# Audit Committee Report: [Company name], [Financial year]

> Two linked documents for an audit committee: (A) the annual report of
> the committee's work for shareholders, and (B) the quarterly report
> that management and assurance providers give to the committee. Part A
> serves the audit committee section of a UK annual report (UK Corporate
> Governance Code 2024, Provisions 24 to 26 and 29, cited by number), the
> audit committee disclosures of a US-listed foreign private issuer in
> SEC Form 20-F (Items 16A to 16D and 16G) with Exchange Act Rule 10A-3
> and the auditor pre-approval rule in Regulation S-X Rule 2-01(c)(7),
> and EU public-interest entity duties under
> Regulation (EU) No 537/2014 (including the auditor's Article 11
> additional report to the audit committee) and Directive 2006/43/EC,
> Article 39. Part B is a practice format for the committee's regular
> meetings. Internal control content uses the GAO Green Book 2025 as the
> public-domain reference; COSO, PCAOB and ISA standards are named only.
> Replace every `[bracketed]` value and every row marked *Example*. This
> is a document format, not legal, audit or accounting advice. Obtain the
> standard or law for the normative text.

<!--
Guidance: How to use this template
- Purpose: Part A tells shareholders what the committee did, what it
  concluded on the significant judgements, and how it oversaw the
  external auditor, internal audit and internal control. Part B keeps
  the committee informed through the year, so that Part A is a summary
  of a real oversight trail rather than a year-end reconstruction.
- Fill section 1 first: the regimes that apply decide which sections are
  mandatory. A UK-listed company writes sections 2 to 10; a foreign
  private issuer filing Form 20-F also writes section 11; an EU or UK
  public-interest entity checks the Regulation 537/2014 items in
  section 5. A US domestic registrant's proxy statement report under
  Regulation S-K Item 407(d)(3) is outside the scope of this template.
- The worked example is fictional: Corvid Commerce Group plc, a SaaS
  retailer listed in London with American depositary shares (ADSs)
  listed on the New York Stock Exchange, reporting under IFRS as issued
  by the IASB in EUR, calendar financial year, subsidiaries in Germany,
  the UK, the US and Vietnam. It is an SEC foreign private issuer filing
  Form 20-F. Its external auditor is the fictional firm Ashgrove &
  Partners LLP.
- Common pitfall: a report that lists agenda items ("the committee
  reviewed the half-year results") without saying what the committee
  challenged, what it concluded and why.
-->

## Document control

<!-- Guidance: Treat the draft report as a controlled document: the committee approves it, then the board approves the annual report or proxy statement that contains it. Keep committee minutes as the evidence behind each statement. -->

| Field | Value |
|---|---|
| Document ID | [AC-REP-2026] |
| Company | [Legal name] (*Example:* Corvid Commerce Group plc) |
| Financial year | [YYYY-MM-DD to YYYY-MM-DD] (*Example:* 2026-01-01 to 2026-12-31) |
| Reporting framework | [IFRS as issued by the IASB / UK-adopted international accounting standards / US GAAP] (*Example:* IFRS as issued by the IASB, which are also UK-adopted IAS) |
| Regimes applied | [UK Code / Form 20-F Item 16 and Rule 10A-3 / EU Reg 537/2014 / national law] |
| External auditor | [Firm name] (*Example:* Ashgrove & Partners LLP, fictional) |
| Version | [1.0] |
| Status | [Draft / Approved by committee / Published] |
| Owner | [@audit-committee-chair] |
| Prepared by | [@company-secretary], [@cfo] |
| Approvers/reviewers | Audit committee; board (as part of the annual report) |
| Last updated | YYYY-MM-DD |
| Classification | Draft: board confidential; final: public |
| Related documents | [Committee terms of reference], [Minutes], [Auditor's additional report], [Material controls working paper] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Audit committee | [Meeting reference] | [Approve draft] | YYYY-MM-DD |
| Board | [Meeting reference] | [Approve annual report] | YYYY-MM-DD |
| External auditor (consistency read of the annual report) | [Firm] | [Comments cleared] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@company-secretary] | Skeleton from minutes |
| 0.5 | YYYY-MM-DD | [@cfo] | Significant judgements and auditor sections |
| 1.0 | YYYY-MM-DD | [@audit-committee-chair] | Approved by committee |
| 1.1 | 2026-10-25 | [@company-secretary] | Updated to Corvid's foreign private issuer status: Form 20-F Items 16A to 16D and 16G, Rule 10A-3, audit and non-audit pre-approval; proxy statement module removed; fee cap base period and deficiency references aligned |

## Contents

Part A: annual report of the committee

1. [Purpose, regimes and placement](#1-purpose-regimes-and-placement)
2. [Membership, meetings and attendance](#2-membership-meetings-and-attendance)
3. [Responsibilities and activities in the year](#3-responsibilities-and-activities-in-the-year)
4. [Significant financial reporting judgements](#4-significant-financial-reporting-judgements)
5. [External auditor](#5-external-auditor)
6. [Internal audit oversight](#6-internal-audit-oversight)
7. [Internal control and risk management](#7-internal-control-and-risk-management)
8. [Whistleblowing and fraud oversight](#8-whistleblowing-and-fraud-oversight)
9. [Sustainability reporting oversight](#9-sustainability-reporting-oversight)
10. [Committee effectiveness and forward agenda](#10-committee-effectiveness-and-forward-agenda)
11. [US module: Form 20-F audit committee disclosures](#11-us-module-form-20-f-audit-committee-disclosures)

