Audit Committee Report Template (UK Code, Form 20-F Item 16)

Audit Committee Report: [Company name], [Financial year]

Two linked documents for an audit committee: (A) the annual report of the committee's work for shareholders, and (B) the quarterly report that management and assurance providers give to the committee. Part A serves the audit committee section of a UK annual report (UK Corporate Governance Code 2024, Provisions 24 to 26 and 29, cited by number), the audit committee disclosures of a US-listed foreign private issuer in SEC Form 20-F (Items 16A to 16D and 16G) with Exchange Act Rule 10A-3 and the auditor pre-approval rule in Regulation S-X Rule 2-01(c)(7), and EU public-interest entity duties under Regulation (EU) No 537/2014 (including the auditor's Article 11 additional report to the audit committee) and Directive 2006/43/EC, Article 39. Part B is a practice format for the committee's regular meetings. Internal control content uses the GAO Green Book 2025 as the public-domain reference; COSO, PCAOB and ISA standards are named only. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, audit or accounting advice. Obtain the standard or law for the normative text.

Document control

Approvals

Revision history

Contents

Part A: annual report of the committee

1. Purpose, regimes and placement
2. Membership, meetings and attendance
3. Responsibilities and activities in the year
4. Significant financial reporting judgements
5. External auditor
6. Internal audit oversight
7. Internal control and risk management
8. Whistleblowing and fraud oversight
9. Sustainability reporting oversight
10. Committee effectiveness and forward agenda
11. US module: Form 20-F audit committee disclosures

Part B: quarterly report to the committee

12. Quarterly report to the audit committee
13. Actions log
14. Glossary and references

1. Purpose, regimes and placement

The committee reports each year on how it discharged its responsibilities. The content and place of publication depend on the company's listing and incorporation. Use the table to decide which sections are required, and record the decision.

Example: Corvid applies the UK Code, is a UK public-interest entity and is an SEC foreign private issuer filing Form 20-F (ADSs on the New York Stock Exchange). It publishes this report in its UK annual report. Foreign private issuers are exempt from the proxy rules, so no proxy statement report is written; the committee's US disclosures go in Form 20-F Items 16A to 16D and 16G (section 11), and Rule 10A-3 applies to the committee through the exchange's listing standards.

2. Membership, meetings and attendance

Regular attendees by invitation: [CEO], [CFO], [group financial controller], [head of internal audit], [chief risk officer], [external audit engagement partner]. The committee meets the external auditor and the head of internal audit without management present [at least twice a year].

Record the composition basis that applies and the evidence for it. UK companies applying the Code check the committee against Provision 24 (read the Code for the composition and experience expectations), and record for each member the facts the board relied on: independence assessment, professional qualifications, roles held and sector knowledge. For a foreign private issuer, Form 20-F Item 16A requires disclosure of whether the board has determined that at least one audit committee financial expert serves on the committee, the expert's name and whether that person is independent, or an explanation if there is none (US domestic registrants give the same disclosure under Item 407(d)(5)). Exchange Act Rule 10A-3 and the listing standards govern independence: a member may not accept consulting, advisory or other compensatory fees from the company beyond board and committee fees and may not be an affiliated person, subject to the accommodations the rule gives foreign private issuers. Example: the Corvid board determined that the chair is an audit committee financial expert and that all three members are independent under Rule 10A-3 and the UK Code.

3. Responsibilities and activities in the year

The committee acts under terms of reference approved by the board and published on the company's website. Its responsibilities cover the integrity of financial and narrative reporting, the external audit, internal audit, internal control and risk management, whistleblowing and, for in-scope companies, the oversight of sustainability reporting and its assurance.

Add any additional meetings, including those held with the risk committee on shared topics (for example cyber controls or third-party risk), and say how overlap between committees was managed so that no material control fell between them.

4. Significant financial reporting judgements

For each significant issue considered in relation to the financial statements, record the issue, the committee's work and its conclusion. Agree the list with the matters the auditor reports as key audit matters; explain any difference.

Give a short narrative after the table for any judgement where the committee changed management's proposal or required more disclosure. A reader learns more from "the committee asked for an additional downside scenario, which removed the DACH headroom at a 10.5% discount rate" than from "the committee reviewed the impairment test".

Also report the committee's review of the annual report as a whole: the process supporting the board's statement that the report is fair, balanced and understandable, the consistency of alternative performance measures with the financial statements, and the transition to IFRS 18 for years beginning on or after 2027-01-01 (see finance/ifrs-18-transition-plan).

