Most audit committee packs fail the same test: read the pack, then ask what decision it changed. Usually the answer is none — the pack documented activity, the committee noted it, and everyone moved to the external auditor's slot.
Having built board reporting from scratch at a listed company, here is the model that changed that.
The ten-minute reality
An audit committee gives the CAE perhaps ten focused minutes per quarter. Design for exactly that:
- One page of themes. Not findings — patterns. "Three of four audits this quarter found process changes made without control impact assessment" is a theme. It names a systemic weakness one level above any single report.
- Movement, not snapshots. Risks emerging, risks retired, actions ageing past their dates. A static heat map hides the only thing a board can act on: direction.
- An opinion. The committee pays for judgement. "Adequate with exceptions" is not judgement; "control discipline degrades wherever we restructure, and here is the evidence" is.
What heat maps are actually for
A heat map is a conversation-forcing device, not a deliverable. Its job is to make someone ask: why is that risk still red after two years? If your heat map has never provoked an uncomfortable question, it is decoration.
Three upgrades that make it work:
- Plot movement arrows — where each risk came from since last quarter.
- Mark assurance coverage — which red risks have never been audited. That intersection is the plan for next year.
- Name the owners — a risk with no name attached is nobody's problem by design.
The private session
The scheduled private session between CAE and committee chair is where governance actually happens. No pack, no management, two questions: what worries you that isn't in the report yet and is anything constraining your independence? A CAE who has never been asked those questions is reporting to a committee that is still learning its job — so help them learn it. Brief the chair on what to ask.
The test
After every committee meeting, write down what changed because you reported: a decision, a resource, a mandate, a question management now must answer. If the list is empty two quarters running, the problem is not the committee's attention. It is the report.