Part B: quarterly report to the committee

12. [Quarterly report to the audit committee](#12-quarterly-report-to-the-audit-committee)
13. [Actions log](#13-actions-log)
14. [Glossary and references](#14-glossary-and-references)

## 1. Purpose, regimes and placement

<!-- Guidance: Record which rules apply and where the report is published. Different regimes ask for different content in different documents. Pitfall: writing a UK-style narrative in a US proxy statement, or the reverse, and missing a required statement. -->

The committee reports each year on how it discharged its
responsibilities. The content and place of publication depend on the
company's listing and incorporation. Use the table to decide which
sections are required, and record the decision.

| Regime (as of 2026-10; check current law) | Applies to | Where published | What it drives in this template |
|---|---|---|---|
| UK Corporate Governance Code 2024, Provisions 24, 25, 26 (and 29 from years beginning on or after 2026-01-01) | Companies applying the Code (comply or explain) | Annual report, audit committee section | Sections 2 to 10 |
| FRC "Audit Committees and the External Audit: Minimum Standard" (2023) | FTSE 350 companies on a comply or explain basis via the Code (check) | Annual report | Section 5 (name only; read the Standard) |
| SEC Form 20-F, Items 16A (financial expert), 16B (code of ethics), 16C (principal accountant fees and services), 16D (exemptions from audit committee listing standards) and 16G (corporate governance differences) | Foreign private issuers filing annual reports on Form 20-F | Form 20-F | Sections 2, 5.3 and 11 |
| Exchange Act Rule 10A-3 (17 CFR 240.10A-3), applied through the US exchange listing standards | Issuers with securities listed on a US exchange, including foreign private issuers, with specified accommodations | Committee terms of reference; Form 20-F Item 16D | Sections 2, 8 and 11 |
| SOX sections 201 and 202 (Exchange Act section 10A(g) and (i)); Regulation S-X Rule 2-01(c)(7) | Audit committees of SEC issuers | Committee pre-approval policy; Form 20-F Item 16C | Section 5.3 |
| Exchange Act Rule 3a12-3(b) | Securities registered by foreign private issuers are exempt from the proxy rules (section 14(a)) | Not applicable | No Item 407(d)(3) proxy report; the committee's US disclosures go in Form 20-F |
| Regulation (EU) No 537/2014, Articles 4, 5, 6, 11, 16, 17 | Statutory audits of EU public-interest entities; the UK applies a retained and amended version for UK public-interest entities (check legislation.gov.uk) | Committee papers; some items disclosed in the annual report under national law | Section 5 |
| Directive 2006/43/EC, Article 39 (as amended, including by the Corporate Sustainability Reporting Directive; check the consolidated text) | EU public-interest entities | Committee terms of reference; national law | Sections 3, 5, 9 |

*Example:* Corvid applies the UK Code, is a UK public-interest entity
and is an SEC foreign private issuer filing Form 20-F (ADSs on the New
York Stock Exchange). It publishes this report in its UK annual report.
Foreign private issuers are exempt from the proxy rules, so no proxy
statement report is written; the committee's US disclosures go in Form
20-F Items 16A to 16D and 16G (section 11), and Rule 10A-3 applies to
the committee through the exchange's listing standards.

## 2. Membership, meetings and attendance

<!-- Guidance: Show who sat on the committee, their independence and relevant experience, how often the committee met and who attended by invitation. Pitfall: claiming "recent and relevant financial experience" without naming the member and the basis. -->

| Member | Role | Independent | Appointed | Relevant experience | Meetings attended |
|---|---|---|---|---|---|
| [Name] *(Example)* | Chair | Yes | 2022-05-12 | Former group finance director of a listed retailer; chartered accountant (recent and relevant financial experience) | 5 of 5 |
| [Name] *(Example)* | Member | Yes | 2023-09-01 | Former chief information officer of a payments company (technology and cyber) | 5 of 5 |
| [Name] *(Example)* | Member | Yes | 2025-03-01 | Former regional managing director in Asia; sector experience in e-commerce | 4 of 5 |

Regular attendees by invitation: [CEO], [CFO], [group financial
controller], [head of internal audit], [chief risk officer], [external
audit engagement partner]. The committee meets the external auditor and
the head of internal audit without management present [at least twice a
year].

Record the composition basis that applies and the evidence for it. UK
companies applying the Code check the committee against Provision 24
(read the Code for the composition and experience expectations), and
record for each member the facts the board relied on: independence
assessment, professional qualifications, roles held and sector
knowledge. For a foreign private issuer, Form 20-F Item 16A requires
disclosure of whether the board has determined that at least one audit
committee financial expert serves on the committee, the expert's name
and whether that person is independent, or an explanation if there is
none (US domestic registrants give the same disclosure under Item
407(d)(5)). Exchange Act Rule 10A-3 and the listing standards govern
independence: a member may not accept consulting, advisory or other
compensatory fees from the company beyond board and committee fees and
may not be an affiliated person, subject to the accommodations the rule
gives foreign private issuers. *Example:* the Corvid board determined
that the chair is an audit committee financial expert and that all
three members are independent under Rule 10A-3 and the UK Code.