5. External auditor

5.1 Appointment, tenure and tender

Regulation (EU) No 537/2014, Article 17, sets a maximum engagement duration of ten years for public-interest entities, which Member States may extend (up to twenty years with a public tender under Article 16, or twenty-four years with a joint audit), followed by a four-year cooling off period. Key audit partners must rotate off no later than seven years after appointment under Article 17(7), and national ethical rules may set shorter periods. Under Article 16(2), when the committee recommends a new appointment, the recommendation is justified, contains at least two choices and states a reasoned preference. The UK retained version keeps a similar framework; check legislation.gov.uk and the applicable FRC Ethical Standard for current UK periods.

5.2 Independence

The auditor confirms its independence to the committee in writing each year and discusses threats and safeguards with the committee (Regulation 537/2014, Article 6(2); for SEC issuers, including foreign private issuers, the auditor's written independence communication under PCAOB Rule 3526, cited by number only). Record what the committee reviewed:

• the auditor's written confirmation and the threats it identified;
• employment of former audit staff by the company;
• personal, financial and business relationships disclosed;
• the fee dependency of the audit firm on the company (Article 4(3) sets a review mechanism where fees from one public-interest entity exceed 15% of the firm's total fees for three consecutive years);
• the non-audit services in section 5.3.

5.3 Non-audit services and fees

Non-audit services by the auditor require committee approval after an assessment of threats and safeguards (Article 5(4)); services on the Article 5(1) prohibited list are not allowed. Where non-audit services (other than prohibited ones and those required by law) are provided for three or more consecutive years, Article 4(2) caps their fees at 70% of the average statutory audit fees for the last three consecutive years. The common reading, used here, applies the cap from the fourth year to the average of the three years before the year being tested.

where $F$ is the statutory audit fee for the entity, its parent and controlled undertakings and the consolidated accounts. Some readings include the current year instead; check national law, the Commission's interpretation and the current consolidated text for the exact base period and any national variations, and record the reading you use.

Example (EUR thousand, Corvid group, Ashgrove & Partners LLP):

Calculation for FY2026: non-audit services were provided in FY2023, FY2024 and FY2025, three consecutive years, so the cap applies in FY2026. Average audit fees (950 + 1,050 + 1,150) / 3 = 1,050; cap = 0.70 x 1,050 = 735; non-audit services 180 = 17.1% of the average, within the cap. Classification of each service as "required by law" or not depends on national law; record the basis used.

SEC issuers, including foreign private issuers. The committee must pre-approve every audit and permitted non-audit service by the auditor (SOX section 202, Exchange Act section 10A(i); Regulation S-X Rule 2-01(c)(7)). Approval is given either for each engagement before it starts or under detailed pre-approval policies that name the particular service, keep the committee informed of each service and do not delegate the committee's responsibility to management. A narrow de minimis exception covers non-audit services not recognised as such when engaged, up to 5% of total fees paid to the auditor in the year, if they are promptly brought to the committee and approved before the audit is completed. The services prohibited by SOX section 201 (Exchange Act section 10A(g)), such as bookkeeping, financial information systems design, valuation, actuarial and internal audit outsourcing services, apply alongside the Article 5(1) list; apply the stricter of the two. Fees are disclosed in Form 20-F Item 16C in four categories: audit, audit-related, tax and all other.

Example (EUR thousand, Form 20-F Item 16C categories; classification agreed with the auditor):

Check: 1,150 + 165 = 1,315; 1,250 + 180 = 1,430. Services approved under the de minimis exception: none in either year. Corvid's policy: every engagement is pre-approved; engagements above EUR 25k are approved individually by the committee, and smaller ones under the annual pre-approval policy, with each one reported at the next meeting.

5.4 Additional report to the audit committee (EU and UK public-interest entities)

The auditor of a public-interest entity submits a written additional report to the committee no later than the audit report date (Regulation 537/2014, Article 11). Use the checklist to confirm it was received and discussed. Items are summarised by the letters in Article 11(2).

5.5 Effectiveness of the external audit

Describe how the committee assessed audit quality: its own observations of the audit team's challenge on the significant judgements, feedback from management and internal audit, the firm's transparency report and regulator inspection findings, and whether the audit plan was delivered on time. State the conclusion and the recommendation to the board on reappointment.

