational. Maintaining an independent

perspective is important when challenging management judgments, reviewing reporting and acting as a sounding board for

senior executives.

Working reference

Area

Committee perspective

Reporting

Is the information reliable, balanced and consistent?

Risk

Are principal and emerging risks identified and addressed?

Controls

Are controls designed and operating effectively?

Audit

Is the external audit independent, effective and appropriately challenged?

EY Audit Committee Guide 2026

Page 3

02. About the Guide: A Jurisdiction-Agnostic Approach

The 2026 guide is designed around common expectations rather than a single legal regime. Local laws, governance codes,

listing requirements and organizational structures remain important constraints.

Using the guide in practice

1. Start with local requirements.

Identify the laws, listing rules, governance code and sector-specific obligations that apply.

2. Map responsibilities.

Compare the committee charter and annual workplan with those requirements.

3. Identify gaps.

Look for responsibilities that are unclear, duplicated or insufficiently covered.

4. Adjust for context.

Consider ownership, board structure, business model, risk profile and organizational maturity.

Public versus private companies

The governance expectations applicable to listed entities should not automatically be imposed on private businesses.

Private companies may use the guide’s questions selectively, adapting governance mechanisms to their circumstances.

Chair considerations

The chair has responsibilities beyond formal meetings, including setting the agenda, maintaining appropriate relationships

with management and assurance providers, and ensuring that the committee has sufficient time and information to

challenge material matters.

Use of self-evaluation questions

The guide uses questions as practical prompts for assessing committee effectiveness. They can be incorporated into

annual evaluations, meeting planning and committee development activities.

EY Audit Committee Guide 2026

Page 4

03. Who: The Right Individuals at the Right Time

An effective audit committee needs members with appropriate independence, skills, experience, knowledge and capacity.

The exact requirements differ across jurisdictions.

Independence of mind

Independence is important because members need to be able to challenge management and raise concerns without being

unduly influenced by relationships or other interests.

Potential consideration

Why it matters

Executive employment

Current or recent executive involvement can affect independence.

Business relationships

Significant relationships can create actual or perceived conflicts.

Family relationships

Relevant family connections may affect independence assessments.

Audit-firm relationships

Recent relationships with the external audit firm can require consideration of

cooling-off rules.

Tenure

Long service can create actual or perceived independence concerns in some

jurisdictions.

Financial literacy and broader skills

Members commonly need financial expertise, but financial competence alone may not be sufficient. Depending on the

remit, useful capabilities can include technology, cybersecurity, sustainability reporting, industry knowledge, risk, regulation

and data.

Succession and development

The committee should consider future capability needs when appointments and succession are discussed. Existing

members also need continuing development as standards, technologies, reporting expectations and risks evolve.

Capacity

Time is a practical requirement. Members need enough capacity to prepare for meetings, read papers, engage with

management and assurance functions, and follow up on significant issues.

EY Audit Committee Guide 2026

Page 5

04. How: Working Together as a High-Performing Leadership Team

Committee effectiveness depends not only on individual competence but also on group dynamics. The 2026 framework

emphasizes cognitive diversity, good information and a culture in which dissenting or challenging views can be expressed.

Constructive challenge

1. Prepare.

Members should read the relevant briefing materials before meetings.

2. Question assumptions.

Challenge material judgments, forecasts, estimates and proposed responses.

3. Invite dissent.

Make space for alternative views and contrary evidence.

4. Reach clear conclusions.

Record decisions, actions, owners and follow-up expectations.

Meeting design

Meeting element

Good practice

Agenda

Prioritize material matters and reserve enough time for debate.

Briefing papers

Provide relevant information early enough for members to prepare.

Specialist input

Bring independent expertise where internal knowledge is insufficient.

Private sessions

Use appropriate sessions with internal audit and external audit to encourage candid discussion.

Follow-up

Track agreed actions and unresolved issues to closure.

Virtual, physical and hybrid meetings can be used where permitted and appropriate to the committee’s annual cycle and

local requirements.

EY Audit Committee Guide 2026

Page 6

05. Tone at the Top and Stakeholder Engagement

The whole board typically oversees corporate culture, while the audit committee often has a specific role in compliance

culture, risk culture, control consciousness and integrity-related oversight.

Integrity and ethical conduct

The committee can reinforce the code of conduct through its own behavior, visibility into how the code is promoted and

enforced, and attention to whether employees can raise concerns without fear of retaliation.

Fraud, bribery, corruption and misuse of data

The committee should understand the incentives and pressures that can contribute to fraud or misconduct and should

consider how management identifies, assesses and responds to these risks.

Whistleblowing

Oversight should include visibility into whistleblowing arrangements, significant reports, investigation processes and

whether issues are escalated appropriately.

Stakeholder engagement

Audit committee chairs may interact with senior executives, employees, shareholders and regulators on matters within the

committee’s remit. Communications should be accurate, transparent and consistent with the committee’s oversight

responsibilities.

Questions for the committee

• Can members demonstrate integrity and accountability through their own actions?

