Welcome to part nine in this series. In this ninth part of the series, we'll be focused on the audit and risk committee. 

First, we'll discuss why boards use committees, in particular the Audit and Risk Committee. Second, we'll discuss the composition of the committee, the purpose of the committee charter, and the relationship between the committee and the full board. Finally, we'll discuss the key areas of oversight the audit and risk committee undertakes, including external financial reporting, the external audit, risk management, and internal controls. 

Let's begin by exploring why boards use committees. Committees also sometimes called subcommittees assist boards to carry out their responsibilities more effectively and efficiently. In practise, boards may not be able to do all the detailed oversight work in full board meetings, so committees are used to take on focused areas of oversight and report the results back to the full board. 

However, it is important to emphasise the committees do not replace the board. Rather, they support the board. The full board remains accountable for all decisions and oversight. Some smaller organisations may not have any board committees, and the full board would undertake the work discussed in this video. 

Audit and risk committees are commonly used by boards to support oversight on financial matters. The committee may be called by other names, including a finance committee or a finance audit and risk committee, or similar. The scope of the committee's responsibilities should be clearly set out in a committee charter, or terms of reference. 

For an audit and risk committee, it is best practise if the members of the committee are all independent non-executive directors. That is directors who are not part of executive management of the organisation. Additionally, the chair of the committee should not also be the chair of the board. 

It is best practise that at least one of the members has strong financial expertise, typically an accountant or similar. Also, the CEO, Finance manager, other relevant members of the management team and the external auditors should be invited to committee meetings. Directors of the board who are not formally members of the committee can attend committee meetings should they choose. 

The full board should have access to the committee papers and be provided with the minutes from the committee meetings. The chair of the audit and risk committee should provide a full report to the board after each committee meeting to update them on the work performed and any recommendations from the committee to the board. 

As mentioned, the areas of oversight undertaken by the audit and risk committee should be set out in the committee charter or terms of reference. As a minimum, they usually include oversight of four key areas, external financial reporting, the external audit, risk management, and internal controls. Let's consider each of these areas in turn. 

As we discussed in part eight, a key responsibility of the board is to authorise the signing of the responsible persons' declaration, in conjunction with the annual financial report or AFR. The committee can be given the responsibility to undertake a detailed review of the AFR to provide the full board with a recommendation as to whether they approve the signing of the declaration. 

As part of their oversight of the AFR, the committee would usually consider the following areas. First, they should assess the appropriateness of the accounting policies that management have used and the estimates and judgements management have made when preparing the financial statements. Management should provide the committee with the information they require to ensure these policies, estimates and judgements have been selected and made with transparency and integrity. 

One of the key judgements underpinning the financial statements is whether the organisation is, what is known as, a "going concern". A going concern means that the organisation is expected to continue to operate normally for at least the next 12 months after the date of signing the responsible persons' declaration. 

That is to say that the organisation is expected to continue its activities, pay its debts as they fall due, and is not planning or forced to wind up, liquidate, or significantly reduce operations. Whether or not an organisation is a "going concern" will have a significant impact on how assets and liabilities are valued. It's therefore a key judgement area the committee needs to consider. 

Second, the committee should make the necessary inquiries of management to ensure the financial statements have been prepared in accordance with Australian accounting standards and that they give a true and fair view of the financial position and performance of the organisation. Here, the committee should consider the integrity, clarity, and transparency of financial disclosures in the AFR. 

Third, the committee should consider the solvency of the organisation. Management should prepare a cashflow forecast that shows that the organisation will have enough cash to pay its debts as and when they fall due over the next 12 months. If the cashflow forecast includes assumptions about receipts from ticket sales, sponsorships, donations, or government grants, the committee should review these to ensure there is a reasonable basis for these assumptions. 

A secondary of oversight responsibilities for the committee, is regarding the external audit. In part eight of this series, we discussed the ACNC's requirements as to when an external audit is required. The audit and risk committee makes recommendations to the board regarding the appointment or replacement of the external auditor. 

The committee must also ensure that the auditor is independent. That is they are free from any influence, bias, or conflicts of interests. The auditor should present their audit plan to the committee, and the committee should review the performance of the auditor on an annual basis. 

Importantly, the committee should receive reports from the auditor and discuss with them their findings from the conduct of the audit. The auditor should also report to the committee on any weaknesses in internal controls that were identified and any recommendations for improvement. 

A good governance practise is for the committee members to meet with the auditor in-camera, that is without management present. This facilitates an open, candid discussion about issues the auditor may not be comfortable raising in front of management. 

In these meetings, the committee can gain insight about the organisation's culture, whether management provided full cooperation and access, if there were any disagreements about accounting judgements, and whether there are any emerging risks not yet visible in the financial reports. 

A third area of oversight responsibilities for the committee is regarding risk management. The full board is responsible for risk management, however, the audit and risk committee can support the board by ensuring the organisation has an effective risk management framework. 

That is an effective system for identifying, assessing, managing, and monitoring risks. The committee should also perform regular reviews of the risk register to ensure all material risks have been identified and are being effectively managed. A key way of mitigating risks is through insurance, and the committee should review the suitability of the insurances that the organisation has. 

The fourth area of the committee's oversight responsibilities is internal controls. While the full board remains responsible for ensuring the organisation has an effective system of internal controls, the audit and risk committee undertakes detailed oversight and monitoring of the controls to ensure they are adequate and effective. 

So what is an internal control? Internal controls are all of the policies and procedures that are necessary to ensure there is integrity in the financial reporting that all laws, regulations, contracts, and agreements are being complied with, that protect the assets of the organisation against fraud or misuse, and ensure effective risk management. 

Examples of internal controls include financial delegations or purchasing procedures. The board is responsible for ensuring these controls are in place. The management of the controls sits with management. 

To summarise the key learnings from this part of the series. First, we discussed why boards use committees, in particular at the audit and risk committee. Second, we discussed the composition of the committee, the purpose of the committee charter, and the relationship between the committee and the full board. Finally, we discussed the key areas of oversight, the audit and risk committee undertakes, including external financial reporting, the external audit, risk management, and internal controls.