## 3. Responsibilities and activities in the year

<!-- Guidance: Summarise the terms of reference in a sentence, then show what the committee actually did in each meeting. A table by meeting is easier to read than a long list. Pitfall: copying the terms of reference as if they were activities. -->

The committee acts under terms of reference approved by the board and
published on the company's website. Its responsibilities cover the
integrity of financial and narrative reporting, the external audit,
internal audit, internal control and risk management, whistleblowing
and, for in-scope companies, the oversight of sustainability reporting
and its assurance.

| Meeting | Main items | Outcomes |
|---|---|---|
| February *(Example)* | FY2025 annual report, significant judgements, going concern and viability, auditor's report and additional report, internal audit annual opinion | Recommended FY2025 accounts to the board; approved material controls criteria draft |
| March *(Example)* | Material controls inventory, internal audit plan update, non-audit services policy | Recommended inventory to the board (12 material controls) |
| July *(Example)* | Half-year report, auditor's interim review findings, IFRS 18 implementation status | Recommended half-year report; asked for IFRS 18 dry-run by Q4 |
| October *(Example)* | Q3 control testing results, significant deficiency AGG-01 in deferred revenue review controls (US entity review and group roll-forward review), audit plan for FY2026, tender planning | Approved remediation plan and retest timetable; approved FY2026 audit plan, fees and the annual pre-approval of permitted services |
| December *(Example)* | Year-end hard close, impairment model assumptions, whistleblowing annual review, committee effectiveness | Agreed assumptions for year-end tests; approved actions from effectiveness review |

Add any additional meetings, including those held with the risk
committee on shared topics (for example cyber controls or third-party
risk), and say how overlap between committees was managed so that no
material control fell between them.

## 4. Significant financial reporting judgements

<!-- Guidance: This is the most read part of the report. For each significant issue, say what the issue was, how the committee challenged management and what it concluded. Be specific to the company and the year. Pitfall: generic paragraphs that never change from year to year. -->

For each significant issue considered in relation to the financial
statements, record the issue, the committee's work and its conclusion.
Agree the list with the matters the auditor reports as key audit
matters; explain any difference.

| ID | Issue | What the committee did | Conclusion |
|---|---|---|---|
| SJ-01 *(Example)* | Revenue recognition for multi-year subscriptions with mid-term upgrades (deferred revenue EUR 15,500k at year end) | Reviewed management's paper on upgrade accounting; discussed the Q3 significant deficiency AGG-01 and its remediation; considered the auditor's controls and substantive testing results | Satisfied that revenue and deferred revenue are appropriately recognised; noted the remediated controls |
| SJ-02 *(Example)* | Goodwill impairment test at 2026-10-31 (IMP-2026-001): Marketplace DACH goodwill EUR 21,000k, headroom EUR 3,877k (9.1%); Vietnam engineering services CGU impaired by EUR 2,600k after the end of external client contracts | Challenged the margin expansion, terminal growth and discount rate assumptions; reviewed sensitivity showing that a rise of 0.68 percentage points in the post-tax discount rate removes the DACH headroom; reviewed the arm's-length pricing behind the Vietnam value in use and the allocation of the loss | Agreed no DACH impairment and the Vietnam loss of EUR 2,600k (goodwill EUR 2,000k written off, other assets EUR 600k); required the reasonably possible change disclosure for DACH |
| SJ-03 *(Example)* | Capitalised software development costs (first capitalised in FY2026: additions EUR 5,200k, balance EUR 4,806k at year end, TAM-2026-011) | Reviewed the criteria applied, the split between research and development, and a sample of projects | Satisfied with capitalisation and useful lives |
| SJ-04 *(Example)* | Going concern and viability statement | Reviewed cash forecasts, facility headroom and covenant tests under severe but plausible scenarios | Agreed the going concern basis with no material uncertainty and the three-year viability period |
| [SJ-NN] | [Issue] | [Work done] | [Conclusion] |

Give a short narrative after the table for any judgement where the
committee changed management's proposal or required more disclosure. A
reader learns more from "the committee asked for an additional downside
scenario, which removed the DACH headroom at a 10.5% discount rate" than from "the committee
reviewed the impairment test".

Also report the committee's review of the annual report as a whole: the
process supporting the board's statement that the report is fair,
balanced and understandable, the consistency of alternative performance
measures with the financial statements, and the transition to
IFRS 18 for years beginning on or after 2027-01-01 (see
`finance/ifrs-18-transition-plan`).

