Most advice for new audit committee members is about the packet. Read the financials closely, understand the critical accounting estimates, know what the auditor found. All of that matters.
In building tools for audit committees, though, the point we heard most often from members was different. The larger risk is rarely misreading this quarter’s materials. It is the area nobody has looked at in three years.
An audit committee’s work is a year, not a meeting. There are the quarterly sessions, a session to set the internal audit plan and one to evaluate or select the outside auditor. Each meeting covers what is on its agenda. What falls between the meetings is the part that gets missed.
The job also keeps getting bigger. In the 2026 Audit Committee Practices Report from Deloitte and the Center for Audit Quality, enterprise risk management ranked as the top priority for audit committees, and 54% of respondents said their committee had grown more focused on emerging risks over the past year. Seventy-five percent named AI governance as a top-three priority, up from 35% the year before, yet only 56% were confident in their committee’s ability to oversee it (Deloitte). For public companies, add the SEC’s cyber disclosure rule, which requires a material incident to be disclosed within four business days of the company determining it is material (Skadden). The committee is now carrying far more than any one member can hold in their head.
So what does “prepared” mean for an audit committee member?
We work from nine areas at every sitting. Do the numbers tie out? Is anything missing from the packet? How aggressive are the estimates? What changed against prior periods? Then auditor independence, internal controls, risk oversight, compliance and ethics, and the quality of disclosure. A new member can use those nine as a checklist with or without software.
Across every sitting, though, three questions matter more than any single area, and they are the ones most often skipped.
The first is commitments. What did management promise at the last meeting, and did it happen? A remediation plan for a control deficiency, or a follow-up analysis the committee asked for. These are agreed in the room and recorded in the minutes. Then they often go unchecked at the next meeting, because no one is responsible for remembering them.
The second is coverage. Which areas has the committee not reviewed this cycle? Some go years without a real look, like a subsidiary’s controls or the whistleblower process itself. Coverage gaps never show up in the packet, because the packet describes what management chose to present.
The third is absence. “Not in this packet” does not mean “not happening.” When a topic you expected to see is missing, ask where that work is being covered. Sometimes the answer is a report you haven’t seen yet. Sometimes there is no good answer, and that is the finding.
Altitude matters too. A sharp question can belong in a program review rather than in the audit committee. New members, especially those with deep operating experience, tend to chase details that management should own. A useful test is whether your question is about the system of oversight or about running the business. The first belongs in the committee. The second usually belongs in a follow-up conversation with management.
The full board depends on the audit committee’s report-out, and a great deal gets lost in the summary. A quarter of careful work becomes a few minutes on the board agenda and a slide. Some boards have responded by having more directors sit in on audit committee meetings. Others are asking for written briefs that carry the open issues and commitments forward from one meeting to the next.
This is also where software can help most, because the hard part of the job is memory and coverage, not reading. Aureclar’s audit brief works through the nine areas at every sitting and carries open commitments forward from the prior meeting, so the committee starts each session knowing what was promised. But the discipline matters more than the tool. A committee that asks about commitments, coverage and absence every time will catch more than one that reads every page and asks none of them.
If you are about to join an audit committee, ask for the last two years of committee minutes and the current internal audit plan before your first meeting. Read them for what was promised and for what never came up. That will tell you more about the committee’s real exposure than your first packet will.
Josh Schiffman is the founder and CEO of Aureclar, AI for the boardroom that helps directors prepare and exercise better judgment.