Beginning in 2014, the Center for Audit Quality (CAQ), together with Audit Analytics – an Ideagen solution, has annually analyzed public company audit committee disclosures of companies in the Standard & Poor’s (S&P) Composite 1500 (S&P 1500), which is comprised of the S&P 500 large-cap companies (S&P 500), the S&P MidCap 400 (S&P MidCap), and the S&P SmallCap 600 (S&P SmallCap).
Now in our 11th year of analyzing disclosures, this publication highlights the progress that has been made in audit committee disclosures since we began tracking in 2014 and emphasizes the need for audit committees to continue to raise the bar with their disclosures each year. We encourage audit committees to build on the progress that has been made; now is not the time to settle for boilerplate disclosures. For audit committees looking to refresh and enhance disclosures, this publication provides leading disclosure examples and questions for consideration in the appendices.
As audit committees and boards of directors continue to face emerging risks and new areas of oversight responsibility, we have added a new question (Q13) this year about whether the board of directors discloses a skills matrix. Investors are interested in understanding the composition of the board and the expertise that each member brings. A skills matrix can be a helpful tool to evaluate if the board and committees have the right expertise and where there may be knowledge gaps that need to be filled through training, the assistance of subject matter experts, or recruitment. In 2024, we found that 85% of the S&P 500 have disclosed their skills matrix in the proxy statement. Additionally, as audit committees take on new areas of responsibility, a skills matrix combined with robust disclosures regarding the allocation of responsibilities among the committees of the board can provide useful information and demonstrate how committees, such as the audit committee, are qualified to oversee various emerging topics. We further explore board composition and responsibilities for emerging risk areas like cybersecurity and Environmental, Social and Governance (ESG) below.
Q13 | Is it disclosed that the board of directors has a skills matrix?
Key Takeaway #1
We have seen positive long-term disclosure trends since we began tracking disclosures in 2014. In recent years we have observed that disclosure rates across several questions measured have plateaued, providing an opportunity for audit committees to enhance disclosures on key matters to effectively tell the audit committee’s story to investors. Here are the results for 2024:
Disclosure Question
S&P
500
S&P
MidCap
S&P
SmallCap
Q1
Is there disclosure related to a discussion of audit committee considerations in appointing or (re)appointing the external auditor?
50%
29%
Q2
Is there disclosure of the length of time the auditor has been engaged?
73%
61%
57%
Q2.1
Is there disclosure related to a discussion about how the audit committee considers length of auditor tenure?
13%
5%
4%
Q3
Is there a disclosure related to a discussion of audit fees and its connection to audit quality?
6%
3%
1%
Q4
Is there disclosure related to a discussion of how non-audit services may impact independence?
85%
80%
74%
Q5
Is there a statement that the audit committee is responsible for fee negotiations?
18%
6%
5%
Q6
Is there an explanation provided for a change in fees paid to the external auditor?
24%
26%
29%
Q7
Is it stated that the evaluation of the external auditor is at least an annual event?
39%
22%
20%
Q8
Is it explicitly stated that the audit committee is involved in selection of the audit engagement partner?
53%
24%
14%
Q8.1
Is there disclosure related to a discussion of how the audit committee is involved in the selection of the audit engagement partner?
17%
9%
5%
Q9
Is it disclosed that the board of directors has a cybersecurity expert?
60%
41%
37%
Q10
Is it disclosed that the audit committee is responsible for cybersecurity risk oversight?
64%
53%
50%
Q11
Is it disclosed that the board of directors has an ESG or sustainability expert?
59%
50%
39%
Q12
Is it disclosed that the audit committee is responsible for ESG oversight?
34%
20%
15%
Q13
Is it disclosed that the board of directors has a skills matrix?
85%
75%
62%
Key Takeaway #2
Telling the Audit Committee’s Story
Audit committees play a crucial role in the financial reporting ecosystem through oversight of the external auditor and the company’s financial reporting process and internal control over financial reporting. Extensive academic research on audit committee effectiveness demonstrates that independent, knowledgeable, and engaged audit committees directly contribute to audit quality. In the current environment where public accounting firms are being called on to raise the bar and continuously improve audit quality, the role of the audit committee is as important as ever. It’s up to the audit committee to tell their unique story each year to provide transparency to investors as to how the audit committee is fulfilling its oversight responsibilities and promoting audit quality. Audit committees can do this with detailed disclosures that focus specifically on the audit committee’s oversight during the prior year, including year-over-year changes. Additionally, disclosures that describe not only the “what” but also the “how” of audit committee oversight provide valuable information to investors.