Example: "The committee assessed the FY2026 audit through a questionnaire to the committee, finance leads in four countries and internal audit, a review of the audit firm's latest inspection results, and its own observation of the auditor's challenge on SJ-01 and SJ-02. It concluded that the audit was effective and recommends reappointment of Ashgrove & Partners LLP for FY2027."

6. Internal audit oversight

Summarise the most significant findings in a sentence each, with the committee's response, and the status of overdue management actions. The committee reviews the internal audit charter and plan (compliance/internal-audit-charter-and-plan) and the results of individual engagements (compliance/iia-internal-audit-engagement).

7. Internal control and risk management

Describe the committee's review of the effectiveness of internal financial controls and, where the board delegated it, of the wider internal control and risk management systems. From financial years beginning on or after 2026-01-01, the board's declaration on material controls (UK Code Provision 29) appears elsewhere in the annual report; say here what the committee did to support it and cross-reference that section.

Example: "The committee reviewed the criteria for material controls, the inventory of twelve material controls, the assurance map and the year-end assessment set out in the board's statement on risk management and internal control, together with management's assessment of internal control over financial reporting for Form 20-F Item 15 and the auditor's attestation. It considered the significant deficiency AGG-01 in the review of deferred revenue (the US entity review and the group roll-forward review, both missed in July 2026) identified in the third quarter, the remediation plan and the retest results. From retests completed on 2026-12-15 and roll-forward testing in January 2027 it was satisfied that the corrected controls operated effectively in the final months of the year. It noted that one operational material control, overseen by the risk committee, was not operating effectively at the year end, and the actions agreed."

Use compliance/material-controls-declaration for the board's working paper and compliance/control-deficiency-evaluation for the severity analysis behind each deficiency. The GAO Green Book 2025 component model (control environment, risk assessment, control activities, information and communication, monitoring) is a public-domain way to structure the discussion.

8. Whistleblowing and fraud oversight

Record who oversees the speak-up arrangements under the company's governance (the board or a committee; check the Code provisions that apply), how the committee satisfied itself that reports are handled independently and without retaliation, and what themes it saw. Audit committees of US-listed issuers, including foreign private issuers such as Corvid, must have procedures for complaints about accounting, internal accounting controls or audit matters, including confidential, anonymous submission by employees (Exchange Act Rule 10A-3). EU and UK entities apply national rules transposing or replacing Directive (EU) 2019/1937. See compliance/whistleblowing-policy and compliance/fraud-risk-assessment.

9. Sustainability reporting oversight

For EU companies in scope of the Corporate Sustainability Reporting Directive, Article 39 of Directive 2006/43/EC (as amended) extends the committee's monitoring tasks to sustainability reporting and its assurance; check national transposition. The EU Omnibus I Directive (EU) 2026/470 narrowed the scope to undertakings with more than 1,000 employees and more than EUR 450m turnover, with simplified European Sustainability Reporting Standards mandatory from financial year 2027; check the current position. UK companies report on the bases that apply to them (for example climate-related disclosures under the listing rules and UK sustainability reporting standards once adopted).

Record the reporting basis, the metrics the committee reviewed, the controls over sustainability data (consider whether any are material controls, see MC-012 in the material controls example) and the assurance obtained. See finance/sustainability-double-materiality-assessment and finance/issb-sustainability-disclosure.

10. Committee effectiveness and forward agenda

Example: "The committee's effectiveness was reviewed internally in December 2026 using a questionnaire to members and regular attendees. Actions: earlier circulation of papers on significant judgements (at least seven days before meetings) and a joint session with the risk committee on third-party risk."

11. US module: Form 20-F audit committee disclosures

A foreign private issuer reports its audit committee matters in the annual report on Form 20-F rather than in a proxy statement. Prepare each item below with the company secretary and the auditor, keep the evidence with the committee minutes, and make sure the UK annual report (Part A) and the Form 20-F say the same thing about the same facts.

Rule 10A-3 sets the minimum structure of the committee for a US-listed issuer. Confirm each point and keep the evidence:

Example wording for Form 20-F Items 16A and 16C (original illustrative text for Corvid):

Item 16A. Our board of directors has determined that [Name], the chair of our audit committee, is an audit committee financial expert and is independent under the applicable NYSE listing standards and Rule 10A-3.