• Does the committee understand how the code of conduct is promoted and enforced?

• Are whistleblowing arrangements credible and sufficiently visible?

• Are fraud, bribery, corruption and data-misuse risks receiving appropriate attention?

• Does stakeholder engagement provide useful information for oversight?

EY Audit Committee Guide 2026

Page 7

06. Risk Management and Internal Controls

Audit committees increasingly oversee a wider range of risks, including economic, financial, geopolitical, technology,

cybersecurity, environmental and social risks. Their role is to challenge and oversee, not to manage risks directly.

The Three Lines Model

Line / role

Primary responsibility

Governing body

Sets direction and risk appetite; oversees management and internal audit.

First line

Operational management identifies and manages risks and operates controls.

Second line

Risk and control functions provide expertise, monitoring and management assurance.

Third line

Internal audit provides independent assurance over the effectiveness of governance, risk

management and controls.

Principal and emerging risks

The committee should understand the principal risks facing the organization, how risks are interconnected, and how

management responses align with the board’s risk appetite. Emerging risks require particular attention because their

potential impact may be significant even when the likelihood or consequences are not yet fully understood.

Internal controls

Effective oversight requires information about control design, implementation and operating effectiveness. The committee

should receive regular reporting from finance, internal audit and other relevant functions and challenge management’s

conclusions where appropriate.

Internal audit

Internal audit commonly serves as an important source of independent assurance. The committee should consider the

quality, scope, resources and independence of internal audit and monitor implementation of significant recommendations.

EY Audit Committee Guide 2026

Page 8

07. Oversight of Corporate Reporting

Oversight of audited financial statements is a core responsibility. The committee should understand how financial reporting

is produced and challenge significant accounting judgments, estimates and disclosures.

Accounting policies and estimates

Topic

Committee focus

Accounting policies

Appropriateness, consistency, material judgments and voluntary changes.

Estimates

Methods, models, assumptions, inputs and uncertainty.

One-off transactions

Acquisitions, disposals, unusual or complex transactions and off-balance-sheet arrangements.

Future standards

Readiness for mandatory changes in accounting requirements.

Alternative performance measures

Where alternative performance measures are used, the committee should consider whether they are clearly defined,

consistently calculated and presented in a way that improves transparency rather than obscuring the accounting-based

measures.

Related party transactions

The committee should understand the processes used to identify and disclose related party transactions and challenge

assertions that transactions were conducted at arm’s length where appropriate.

Going concern and financial narrative

The committee should scrutinize going-concern assessments, including assumptions about forecasts and funding, and

compare the narrative sections of the annual report with the financial statements for consistency.

Environmental and social reporting

Where the committee has oversight, it should consider data collection, provenance, assumptions, regulatory requirements,

integration with financial reporting and external assurance.

EY Audit Committee Guide 2026

Page 9

08. Overseeing the External Audit

The audit committee typically owns the relationship with the external auditor, including appointment, remuneration,

oversight and consideration of independence. The precise legal responsibilities depend on jurisdiction.

Independence and objectivity

The committee should challenge how auditor independence is assessed and consider non-audit services, financial or

business relationships, employment relationships and long association or rotation requirements.

Auditor tendering and appointment

A tender process may involve timing considerations, selection criteria, meetings, site visits, technical presentations, written

submissions and interviews.

Selection criterion

Questions to consider

Technical capability

Does the firm have the accounting and auditing expertise required?

Geographic reach

Can the auditor support the organization’s locations and complexity?

Technology

Can advanced tools and approaches support audit quality and insight?

Key personnel

Are the proposed partners and specialists suitably experienced?

Value

Is the proposed scope, effort and fee appropriate?

Audit planning and execution

The committee should scrutinize the audit plan, scope and planned procedures, monitor progress, review significant

findings and challenge management’s response to audit differences and management-letter observations.

Audit quality indicators

Useful indicators can include regulatory inspection results, technical expertise, partner workload and responsiveness, and

progress against audit milestones.

Non-audit services

The committee should oversee policies governing non-audit services and consider both formal independence requirements

and how services could reasonably be perceived by an external observer.

EY Audit Committee Guide 2026

Page 10

09. Other Areas of Responsibility

The exact allocation of responsibilities varies. Depending on the organization and jurisdiction, audit committees may

oversee or contribute to additional areas that have a material effect on reporting, risk or governance.

Financial condition, going concern and solvency

The committee may review financial projections, liquidity, funding, debt management, covenant compliance and the

assumptions underpinning going-concern assessments.

Funding and dividend capacity

Where assigned to the committee, oversight can include how debt is managed, how covenants are monitored and what

funding options management is considering.

Related party transactions

The committee should understand the policies and procedures for identifying, approving and disclosing related party

transactions.

Cybersecurity

Cybersecurity is increasingly treated as an enterprise risk rather than solely an IT issue. Oversight should consider

governance, risk exposure, incident preparedness, resilience, reporting and access to appropriate expertise.