Oversight of the External Auditor
While many of the audit committee’s activities that relate to oversight of the external auditor, including selecting the audit firm and lead engagement partner, negotiating audit fees, and regularly evaluating the audit firm’s performance are routine, it is important that the audit committee provide robust disclosures about how they have fulfilled these responsibilities each year. Every year there may be changes and unique considerations that impact the audit committee’s oversight. We see an opportunity for audit committees to provide more thorough and transparent disclosures in this area.
For example, as it relates to appointing (or reappointing) the external auditor, there may be a number of factors that the audit committee considers, such as interactions with the lead audit partner and senior audit team members, the audit firm’s reputation including publicly available information regarding audit quality at the firm (e.g., PCAOB inspection reports and firm audit quality reports), specific knowledge, resources, and expertise of the audit firm, and the tenure of the audit firm, among others. These disclosures demonstrate the audit committee’s commitment to selecting and retaining a qualified external auditor, which is critical to promoting audit quality. Providing information regarding the factors considered, including pros and cons, and the unique considerations arising during the year, provides useful information and demonstrates the extent of the audit committee’s engagement. This year we observed that 50% of the S&P 500 included discussion of the audit committee considerations in appointing or reappointing the external auditor (Q1), which is up slightly from the prior year (49% of the S&P 500 in 2023). While progress has been made in the last 11 years, this is an area where disclosures can continue to be enhanced.
Q1 | Is there a discussion of audit committee considerations in appointing or (re)appointing the external auditor?
Relatedly, audit firm tenure continues to be frequently disclosed by audit committees (73% of the S&P 500 in 2024); however, fewer audit committees disclose how length of tenure has been considered when reappointing the external auditor (13% of the S&P 500 in 2024). Solely stating the tenure of the audit firm is not enough; detailed disclosures demonstrate how the audit committee has carefully evaluated the positive and negative impacts of audit firm tenure on audit quality.
Q2 and Q2.1 | Auditor tenure disclosures
Another area where we see opportunity for audit committees to enhance disclosures is related to audit firm compensation. Negotiating the audit fee is a key responsibility of the audit committee, and the audit fee can provide evidence of the quality of the audit. Audit fees that are too low may be indicative of poor audit quality, but audit fees that are too high could be the result of inefficiencies. Clear disclosures about how the audit committee evaluates audit fees in relation to audit quality highlight the audit committee’s commitment to promoting audit quality. This is also an opportunity for the audit committee to discuss how it drives efficiencies in the audit and is focused on not only the cost of the audit, but also the quality. In 2024, only 6% of the S&P 500 included disclosure related to a discussion of audit fees and its connection to audit quality (Q3).
Q3 | Is there a disclosure related to a discussion of audit fees and its connection to audit quality?
Key Takeaway #3
There is an opportunity to enhance audit committee disclosures, especially related to discussion of:
- Audit committee considerations in appointing or (re) appointing the external auditor;
- How length of tenure has been considered when reappointing the external auditor; and
- How the audit committee evaluates audit fees in relation to audit quality.
Expanding Oversight Responsibilities
We continue to see the role of the audit committee expand to include oversight of topics like cybersecurity and ESG reporting. Leveraging their expertise and experience in oversight of financial reporting and internal controls, audit committees can play an important role in overseeing these topics. As cybersecurity, ESG, and other emerging topics are multi-faceted and evolving, how the board assigns oversight of these risks among its committees is helpful information for investors. Leading disclosure examples also clearly state the roles and responsibilities assigned to the audit committee, an explanation of why the audit committee is suited to oversee those topics, and discussion of why audit committee members are appropriate for the specific company. The 2022 Audit Committee: The Kitchen Sink of the Board report found that these topics, among others related to the role of the audit committee, are of high importance to investors.
