The 2026 audit committee agenda priorities are eight items: the health of internal control over financial reporting and the deficiencies against it, the cost and quality of the SOX program, cybersecurity oversight and SEC disclosure, AI governance, third-party risk, fraud risk, the relevance and sourcing of internal audit, and the external auditor relationship. For each item, what helps is knowing which document management should put in front of the committee and which question tests whether that document is real, because a topic list alone does not help much.
This guide takes that approach. It is written from the perspective of someone who spent years defending audit scope, evidence and conclusions through PCAOB inspections (background here). The pattern from that work is simple. Committees that ask for evidence get better answers than committees that ask for reassurance.
This is general information, not legal or accounting advice. Your counsel and your external auditor should confirm how any of it applies to your company.
1. ICFR health and deficiency tracking
Start with the vocabulary, because the classification decides who hears about a problem and whether it is disclosed. A material weakness is a deficiency, or a combination of deficiencies, where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. A significant deficiency is less severe than a material weakness but still important enough to merit the attention of the people who oversee financial reporting, usually the audit committee. The auditor must report both to management and the committee in writing before issuing the audit report, and must keep the two categories clearly separate. Material weaknesses must be disclosed publicly. A significant deficiency need not be disclosed simply because it exists.
Deficiencies also come in two kinds. A design deficiency means the needed control is missing or badly built. An operating deficiency means a sound control did not run as designed, or the person running it lacked the authority or competence to do so. The fix differs for each, and so does the time to prove it.
Ask for a quarterly deficiency scorecard that shows:
- Open deficiencies by severity, with the age of each.
- Root cause, plus design or operating.
- The compensating control running in the meantime, and who performs it.
- The remediation due date, set against the date by which the fixed control must have operated long enough to be tested.
That last column matters most. SEC guidance allows management to conclude ICFR is effective if every material weakness is remediated by fiscal year-end. A fix installed in the last month may not have run enough times to show it works.
Questions to ask management
- Which open items could combine into something more severe?
- For each fix, when does it go live, and how many operating instances will exist before testing?
- Who other than the control owner has confirmed the fix works?
One point is uncomfortable but useful. Under AS 1305, ineffective oversight by the audit committee is itself an indicator of a material weakness. The committee's own diligence sits inside the control environment.
2. SOX cost and quality
Cost and quality are usually discussed separately. They should be discussed together, because the same causes drive both: too many key controls, duplicate controls, manual controls doing work a system could do, and management testing the auditor cannot use.
SEC guidance tells management to focus its evaluation on the areas of highest ICFR risk. That supports scaling effort to risk instead of testing everything the same way.
Ask management for these measures, year over year:
- Key controls per financial reporting risk. A rising ratio with no new risks usually means duplicates or orphaned controls.
- Hours spent per key control, for management and for the auditor.
- The share of controls that are automated versus manual.
- How much the external auditor relies on management's testing, in the auditor's own words.
Questions to ask management
- When did someone last remove a key control, and why?
- Does the committee's status view come out of the SOX platform, or from a spreadsheet built beside it?
Question to ask the auditor
- What would management's testing need to look like for you to use more of it?
3. Cybersecurity oversight and SEC disclosure
Two disclosure duties shape this item. Each year the 10-K must describe the company's processes for managing material cybersecurity risk, the board's oversight of that risk, and management's role and expertise. A material incident must be reported on Form 8-K under Item 1.05 within four business days of the company determining that it is material. The materiality determination itself must be made without unreasonable delay after discovery.
The determination is a judgment, so the committee should see how it gets made. SEC staff have said materiality should weigh qualitative factors, such as reputation, customer relationships and regulatory exposure, and not only financial results. Staff guidance also says insurance reimbursement of a ransom does not by itself make an incident immaterial.
Ask for a materiality playbook that names who decides, who is consulted, how a decision is documented, and how an incident at a vendor is handled. Then ask to see it used in a tabletop exercise.
In 2026, commenters asked the SEC to rescind both Item 106 and Item 1.05 as part of its Regulation S-K review. Treat this as an open question to track. Do not take it as a reason to stop testing the process. Examiners, customers and plaintiffs will still ask what you did.
Questions to ask management
- Which framework is the program baselined to, and who tested the controls, as opposed to scoring a questionnaire?
- When did the playbook last run, and what changed afterward?
4. AI governance
An AI policy and a tested AI control are not the same thing. The committee needs the second. COSO's February 2026 guidance places generative AI inside the 2013 internal control framework. The NIST AI Risk Management Framework is organized around four functions: Govern, Map, Measure and Manage. NIST advises building AI risk into enterprise risk management alongside cybersecurity and privacy, rather than running it on a separate track.
