An audit committee oversees financial reporting, internal controls and the external auditor on behalf of the board. It exists because the people preparing the accounts should not be the only people checking them, and that principle applies well below the size of company legally required to have one.
Most small businesses will never need a formal committee. All of them need the separation it represents.
What it actually does
Reviews financial statements before they are approved, oversees the appointment and independence of the external auditor, monitors internal controls and how risks are managed, and provides a route for concerns to be raised outside the management line.
Members are non-executive and expected to be independent, with at least some financial expertise, precisely so that they can challenge management rather than represent it.
Which companies must have one
Public and state-owned companies are required to appoint one, and certain private companies are too depending on their public interest score, which is calculated from turnover, employees, third-party liabilities and shareholder numbers.
The requirements sit under the Companies Act, administered by the Companies and Intellectual Property Commission. Whether your company must have an audit, an independent review or neither also follows from that score, so it is worth calculating rather than assuming.
Why it matters below that threshold
The underlying risk is the same in a small business and usually worse: one person controls the bank account, prepares the numbers and reports on them, with nobody checking.
That is how most internal fraud in small businesses happens, and it is rarely elaborate. It is usually a single trusted person with unchecked access over a long period.
The small-company version
Separate who authorises payments from who makes them. Have someone other than the bookkeeper review bank statements monthly. Require two approvals above a threshold. Reconcile regularly rather than annually.
As the business grows, a non-executive director or an independent adviser reviewing the numbers quarterly provides most of the benefit of a committee at a fraction of the cost.
Frequently asked questions
What does an audit committee do?
Reviews financial statements, oversees the external auditor’s independence, monitors internal controls and provides a route for concerns outside management.
Which companies must have one?
Public and state-owned companies, and certain private companies depending on their public interest score under the Companies Act.
Why does this matter to a small business?
Because the same risk exists and is usually worse: one person preparing, approving and reporting on the numbers with nobody checking.
How does small-business fraud usually happen?
Not elaborately. Typically one trusted person with unchecked access to payments and records over a long period.
What is the practical alternative?
Separate authorisation from payment, have someone other than the bookkeeper review statements monthly, and require two approvals above a threshold.
Further reading
Originally published in April 2018. Updated September 2026 to explain what an audit committee does and the equivalent controls a smaller company needs.