## 5. External auditor

<!-- Guidance: Cover appointment and tenure, independence, non-audit services and fees, and the effectiveness of the audit. For EU and UK public-interest entities, also record the auditor's additional report. Show the arithmetic for fee caps. Pitfall: stating that independence was "confirmed" without saying how the committee assessed threats and safeguards. -->

### 5.1 Appointment, tenure and tender

| Item | Value |
|---|---|
| Auditor | [Firm] (*Example:* Ashgrove & Partners LLP) |
| First financial year audited | [YYYY] (*Example:* FY2019, after a tender in 2018) |
| Years of tenure including this year | [n] (*Example:* 8, FY2019 to FY2026) |
| Engagement partner and year of appointment | [Name], [FY] (*Example:* first signed FY2022) |
| Next mandatory tender (company's analysis) | [FY] (*Example:* tender in 2027 for the FY2029 audit) |
| Regulatory basis | [Reg 537/2014 Art. 16 and 17, or national equivalent] |

Regulation (EU) No 537/2014, Article 17, sets a maximum engagement
duration of ten years for public-interest entities, which Member States
may extend (up to twenty years with a public tender under Article 16, or
twenty-four years with a joint audit), followed by a four-year cooling
off period. Key audit partners must rotate off no later than seven
years after appointment under Article 17(7), and national ethical rules
may set shorter periods. Under Article 16(2), when the committee
recommends a new appointment, the recommendation is justified, contains
at least two choices and states a reasoned preference. The UK retained
version keeps a similar framework; check legislation.gov.uk and the
applicable FRC Ethical Standard for current UK periods.

### 5.2 Independence

The auditor confirms its independence to the committee in writing each
year and discusses threats and safeguards with the committee (Regulation
537/2014, Article 6(2); for SEC issuers, including foreign private
issuers, the auditor's written independence communication under PCAOB
Rule 3526, cited by number only).
Record what the committee reviewed:

- the auditor's written confirmation and the threats it identified;
- employment of former audit staff by the company;
- personal, financial and business relationships disclosed;
- the fee dependency of the audit firm on the company (Article 4(3)
  sets a review mechanism where fees from one public-interest entity
  exceed 15% of the firm's total fees for three consecutive years);
- the non-audit services in section 5.3.

### 5.3 Non-audit services and fees

Non-audit services by the auditor require committee approval after an
assessment of threats and safeguards (Article 5(4)); services on the
Article 5(1) prohibited list are not allowed. Where non-audit services
(other than prohibited ones and those required by law) are provided for
three or more consecutive years, Article 4(2) caps their fees at 70% of
the average statutory audit fees for the last three consecutive years.
The common reading, used here, applies the cap from the fourth year to
the average of the three years before the year being tested.

$$
\text{Cap}_t = 0.70 \times \frac{F_{t-3} + F_{t-2} + F_{t-1}}{3}
$$

where $F$ is the statutory audit fee for the entity, its parent and
controlled undertakings and the consolidated accounts. Some readings
include the current year instead; check national law, the Commission's
interpretation and the current consolidated text for the exact base
period and any national variations, and record the reading you use.

*Example* (EUR thousand, Corvid group, Ashgrove & Partners LLP):

| Service | FY2023 | FY2024 | FY2025 | FY2026 |
|---|---|---|---|---|
| Statutory audit of group and subsidiaries (integrated with the ICFR audit) | 950 | 1,050 | 1,150 | 1,250 |
| Half-year review | 75 | 80 | 85 | 90 |
| Voluntary limited assurance of selected sustainability metrics | 0 | 0 | 50 | 60 |
| Reporting accountant work on covenant compliance (lender request) | 25 | 25 | 30 | 30 |
| **Total non-audit services (not required by law)** | **100** | **105** | **165** | **180** |

Calculation for FY2026: non-audit services were provided in FY2023,
FY2024 and FY2025, three consecutive years, so the cap applies in
FY2026. Average audit fees (950 + 1,050 + 1,150) / 3 = 1,050; cap =
0.70 x 1,050 = 735; non-audit services 180 = 17.1% of the average,
within the cap. Classification of each service as "required by law" or
not depends on national law; record the basis used.

**SEC issuers, including foreign private issuers.** The committee must
pre-approve every audit and permitted non-audit service by the auditor
(SOX section 202, Exchange Act section 10A(i); Regulation S-X Rule
2-01(c)(7)). Approval is given either for each engagement before it
starts or under detailed pre-approval policies that name the particular
service, keep the committee informed of each service and do not
delegate the committee's responsibility to management. A narrow de
minimis exception covers non-audit services not recognised as such when
engaged, up to 5% of total fees paid to the auditor in the year, if
they are promptly brought to the committee and approved before the
audit is completed. The services prohibited by SOX section 201
(Exchange Act section 10A(g)), such as bookkeeping, financial
information systems design, valuation, actuarial and internal audit
outsourcing services, apply alongside the Article 5(1) list; apply the
stricter of the two. Fees are disclosed in Form 20-F Item 16C in four
categories: audit, audit-related, tax and all other.

*Example* (EUR thousand, Form 20-F Item 16C categories; classification
agreed with the auditor):

| Item 16C category | FY2025 | FY2026 |
|---|---|---|
| Audit fees | 1,150 | 1,250 |
| Audit-related fees (half-year review, sustainability assurance, covenant reporting) | 165 | 180 |
| Tax fees | 0 | 0 |
| All other fees | 0 | 0 |
| **Total** | **1,315** | **1,430** |

Check: 1,150 + 165 = 1,315; 1,250 + 180 = 1,430. Services approved
under the de minimis exception: none in either year. Corvid's policy:
every engagement is pre-approved; engagements above EUR 25k are
approved individually by the committee, and smaller ones under the
annual pre-approval policy, with each one reported at the next
meeting.