Artificial intelligence and emerging technology

New technologies can create financial, operational, regulatory and reporting implications. The committee should

understand how significant technology-related risks are identified, governed and reflected in its broader risk and control

framework.

Deep dives and mandated topics

Where regulations or the committee charter assign specific topics, those responsibilities should be mapped into the annual

workplan with sufficient time and expertise for effective oversight.

EY Audit Committee Guide 2026

Page 11

10. Evaluating Audit Committee Effectiveness

Self-evaluation supports continuous improvement. An effective evaluation should consider both the committee’s formal

responsibilities and how effectively members work together.

Annual evaluation checklist

Dimension

Questions

Composition

Does the committee have the right skills, independence, experience and capacity?

Information

Does it receive clear, timely and decision-useful information?

Challenge

Are difficult questions and dissenting views encouraged?

Reporting

Is oversight of financial and nonfinancial reporting sufficiently robust?

Risk & controls

Can the committee challenge management’s view of principal and emerging risks and controls?

External audit

Is audit independence, quality and effectiveness adequately assessed?

Follow-up

Are findings and agreed actions tracked to completion?

Chair action plan

1. Review evaluation results.

Identify recurring themes, gaps and areas requiring deeper attention.

2. Prioritize improvements.

Distinguish urgent governance issues from longer-term capability development.

3. Assign owners.

Set accountable individuals and target dates.

4. Revisit progress.

Include material improvement actions in subsequent committee agendas.

Self-evaluation questions should be used as prompts rather than as a mechanical scorecard. The appropriate approach

depends on the organization, jurisdiction and committee remit.

EY Audit Committee Guide 2026

Page 12

Practical Annual Workplan

A robust annual workplan helps ensure that recurring responsibilities are covered while preserving time for significant and

emerging issues.

Cycle

Typical focus

Preparation / evidence

Planning

Audit strategy, risk landscape, committee

priorities

Risk assessment, annual plan, prior-year findings

Reporting

Financial statements, estimates,

disclosures, narrative reporting

Draft accounts, accounting papers, management

judgments

Controls

Internal control effectiveness and internal

audit

Control reporting, internal audit reports, remediation status

External audit

Audit plan, independence, quality, findings

Audit plan, independence confirmations, AQIs, findings

Risk

Principal, interconnected and emerging risks

Risk register, scenario analysis, response plans

Culture

Integrity, compliance, whistleblowing and

fraud risk

Culture metrics, investigations, hotline reporting

Effectiveness

Self-evaluation and capability development

Evaluation findings, skills matrix, action plan

Meeting discipline

• Distribute material briefing papers with enough time for preparation.

• Reserve meeting time for debate, not only presentation.

• Use private sessions where appropriate to enable candid discussion.

• Document conclusions, unresolved questions and action owners.

• Carry significant issues forward until management provides sufficient evidence or remediation.

EY Audit Committee Guide 2026

Page 13

Audit Committee Quick Reference

Use this page as a compact working checklist for committee members and chairs.

Before each meeting

• Read the agenda and supporting papers before the meeting.

• Identify assumptions, estimates, inconsistencies and areas requiring challenge.

• Consider whether external or internal specialist input is needed.

• Review open actions and unresolved audit or control findings.

• Prepare questions that focus on evidence, not only management conclusions.

During the meeting

• Encourage different views and constructive disagreement.

• Distinguish oversight from management execution.

• Ask whether risk responses align with the board’s risk appetite.

• Test whether information is complete, balanced and consistent.

• Confirm clear decisions, actions and follow-up.

After the meeting

• Record decisions and assigned actions.

• Confirm owners and expected completion dates.

• Escalate matters requiring full-board attention.

• Maintain appropriate private dialogue with internal and external assurance providers.

• Update the annual workplan where emerging issues change priorities.

Core principles

Principle

Practical meaning

Independence

Maintain an objective perspective and challenge where necessary.

Skepticism

Test judgments, assumptions and evidence rather than accepting conclusions

automatically.

Clarity

Focus meetings on material matters and decision-useful information.

Diversity of thought

Create room for dissenting and contrarian views.

Oversight

Monitor and challenge without taking over management’s responsibilities.

Continuous learning

Refresh skills as risks, standards, technology and reporting expectations evolve.

Closing reminder

Audit committee effectiveness depends on the right people, the right information, constructive challenge and

disciplined oversight. The committee should adapt its work to the organization’s circumstances while remaining

attentive to applicable laws, regulations and governance requirements.

EY Audit Committee Guide

Prompt to Clone This EY Audit Committee Guide

Apply this example's core structure, strategic pacing, and structural hierarchy directly to your own topic.

What are you generating today?

IBM Garage Methodology Guide

Red Hat Enterprise Linux Subscription Guide

Snowflake Comprehensive Guide to Dynamic Tables

The Zero to Snowflake Quickstart Guide

Workday AI Guide

The MongoDB Get Started Guide

Cloudflare Deploy cloudflared in AWS Guide

Fannie Mae Selling Guide

Similar Examples