Ask for an inventory of AI in use. It should include the AI built into ERP, HR and close tools that nobody calls AI, and it should flag every use that touches financial reporting: reconciliations, journal entries, forecasts and disclosure drafting. For each flagged use, ask what controls the output before it reaches the ledger or the filing, and whether that control has been tested.
Questions to ask management
- Which AI uses sit inside the scope of the CFO's certification?
- Who can change a model, a prompt or the data a model reads, and is that change controlled like any other program change?
- Which state AI laws apply to us, and on what dates?
5. Third-party risk
The SEC has pointed to growing reliance on third-party IT providers, including cloud computing, as a driver of rising cyber risk. For ICFR, the practical evidence is the SOC 1 Type 2 report.
Ask management for a service organization review memo covering the opinion, scope and period of each report, any exceptions, the complementary user entity controls your own team must operate, the subservice organizations carved out of the report, and the bridge letter that covers the gap to year-end. Ask for the list of providers that deliver no SOC 1 report, and what the company does instead.
Questions to ask management
- Which complementary user entity controls do we run, and are they in our control matrix?
- Which vendors touch financial data or financial systems without a report?
6. Fraud risk
COSO Principle 8 calls for a fraud risk assessment that considers types of fraud, incentives and pressures, opportunities, and attitudes and rationalizations. The second edition of the COSO and ACFE Fraud Risk Management Guide, released in 2023, adds guidance on data analytics. The ACFE has estimated that organizations lose about five percent of revenue to fraud each year.
Culture belongs under this item, because culture is a control. The committee must also have procedures for confidential, anonymous employee complaints about accounting and auditing matters. The PCAOB's standard-setting agenda now includes the auditor's responsibilities for noncompliance with laws and regulations, which covers fraud.
Questions to ask management
- Show us the current fraud risk assessment, and tell us what changed since last year.
- How are management override and unusual journal entries monitored, and by whom?
- How many hotline reports came in, how many were closed, and how many touched finance?
7. Internal audit relevance and sourcing
Internal audit now works under the IIA's 2024 Global Internal Audit Standards, which raise expectations for how the audit plan ties to strategy and risk. Sourcing involves trade-offs:
- In-house keeps the institutional knowledge, but specialist depth can be thin.
- Co-sourcing adds specialists for AI, cyber or IT general controls while keeping ownership internal.
- Outsourcing gives a small company coverage, at some cost to continuity.
External auditors may use internal audit's work under AS 2605, and that use can affect audit effort. How much they use it is the auditor's decision. The IIA has asked the PCAOB to update AS 2605.
Questions to ask
- What share of the plan covers this year's top risks, including AI and third parties?
- What work did the external auditor use, and what stopped them from using more?
8. The external auditor relationship
The committee is directly responsible for appointing, paying, retaining and overseeing the external auditor. The PCAOB's April 2026 Spotlight, drawn from conversations with audit committee chairs, covers how chairs assess the auditor, pre-approval of services, fraud, critical audit matters and technology risk.
Questions to ask the auditor
- Was our engagement, or this office, inspected? What was found, and what changed as a result?
- Which senior people stay on our engagement next year?
- What should management have caught before you did?
The same discipline applies to the committee itself. Companies must disclose whether an audit committee financial expert serves on the committee. It is also worth asking whether anyone on the committee can read a controls report critically.
Where an advisor fits
Your auditor can tell you a control failed. Independence rules bar the auditor from designing the fix, and the opinion stays with the auditor. We are an advisory firm, not a CPA firm. We do not perform audits or issue opinions. We work for management, and sometimes alongside the committee:
- A quarterly audit committee advisory read of the control program, on retainer.
- A two-day deficiency second opinion on whether a classification holds and what a credible response looks like.
- Readiness work across ICFR, AI, cyber and regulated frameworks.
See the services or how an engagement runs.
Start with a free two hour scoping call. Send the date of your next committee meeting and a sentence on what is coming up.
Frequently asked questions
What should come first on the 2026 audit committee agenda?
Deficiency tracking. Every other item eventually shows up as a control that works or does not. Without a severity and aging view, the committee cannot tell whether a fix will be tested in time.
How often should the committee see the deficiency scorecard?
Quarterly at a minimum, and at every meeting during the months before year-end, when remediation dates and testing windows start to collide.
Can our external auditor design the remediation?
No. Independence rules keep the auditor from designing or building your controls. Management owns the fix, sometimes with an advisor, and the auditor then tests it.
Do you perform the audit or sign anything for the auditor?
No. Our work is advisory and not an attest engagement. We document, test and remediate for management, and we can confirm in writing for your auditor's independence file that we are not affiliated with any audit firm.
We are not yet subject to auditor attestation. Does this still apply?
Yes. Management still assesses its controls, the committee still asks, and a lender, sponsor or registration statement can still turn on the answer.