### 5.4 Additional report to the audit committee (EU and UK public-interest entities)

The auditor of a public-interest entity submits a written additional
report to the committee no later than the audit report date
(Regulation 537/2014, Article 11). Use the checklist to confirm it was
received and discussed. Items are summarised by the letters in Article
11(2).

| Art. 11(2) | Topic (summary) | Received | Discussed at | Committee follow-up |
|---|---|---|---|---|
| (a) | Independence declaration | [Yes / No] | [Meeting] | [Action] |
| (b) | Key audit partners identified | [Yes / No] | [Meeting] | [Action] |
| (c) | Use of other auditors outside the network or external experts, with their independence confirmations | [Yes / No] | [Meeting] | [Action] |
| (d) | Nature, frequency and extent of communication, with meeting dates | [Yes / No] | [Meeting] | [Action] |
| (e), (f) | Scope and timing; distribution of work between joint auditors | [Yes / No] | [Meeting] | [Action] |
| (g) | Methodology, including which balance sheet categories were verified directly and which through system and compliance testing | [Yes / No] | [Meeting] | [Action] |
| (h) | Quantitative materiality and qualitative factors | [Yes / No] (*Example:* materiality EUR 700k) | [Meeting] | [Action] |
| (i) | Going concern judgements and support measures considered | [Yes / No] | [Meeting] | [Action] |
| (j) | Significant deficiencies in internal financial control or the accounting system, and whether resolved | [Yes / No] (*Example:* revenue review deficiency, resolved) | [Meeting] | Link to `compliance/control-deficiency-evaluation` |
| (k) | Significant matters of actual or suspected non-compliance with laws, regulations or articles | [Yes / No] | [Meeting] | [Action] |
| (l) | Valuation methods and changes in them | [Yes / No] | [Meeting] | [Action] |
| (m), (n) | Scope of consolidation and exclusions; work of third-country or non-network auditors | [Yes / No] | [Meeting] | [Action] |
| (o) | Whether all requested explanations and documents were provided | [Yes / No] | [Meeting] | [Action] |
| (p) | Significant difficulties, significant matters discussed with management, and other significant matters | [Yes / No] | [Meeting] | [Action] |

### 5.5 Effectiveness of the external audit

Describe how the committee assessed audit quality: its own observations
of the audit team's challenge on the significant judgements, feedback
from management and internal audit, the firm's transparency report and
regulator inspection findings, and whether the audit plan was delivered
on time. State the conclusion and the recommendation to the board on
reappointment.

*Example:* "The committee assessed the FY2026 audit through a
questionnaire to the committee, finance leads in four countries and
internal audit, a review of the audit firm's latest inspection results,
and its own observation of the auditor's challenge on SJ-01 and SJ-02.
It concluded that the audit was effective and recommends reappointment
of Ashgrove & Partners LLP for FY2027."

## 6. Internal audit oversight

<!-- Guidance: Show that internal audit is independent, resourced and focused on the right risks, and summarise what it found. Name the standard it follows. Pitfall: reporting only the number of audits completed. -->

| Item | Value |
|---|---|
| Head of internal audit reports to | [Audit committee chair (functional); CFO or CEO (administrative)] |
| Standards followed | [IIA Global Internal Audit Standards, effective 2025-01-09 (name only)] |
| Plan approved | [Meeting, date] |
| Plan delivery | [n of m audits completed] (*Example:* 11 of 12; one deferred to Q1 2027 with committee approval) |
| Resources | [FTE, co-source arrangements] |
| Last external quality assessment | [Year, provider] |
| Annual opinion | [Summary of the head of internal audit's opinion] |

Summarise the most significant findings in a sentence each, with the
committee's response, and the status of overdue management actions. The
committee reviews the internal audit charter and plan
(`compliance/internal-audit-charter-and-plan`) and the results of
individual engagements (`compliance/iia-internal-audit-engagement`).

## 7. Internal control and risk management

<!-- Guidance: Report the committee's review of internal control and its role in the board's Provision 29 declaration. Link to the evidence. Pitfall: duplicating the full declaration; summarise and cross-reference instead. -->

Describe the committee's review of the effectiveness of internal
financial controls and, where the board delegated it, of the wider
internal control and risk management systems. From financial years
beginning on or after 2026-01-01, the board's declaration on material
controls (UK Code Provision 29) appears elsewhere in the annual report;
say here what the committee did to support it and cross-reference
that section.

*Example:* "The committee reviewed the criteria for material controls,
the inventory of twelve material controls, the assurance map and the
year-end assessment set out in the board's statement on risk management
and internal control, together with management's assessment of
internal control over financial reporting for Form 20-F Item 15 and the
auditor's attestation. It considered the significant deficiency AGG-01
in the review of deferred revenue (the US entity review and the group
roll-forward review, both missed in July 2026) identified in the third
quarter, the remediation plan and the retest results. From retests
completed on 2026-12-15 and roll-forward testing in January 2027 it was
satisfied that the corrected controls operated effectively in the
final months of the year. It noted that one
operational material control, overseen by the risk committee, was not
operating effectively at the year end, and the actions agreed."

Use `compliance/material-controls-declaration` for the board's working
paper and `compliance/control-deficiency-evaluation` for the severity
analysis behind each deficiency. The GAO Green Book 2025 component model
(control environment, risk assessment, control activities, information
and communication, monitoring) is a public-domain way to structure the
discussion.