Item 16C (extract). Ashgrove & Partners LLP has served as our independent registered public accounting firm since FY2019. The fees it billed for FY2025 and FY2026 are shown below by category. Our audit committee pre-approves all audit and permitted non-audit services, either individually or under an annual pre-approval policy that lists the specific services, and is informed of each service provided. No services were approved under the de minimis exception in either year.

US domestic registrants instead give the audit committee report in their proxy statement under Regulation S-K Item 407(d)(3), with the financial expert disclosure under Item 407(d)(5); that format is not covered here.

12. Quarterly report to the audit committee

Prepare one report per scheduled meeting. Start with a one-page summary of decisions requested and matters for attention, then the sections below. Each section owner signs off their part.

Example summary page, Q3 2026 meeting (2026-10-14, Corvid):

For B3, include the deficiency register extract with IDs, severity, owner and due date, and a trend chart or table of open deficiencies by quarter. For B5, include any matters the auditor wishes to raise privately, which are taken in the session without management.

Keep the quarterly report factual. Opinions and recommendations should be marked as such and attributed to the person giving them, so that the minutes can record what the committee accepted and what it challenged.

13. Actions log

14. Glossary and references

References (obtain current versions):

• SEC Form 20-F, Items 15 and 16A to 16D and 16G, sec.gov.
• 17 CFR 240.10A-3, listing standards relating to audit committees; 17 CFR 240.3a12-3(b), exemption of foreign private issuers from the proxy rules; 17 CFR 210.2-01(c)(7), audit committee pre-approval; eCFR.
• Sarbanes-Oxley Act of 2002, sections 201 and 202 (Exchange Act section 10A(g) and (i)).
• 17 CFR 229.407(d) (Regulation S-K Item 407), for US domestic registrants only, eCFR.
• New York Stock Exchange Listed Company Manual, Section 303A (name only; check the requirements that apply to foreign private issuers).
• Regulation (EU) No 537/2014 on specific requirements regarding statutory audit of public-interest entities, OJ L 158, 2014-05-27, applies from 2016-06-17; Articles 4, 5, 6, 11, 16, 17; EUR-Lex. UK retained and amended version on legislation.gov.uk.
• Directive 2006/43/EC on statutory audits, Article 39, as amended (including by Directive (EU) 2022/2464); check the consolidated text on EUR-Lex.
• Directive (EU) 2026/470 (Omnibus I), sustainability reporting scope changes; check the consolidated text.
• UK Corporate Governance Code 2024, Provisions 24, 25, 26 and 29; FRC Audit Committees and the External Audit: Minimum Standard (2023); FRC Ethical Standard (names and numbers only).
• PCAOB AS 1301, Communications with Audit Committees; PCAOB Rule 3526; IIA Global Internal Audit Standards; ISA 570 (Revised 2024); ISA 240 (Revised) (names and numbers only).
• GAO, Standards for Internal Control in the Federal Government (Green Book), GAO-25-107721, 2025.
• Related templates: Material Controls Declaration (compliance/material-controls-declaration), Control Deficiency Evaluation (compliance/control-deficiency-evaluation), Internal Audit Charter and Plan (compliance/internal-audit-charter-and-plan), Whistleblowing Policy (compliance/whistleblowing-policy), Going Concern Assessment (finance/going-concern-assessment), Impairment Test Memo (finance/impairment-test-memo), Audit Engagement Letter (finance/audit-engagement-letter), Board Pack (business/board-pack).

Standard and licence note

Based on public law: SEC Form 20-F, Exchange Act Rules 3a12-3 and 10A-3, Regulation S-X Rule 2-01(c)(7), Sarbanes-Oxley Act sections 201 and 202 and Regulation S-K Item 407 (US government works) and EU legislation from EUR-Lex (Regulation (EU) No 537/2014 and Directive 2006/43/EC), reused with acknowledgement under Commission Decision 2011/833/EU and summarised in original wording, with the GAO Green Book 2025 (US government work) as the internal control reference. The UK Corporate Governance Code 2024 and other FRC publications, PCAOB standards and rules, ISA standards, the IIA Global Internal Audit Standards and the COSO framework are cited by name and number only; no text from them is reproduced or paraphrased. The NYSE listing standards are cited by name only. This template is not affiliated with or endorsed by the SEC, the NYSE, the European Commission, GAO, FRC, PCAOB, IAASB, IIA or COSO. All names and figures in the examples are fictional. This template is original text written for this collection. Check the current official versions before use. Template licence: MIT.