Additionally, oversight of emerging topics may require expanded skillsets from board and audit committee members. Disclosures about the expertise of board members and ongoing education efforts to keep board members informed on emerging topics provide transparency about how the board and committees are adapting to these new oversight responsibilities. As discussed above, a skills matrix can be a clear way to depict the expertise of board members, and in 2024, 85% of the S&P 500 disclosed a skills matrix in the proxy statement (Q13).
Audit Committee Oversight of Cybersecurity
The cybersecurity landscape has changed dramatically in recent years. Cybersecurity incidents are on the rise and the costs associated with a cybersecurity incident are also increasing. In the CAQ and Deloitte joint 2024 Audit Committee Practices Report, 69% of audit committee respondents indicated that cybersecurity will be in the top three priority areas for the audit committee in the next 12 months, and 30% ranked cybersecurity as the number one priority for the audit committee in that period. Additionally, with the SEC Cybersecurity Disclosure Rule in full effect, certain cybersecurity information is required to be included in SEC filings. Further, per the CAQ 2024 Audit Partner Pulse Survey, 47% of audit partners expect to see companies in their primary industry sector voluntarily increasing or enhancing cybersecurity disclosures over the next 12 months. Consistent with this, in 2024, we continue to see an increase in the percentage of audit committees disclosing that they are responsible for cybersecurity risk oversight (Q10, 64% of the S&P 500 in 2024, compared to 59% in 2023). Additionally, we see more boards disclosing that they have a cybersecurity expert (Q9, 60% of the S&P 500 in 2024, compared to 51% in 2023). Given the complex and evolving cybersecurity risk environment, it is important that board and audit committee members are staying current through education and training – including use of specialists - to effectively oversee the company’s approach to cybersecurity risk management.
Q9 | Is it disclosed that the board of directors has a cybersecurity expert?
Q10 | Is it disclosed that the audit committee is responsible for cybersecurity risk oversight?
Audit Committee Oversight of ESG
In the last several years there has been an explosion of ESG reporting. Investors and other stakeholders are demanding this information, and domestic and international regulators are requiring the reporting of certain ESG information to promote consistency and comparability. While this emerging reporting area continues to evolve, we believe that ESG reporting is here to stay. A recent CAQ analysis found that 98% of S&P 500 companies reported some form of ESG-related information in 2022. Further, 70% of those companies obtained assurance over certain of that information. Additionally, the final SEC Climate Disclosure Rule, which was adopted in March 2024, requires certain ESG-related information to be included in the Form 10-K (the SEC has voluntarily stayed the Climate Disclosure Rule amid pending litigation).
As more companies report and obtain assurance over ESG-related information, it is becoming increasingly important to have appropriate processes and controls in place to help ensure the reliability of such information. In some companies, ESG reporting is falling within the controllership structure to enhance the rigor applied to ESG reporting and leverage the controllership’s expertise in internal controls and external reporting. Relatedly, audit committees are also increasingly disclosing their responsibility for oversight of ESG (Q12, 34% in 2024 as compared to 29% in 2023). The audit committee, with its expertise and experience overseeing financial reporting processes and internal controls over financial reporting is well-positioned to also oversee the external reporting of ESG-related information. Additionally, we observe the percentage of S&P 500 companies that disclose that the board of directors has an ESG or sustainability expert continues to increase (59% in 2024 as compared to 54% in 2023). As audit committees and boards take on new responsibilities, it is increasingly important to ensure that the committee members have appropriate training or expertise to exercise effective oversight.
Q11 | Is it disclosed that the board of directors has an ESG or sustainability expert?
Q12 | Is it disclosed that the audit committee is responsible for ESG oversight?
Key Takeaway #4
Conclusion
It is crucial for audit committees to tell their stories to clearly articulate the work that they do to protect investors through their oversight of the external auditor and emerging risks. Robust disclosures provide important information to investors about how the audit committee promotes audit quality and fulfills its responsibilities. While we know that significant progress has been made, we strongly encourage audit committees to seize this opportunity to enhance their disclosures by considering where further transparency can be provided regarding not just what the audit committee does, but how it does it.
Download the full report PDF for detailed appendices including examples of effective disclosure and questions to consider when preparing audit committee disclosures.
Related Resources
The latest news and
resources from the CAQ.