## 8. Whistleblowing and fraud oversight

<!-- Guidance: Report how the committee oversees the speak-up channel and fraud risk, without identifying reporters. Pitfall: reporting case numbers with no view on whether the channel works. -->

| Item | FY2026 *(Example)* |
|---|---|
| Reports received | 23 |
| Of which financial reporting, accounting or audit matters | 3 |
| Substantiated in whole or part | 5 |
| Median days to acknowledge / to close | 2 / 38 |
| Fraud losses identified | EUR 41k (supplier bank detail fraud attempt, partly recovered) |
| Fraud risk assessment reviewed | 2026-12 meeting |

Record who oversees the speak-up arrangements under the company's
governance (the board or a committee; check the Code provisions that
apply), how the committee satisfied itself that reports are handled
independently and without retaliation, and what themes it saw. Audit committees of US-listed issuers, including
foreign private issuers such as Corvid, must have procedures
for complaints about accounting, internal accounting controls or audit
matters, including confidential, anonymous submission by employees
(Exchange Act Rule 10A-3). EU and UK entities apply national rules
transposing or replacing Directive (EU) 2019/1937. See
`compliance/whistleblowing-policy` and `compliance/fraud-risk-assessment`.

## 9. Sustainability reporting oversight

<!-- Guidance: Explain the committee's role in sustainability reporting and its assurance where the company is in scope. State the reporting basis and the current scope position. Pitfall: describing obligations that changed under the 2026 EU simplification without checking the current position. -->

For EU companies in scope of the Corporate Sustainability Reporting
Directive, Article 39 of Directive 2006/43/EC (as amended) extends the
committee's monitoring tasks to sustainability reporting and its
assurance; check national transposition. The EU Omnibus I Directive
(EU) 2026/470 narrowed the scope to undertakings with more than 1,000
employees and more than EUR 450m turnover, with simplified European
Sustainability Reporting Standards mandatory from financial year 2027;
check the current position. UK companies report on the bases that apply
to them (for example climate-related disclosures under the listing
rules and UK sustainability reporting standards once adopted).

Record the reporting basis, the metrics the committee reviewed, the
controls over sustainability data (consider whether any are material
controls, see MC-012 in the material controls example) and the
assurance obtained. See
`finance/sustainability-double-materiality-assessment` and
`finance/issb-sustainability-disclosure`.

## 10. Committee effectiveness and forward agenda

<!-- Guidance: Say how the committee evaluated itself, what it learned and what it will focus on next year. Pitfall: a forward agenda copied from the standing calendar. -->

*Example:* "The committee's effectiveness was reviewed internally in
December 2026 using a questionnaire to members and regular attendees.
Actions: earlier circulation of papers on significant judgements (at
least seven days before meetings) and a joint session with the risk
committee on third-party risk."

| Forward agenda item | Reason | Planned meeting |
|---|---|---|
| IFRS 18 first-time presentation and comparatives | Applies to years beginning on or after 2027-01-01 | February, July 2027 |
| ISA 570 (Revised 2024) and ISA 240 (Revised), as adopted in the UK by the FRC, effect on the FY2027 audit | IAASB effective date: periods beginning on or after 2026-12-15; check the ISA (UK) effective dates; the Form 20-F audit follows PCAOB standards | March 2027 |
| External audit tender | Tenure reaches the tender point | From Q2 2027 |
| Remediation of MC-009 | Not effective at FY2026 year end | Each meeting until closed |
| [Item] | [Reason] | [Meeting] |

## 11. US module: Form 20-F audit committee disclosures

<!-- Guidance: Use this section for a foreign private issuer that files Form 20-F and has securities listed on a US exchange. Exchange Act Rule 3a12-3(b) exempts its securities from the proxy rules, so no proxy statement audit committee report is written; the committee's US disclosures sit in Form 20-F Item 16 and its structure must meet Rule 10A-3. Pitfall: copying a US domestic proxy report into the Form 20-F, or omitting the pre-approval policy and the de minimis percentage from Item 16C. -->

A foreign private issuer reports its audit committee matters in the
annual report on Form 20-F rather than in a proxy statement. Prepare
each item below with the company secretary and the auditor, keep the
evidence with the committee minutes, and make sure the UK annual
report (Part A) and the Form 20-F say the same thing about the same
facts.

| Form 20-F item | Topic (summary) | What the committee prepares or confirms | Corvid FY2026 *(Example)* |
|---|---|---|---|
| 16A | Audit committee financial expert | Whether the board has determined that at least one member is an audit committee financial expert, the name and whether independent; if none, why not | Chair determined to be the expert; independent |
| 16B | Code of ethics | Whether a code of ethics applies to the principal executive, financial and accounting officers or controller, where it is available, and any amendment or waiver in the year | Group code of conduct (ELC-001); no waivers granted |
| 16C | Principal accountant fees and services | Fees billed for the last two years in the four categories, a description of the services in the last three categories, the pre-approval policies and procedures, and the percentage of services approved under the de minimis exception | Section 5.3 table; de minimis 0% |
| 16D | Exemptions from the listing standards for audit committees | Whether the company relies on any Rule 10A-3 exemption and, if so, whether that affects the committee's ability to act independently | No exemption relied on |
| 16G | Corporate governance | A concise summary of the significant ways the company's governance practices differ from those the US exchange requires of domestic companies | UK Code practice summarised, for example board committee composition and the approval of equity plans under UK rules |

