12 Top Audit Committee Questions That Matter

An audit committee meeting should not end with a motion to accept the audit and a brief discussion of the financial statements. The top audit committee questions are designed to test whether the organization’s reporting, controls, and compliance practices can withstand scrutiny from funders, regulators, lenders, taxpayers, and the board itself. For organizations with public accountability, the audit is often the clearest picture your board will ever get of how financial stewardship is functioning.

The most useful questions do more than revisit numbers already printed in the audited statements. They help directors understand where judgment was required, where risk is changing, and whether management has the resources and discipline to address issues before they become reportable findings or operational disruptions.

Top Audit Committee Questions for Financial Oversight

1. What did the audit tell us that the financial statements alone do not?

Audited financial statements present results, financial position, and cash flows. They do not always explain the practical significance of accounting judgments, control observations, or areas that required substantial audit attention. Ask the auditor to identify the matters that most influenced the audit approach, including difficult estimates, unusual transactions, revenue-recognition judgments, related-party activity, or changes in accounting policies.

This question moves the discussion from acceptance to understanding. A clean opinion is meaningful, but it does not mean every process is equally strong or every risk has disappeared.

2. Were there any disagreements, adjustments, or difficult conversations with management?

The committee should ask both management and the independent auditor whether there were disagreements over accounting treatment, audit scope, disclosures, or access to information. Also ask about proposed adjustments, including those management recorded and those that were passed as immaterial.

A passed adjustment is not necessarily a problem. Auditors use materiality in performing their work, and some differences may reasonably fall below the threshold for correction. Still, a pattern of passed adjustments, recurring late entries, or resistance to straightforward corrections can indicate weaknesses in the close process or a culture that needs attention.

3. Are our significant estimates supported by current evidence?

Many organizations face estimates that can materially affect the statements: allowance for uncollectible receivables, fair value measurements, pension obligations, depreciation lives, reserves, impairment assessments, and contingent liabilities. Human-services providers, housing entities, schools, and organizations receiving government reimbursement may also encounter complex receivable and revenue estimates.

Ask what assumptions management used, what evidence supports them, and whether the assumptions changed from the prior year. The right answer may depend on the organization’s facts, but the board should understand where management judgment is concentrated and whether that judgment is documented and consistently applied.

4. What internal-control deficiencies were identified, and how serious are they?

Not every control issue rises to the level of a material weakness or significant deficiency. Yet less severe deficiencies can still create exposure if they affect cash disbursements, payroll, grant reporting, vendor setup, financial closing, or access to accounting systems.

The committee should ask for a plain-language explanation of each issue, its root cause, the compensating controls currently in place, and management’s remediation timetable. A finding is most useful when it leads to a named owner, a realistic completion date, and follow-up testing. Broad assurances that an issue will be addressed are not a remediation plan.

5. Have prior-year findings actually been resolved?

This is one of the most important top audit committee questions because repeat findings often signal that corrective action was not adequately designed, funded, or monitored. For Single Audits and Yellow Book engagements, unresolved findings can receive heightened attention from pass-through entities, oversight agencies, and future auditors.

Ask management to show what changed in the process, not simply state that the matter was corrected. For example, if timely bank reconciliations were a concern, the committee should know who prepares them, who reviews them, how exceptions are tracked, and whether the review is evidenced. A new policy without consistent execution is not a resolved finding.

6. What compliance requirements pose the greatest risk this year?

Compliance risk is not static. Changes in awards, program operations, leadership, procurement activity, subrecipient relationships, enrollment, reimbursement rules, or federal guidance can alter an organization’s exposure quickly.

For recipients of federal funding, the discussion should address major program determination, allowable costs, procurement, reporting, cash management, eligibility, subrecipient monitoring, and other applicable Uniform Guidance requirements. HUD-funded entities may need focused discussion of program-specific reporting and use-of-funds requirements. School districts and municipalities may need to consider state reporting, procurement rules, and the expectations of governmental oversight bodies.

The committee does not need to manage compliance tasks directly. Its role is to ensure management has identified the requirements, assigned ownership, and established monitoring before the year-end audit reveals a gap.

7. Is there any indication of fraud risk, conflict of interest, or management override?

Fraud-risk discussion should be direct and routine, not reserved for a crisis. Ask whether there were allegations, hotline reports, unusual journal entries, vendor concerns, payroll anomalies, conflicts of interest, or transactions involving related parties. Ask whether the organization’s controls can prevent or detect management override, particularly when a small finance team concentrates authority in a few individuals.

The goal is not to assume misconduct. It is to verify that the organization has credible mechanisms for disclosure, review, escalation, and investigation. A board that normalizes this conversation is better positioned to protect both the mission and the people responsible for carrying it out.

8. Are liquidity and going-concern risks being addressed early enough?

An organization can report positive net assets while facing near-term cash pressure. Restricted funding, delayed reimbursement, debt-service demands, expiring grants, enrollment changes, and rising labor costs can all affect liquidity. Ask management to explain available cash, restrictions on its use, debt covenants, expected operating needs, and contingency plans.

If there is substantial doubt about the organization’s ability to continue as a going concern, disclosure and audit implications may follow. More often, the issue is less immediate but still significant: the organization needs better forecasting, earlier covenant monitoring, or a more disciplined process for matching program commitments to reliable funding.

9. How secure are our financial systems and data?

Financial reporting now depends on information technology controls as much as traditional approvals and reconciliations. The committee should ask who has administrator access, how terminated employees are removed, whether key reports are reviewed for completeness, how backups are protected, and whether management has tested its response to a cyber incident.

The depth of this discussion should fit the organization. A large entity may need formal cybersecurity reporting and third-party assessments. A smaller nonprofit may need clear user-access reviews, stronger password controls, and better segregation of duties. In either case, financial and donor data deserve board-level attention.

10. Is the audit scope aligned with the risks the organization actually faces?

Audit scope is shaped by professional standards, materiality, risk assessment, and the engagement terms. The committee should understand what the audit covers and what it does not. A financial statement audit is not a forensic examination, a full operational review, or a guarantee that fraud will be found.

Where the organization has a targeted concern - such as procurement practices, executive expenses, grant billing, revenue cycles, or a suspected control breakdown - an agreed-upon procedures engagement or internal-control assessment may be more appropriate than expecting the annual audit to answer every question. The right engagement depends on the objective and the intended users of the results.

11. Is the auditor independent, and are communications candid?

Auditor independence is a governance safeguard, not a formality. Ask whether the audit firm has any relationships or services that could affect independence and whether the auditor has unrestricted access to the committee. The committee should also meet privately with the auditor, without management present, at least once during the audit cycle.

That private conversation gives the auditor room to discuss cooperation, tone at the top, pressure points, and any concerns that may not surface in a larger meeting. It also gives the committee a reliable channel for candid communication throughout the year.

12. What should the committee monitor before the next audit?

The best audit committees leave the meeting with a short, practical oversight agenda. That may include completion of a corrective action plan, quarterly liquidity reporting, a review of subrecipient monitoring, updated conflict-of-interest disclosures, or a status report on financial-system access.

The committee should distinguish between matters needing immediate escalation and matters requiring sustained monitoring. A well-designed follow-up process is often more valuable than adding another policy. It demonstrates that governance is active, informed, and connected to how the organization operates between audit cycles.

An effective audit committee does not try to replicate management’s work or the auditor’s testing. It asks focused questions, expects evidence-based answers, and follows through on commitments. That discipline gives leadership a stronger foundation for compliance, financial reporting, and mission-centered decision-making.