Most nonprofit audit committees exist on paper. The ones that actually work share a few structural features that are easy to replicate — if you know what to look for.
A lot of nonprofit audit committees meet once a year. The auditor presents. Someone asks a clarifying question. The committee votes to accept. Everyone moves on.
That's not oversight. That's a signature.
The audit committee's actual job is to serve as the board's eyes and ears on financial risk, internal controls, and the integrity of financial reporting, independent of management. When it works, it's one of the most valuable governance structures a nonprofit can have. When it doesn't, it's a checkbox that creates a false sense of security.
The difference matters most when it counts: when a major funder asks to speak with your finance committee before renewing a grant, when a board candidate evaluates your governance practices, when something goes wrong, and the question is whether your oversight structures were functioning.
What the committee should actually be doing
Most audit committees review the annual audit. A functioning one does more than that.
The committee should have a direct relationship with the external auditor, separate from the ED and CFO. Auditors will tell the audit committee things they won't say in a full board meeting with staff present. That relationship only works if it's cultivated, not activated once a year when the engagement letter arrives.
Beyond the audit itself, the committee should be reviewing management letters, internal control findings, significant accounting policy changes, and whistleblower reports. It should also own the process for selecting and evaluating the auditor, including deciding when it's time to rotate firms.
Who belongs on it
Small committees work better than large ones. Three members is enough. Composition matters more than size.
At a minimum, one member should have genuine financial literacy — someone who can read a balance sheet, understand fund accounting at a basic level, and ask the auditor a follow-up question that isn’t just a restatement of what the auditor said. This is not the same as having a treasurer.
Members should be independent of management. No staff, and no board members with a financial relationship to the organization beyond their board service. If your organization is at the working-board stage, full independence can be hard to achieve. Acknowledge the limitation, document it, and address it as you grow.
The audit committee chair should be someone the auditor respects and the ED can't steamroll. That combination is rarer than it sounds.
How to make it functional
New audit committee members should receive the last two years of audited financials and any management letters from that period, along with a briefing from the external auditor before their first meeting. Most don't get any of this.
The committee should meet at least twice a year: once before the audit fieldwork begins, to discuss scope, risk areas, and any concerns with the external auditor; once after the audit is complete, to review findings with the auditor before they go to the full board. A third meeting, without the auditor, to review interim financials is worth considering for organizations with significant grant complexity, rapid growth, or limited financial staff capacity. Revenue size alone is not the right trigger, though larger budgets rarely stay simple for long.
Between meetings, the committee chair should have a standing channel to the auditor, not for day-to-day issues, but for anything that would affect the board's understanding of financial risk.
The committee should also produce a brief written report to the full board each year, separate from the audit itself. The audit is a technical document. It’s useful but not designed to tell the board what to make of what it found. The committee's one-pager does that: what was reviewed, what was found, what management has committed to address, and whether the committee is satisfied with the response. The full audit should accompany it for any board member who wants to go deeper.
What this makes possible
Funders who do serious due diligence look at governance structures. An audit committee that can speak to what it actually does and produce documentation to support it is a signal. It says the organization is run by people who take fiduciary responsibility seriously, not people who just know how to check the right boxes.
That signal compounds. Organizations with strong governance attract stronger board members, which strengthens governance further. The audit committee is a good place to start. The changes required are structural — specific roles, clear meeting cadence, a direct line to the auditor — and structure is easier to implement than culture. But get the structure right and the culture tends to follow.