Rule 10A-3 sets the minimum structure of the committee for a US-listed
issuer. Confirm each point and keep the evidence:

| Rule 10A-3 point (summary) | Evidence | Corvid *(Example)* |
|---|---|---|
| Every member is independent: no compensatory fees beyond board and committee fees, and not an affiliated person (with accommodations for foreign private issuers) | Annual independence questionnaires | 3 of 3 members |
| The committee is directly responsible for the appointment, compensation, retention and oversight of the auditor, which reports directly to it; where home-country law gives shareholders the appointment, the responsibility applies within that law | Terms of reference; minutes approving the audit fee and recommending reappointment to shareholders | Yes; shareholders appoint the auditor under UK company law on the committee's recommendation |
| Procedures for complaints about accounting, internal accounting controls or audit matters, including confidential, anonymous submission by employees | Whistleblowing policy and case log (section 8) | Yes |
| Authority to engage independent counsel and other advisers | Terms of reference | Yes |
| Funding for the auditor's fee, advisers and the committee's ordinary administrative expenses | Board resolution, budget | Yes |

*Example* wording for Form 20-F Items 16A and 16C (original illustrative
text for Corvid):

> **Item 16A.** Our board of directors has determined that [Name], the
> chair of our audit committee, is an audit committee financial expert
> and is independent under the applicable NYSE listing standards and
> Rule 10A-3.
>
> **Item 16C (extract).** Ashgrove & Partners LLP has served as our
> independent registered public accounting firm since FY2019. The fees
> it billed for FY2025 and FY2026 are shown below by category. Our audit
> committee pre-approves all audit and permitted non-audit services,
> either individually or under an annual pre-approval policy that lists
> the specific services, and is informed of each service provided. No
> services were approved under the de minimis exception in either year.

US domestic registrants instead give the audit committee report in their
proxy statement under Regulation S-K Item 407(d)(3), with the
financial expert disclosure under Item 407(d)(5); that format is not
covered here.

## 12. Quarterly report to the audit committee

<!-- Guidance: Part B is the regular paper the CFO and assurance providers bring to each meeting. Keep the same structure every quarter so trends are visible. Pitfall: a 200-page pack with no summary page telling the committee what decisions are needed. -->

Prepare one report per scheduled meeting. Start with a one-page summary
of decisions requested and matters for attention, then the sections
below. Each section owner signs off their part.

| Section | Owner | Content |
|---|---|---|
| B1. Decisions requested | Company secretary | Approvals needed today (for example audit plan, non-audit service, policy) |
| B2. Financial reporting update | CFO | Results, significant judgements and estimates in progress, new standards, alternative performance measures |
| B3. Internal control status | Head of internal control | Testing progress, deficiencies by severity, aggregation, remediation, material controls status |
| B4. Internal audit | Head of internal audit | Plan delivery, reports issued with ratings, overdue actions, resource issues |
| B5. External auditor | Engagement partner | Audit progress, findings, independence matters, non-audit services approved under delegated authority |
| B6. Risk, fraud and whistleblowing | Chief risk officer, head of compliance | Fraud cases, speak-up statistics and themes, significant regulatory matters |
| B7. Tax and treasury matters within the committee's remit | Head of tax, group treasurer | Uncertain tax positions, covenant headroom, hedge accounting |
| B8. Actions log | Company secretary | Section 13 |

*Example* summary page, Q3 2026 meeting (2026-10-14, Corvid):

| Topic | Status | Decision or attention |
|---|---|---|
| Q3 trading and judgements | Revenue EUR 36,100k for Q3; no new significant judgements | For information |
| Internal control | 82% of key control tests complete; DEF-2026-001 and DEF-2026-003 aggregated to a significant deficiency (AGG-01), see paper AC-2026-Q3-06 | Approve remediation plan and retest timetable |
| Material controls | 11 of 12 on track; MC-009 two supplier assessments at risk of missing year end | Attention: risk committee to monitor |
| Internal audit | 8 of 12 audits issued; IA-2026-07 rated "needs improvement" (ERP privileged access for the CC-VN company code, DEF-2026-002) | For information |
| External audit | FY2026 integrated audit plan and fee EUR 1,250k; materiality EUR 700k | Approve plan and fee |
| Non-audit services | Sustainability limited assurance EUR 60k, approved individually above EUR 25k under the pre-approval policy | Approve |
| Whistleblowing | 6 reports in Q3, 1 relating to expense claims, investigation ongoing | For information |

For B3, include the deficiency register extract with IDs, severity,
owner and due date, and a trend chart or table of open deficiencies by
quarter. For B5, include any matters the auditor wishes to raise
privately, which are taken in the session without management.

Keep the quarterly report factual. Opinions and recommendations should
be marked as such and attributed to the person giving them, so that the
minutes can record what the committee accepted and what it challenged.

## 13. Actions log

<!-- Guidance: Track every committee request to closure. Review open actions at the start of each meeting. Pitfall: actions closed by the person who owns them without evidence. -->

| Action ID | Meeting | Action | Owner | Due | Status | Evidence of closure |
|---|---|---|---|---|---|---|
| ACT-2026-14 *(Example)* | 2026-10-14 | Retest CTL-REV-004, CTL-REV-007 and ITG-ACC-002 after remediation and report results | [@head-of-internal-control] | 2026-12-15 | Closed | TW-2026-REV-004 and TW-2026-REV-007 version 1.1; IA-2026-07 follow-up |
| ACT-2026-15 *(Example)* | 2026-10-14 | Prepare tender timetable for the FY2029 audit appointment | [@cfo] | 2027-03-31 | Open | |
| ACT-2026-16 *(Example)* | 2026-12-09 | Report overdue supplier assessments each quarter until closed | [@head-of-procurement] | 2027-03-31 | Open | |
| [ACT-ID] | [Date] | [Action] | [@owner] | YYYY-MM-DD | [Open / Closed] | [Reference] |

## 14. Glossary and references

<!-- Guidance: Define terms shareholders may not know and list the rules relied on by number. Obtain the current texts. -->

| Term | Meaning in this template |
|---|---|
| Additional report | The auditor's written report to the audit committee of a public-interest entity under Regulation 537/2014, Article 11 |
| Audit committee financial expert | A US term for a member with specified accounting and financial expertise, disclosed by foreign private issuers under Form 20-F Item 16A (Item 407(d)(5) for domestic registrants) |
| Foreign private issuer | A non-US company that meets the SEC test in Exchange Act Rule 3b-4; it files Form 20-F and is exempt from the proxy rules |
| Pre-approval | The audit committee's approval, before the work starts, of each audit and permitted non-audit service by the auditor of an SEC issuer |
| Key audit matter | A matter the auditor judged most significant in the audit, described in its report |
| Material control | A control the board judges material for the UK Code Provision 29 declaration |
| Non-audit service | Any service by the auditor other than the statutory audit |
| Public-interest entity | Listed companies, credit institutions, insurers and others designated by law |
| Significant deficiency | A control weakness important enough to merit the attention of those overseeing financial reporting (SEC definition in 17 CFR 210.1-02(a)(4); auditing standards use similar terms) |

References (obtain current versions):

- SEC Form 20-F, Items 15 and 16A to 16D and 16G, sec.gov.
- 17 CFR 240.10A-3, listing standards relating to audit committees; 17 CFR 240.3a12-3(b), exemption of foreign private issuers from the proxy rules; 17 CFR 210.2-01(c)(7), audit committee pre-approval; eCFR.
- Sarbanes-Oxley Act of 2002, sections 201 and 202 (Exchange Act section 10A(g) and (i)).
- 17 CFR 229.407(d) (Regulation S-K Item 407), for US domestic registrants only, eCFR.
- New York Stock Exchange Listed Company Manual, Section 303A (name only; check the requirements that apply to foreign private issuers).
- Regulation (EU) No 537/2014 on specific requirements regarding statutory audit of public-interest entities, OJ L 158, 2014-05-27, applies from 2016-06-17; Articles 4, 5, 6, 11, 16, 17; EUR-Lex. UK retained and amended version on legislation.gov.uk.
- Directive 2006/43/EC on statutory audits, Article 39, as amended (including by Directive (EU) 2022/2464); check the consolidated text on EUR-Lex.
- Directive (EU) 2026/470 (Omnibus I), sustainability reporting scope changes; check the consolidated text.
- UK Corporate Governance Code 2024, Provisions 24, 25, 26 and 29; FRC Audit Committees and the External Audit: Minimum Standard (2023); FRC Ethical Standard (names and numbers only).
- PCAOB AS 1301, Communications with Audit Committees; PCAOB Rule 3526; IIA Global Internal Audit Standards; ISA 570 (Revised 2024); ISA 240 (Revised) (names and numbers only).
- GAO, Standards for Internal Control in the Federal Government (Green Book), GAO-25-107721, 2025.
- Related templates: Material Controls Declaration (`compliance/material-controls-declaration`), Control Deficiency Evaluation (`compliance/control-deficiency-evaluation`), Internal Audit Charter and Plan (`compliance/internal-audit-charter-and-plan`), Whistleblowing Policy (`compliance/whistleblowing-policy`), Going Concern Assessment (`finance/going-concern-assessment`), Impairment Test Memo (`finance/impairment-test-memo`), Audit Engagement Letter (`finance/audit-engagement-letter`), Board Pack (`business/board-pack`).

## Standard and licence note

Based on public law: SEC Form 20-F, Exchange Act Rules 3a12-3 and
10A-3, Regulation S-X Rule 2-01(c)(7), Sarbanes-Oxley Act sections 201
and 202 and Regulation S-K Item 407 (US government works) and EU
legislation from EUR-Lex (Regulation
(EU) No 537/2014 and Directive 2006/43/EC), reused with acknowledgement
under Commission Decision 2011/833/EU and summarised in original
wording, with the GAO Green Book 2025 (US government work) as the
internal control reference. The UK Corporate Governance Code 2024 and
other FRC publications, PCAOB standards and rules, ISA standards, the
IIA Global Internal Audit Standards and the COSO framework are cited by
name and number only; no text from them is reproduced or paraphrased.
The NYSE listing standards are cited by name only. This template is
not affiliated with or endorsed by the SEC, the NYSE, the European
Commission, GAO, FRC, PCAOB, IAASB, IIA or COSO. All names and
figures in the examples are fictional. This template is original text
written for this collection. Check the current official versions before
use. Template licence: MIT.