The Board's Role in a Financial Audit: From Hiring to Follow-Through

For many nonprofits, the annual audit is treated like a trip to the dentist: a little dreaded, largely handed off to staff, and forgotten until next year. That is a missed opportunity. An external audit is one of the few moments each year when an independent professional examines your finances and controls and reports directly to the board. Used well, it strengthens trust with funders, catches problems early, and sharpens your organization's financial discipline.

Here is how a board should engage with the audit process, from selecting the firm to acting on what the auditors find.

Know What an Audit Is (and Isn't)

An independent financial audit is an examination of your financial statements by a licensed CPA firm, resulting in an opinion on whether those statements fairly present your financial position in accordance with accounting standards. A clean (or "unmodified") opinion is the goal.

Be clear on what an audit does not do:

• It is not a guarantee that fraud is absent. Auditors test samples and assess risk; they do not examine every transaction.
• It is not the same as a review or a compilation, which offer less assurance and cost less.
• It is not a management consulting engagement. Auditors can flag weaknesses but generally will not fix them for you.

Whether you even need a full audit depends on your size, your state's charitable registration rules, and your funders' requirements. Many states require audited financials above a revenue threshold, and many large grants and government contracts require them regardless. If you are unsure, your finance committee should confirm the specific triggers that apply to your organization.

Selecting and Overseeing the Auditor

The board, not management, owns the relationship with the auditor. In practice this responsibility usually sits with an audit committee or, in smaller organizations, the finance committee.

When selecting or renewing an audit firm:

• Put it out to bid periodically. Every five to seven years, request proposals from a few qualified firms with nonprofit experience. This keeps fees honest and brings fresh eyes.
• Check for nonprofit fluency. Nonprofit accounting has quirks (net asset classifications, in-kind contributions, functional expense reporting) that general business auditors sometimes miss.
• Consider rotating the lead partner even if you keep the same firm. It reduces the risk of overly comfortable relationships.
• Confirm independence. The audit firm should not also be doing your bookkeeping. That creates a conflict where they would be auditing their own work.

The engagement letter, which spells out scope and fees, should be reviewed and approved at the board or committee level, not simply signed by the executive director.

During the Audit: Meet the Auditors Directly

One of the most important governance practices around the audit is simple: the board (or audit committee) should meet with the auditors without staff present, at least once.

This executive session gives auditors a safe channel to raise concerns they might soften in front of management. Ask them directly:

• Did you encounter any disagreements with management during the audit?
• Were there any difficulties getting the information you needed?
• Did you find any weaknesses in internal controls?
• Is there anything you would want to know if you sat on this board?

You are not looking to ambush your executive director. You are exercising an independent check that good governance requires. Skilled executives welcome it, because a clean audit backed by real board oversight is far more credible to funders.

Reading the Deliverables

At the end of the engagement, expect two main documents. Board members should understand both.

The audited financial statements. These include the statement of financial position (balance sheet), statement of activities (income statement), statement of functional expenses, statement of cash flows, and the all-important footnotes. The footnotes often contain the real story: significant commitments, related-party transactions, restricted funds, and going-concern language if the organization's survival is in question. Do not skip them.

The management letter (or governance communication). Auditors are required to communicate certain matters to those charged with governance, and they often include a separate letter flagging control weaknesses and recommendations. Pay close attention to any items labeled:

• Material weakness: a serious deficiency that could allow a significant misstatement to go undetected. Treat this as urgent.
• Significant deficiency: less severe, but still important enough to report to the board.

Even small "other matters" comments deserve a plan. A recurring low-level comment that never gets fixed signals a board that is not following through.

The Part Boards Skip: Follow-Through

The audit is only as valuable as what happens after it lands. Too many boards accept the report, thank the auditors, file it, and repeat the same weaknesses next year.

Build a simple follow-through habit:

1. Formally accept the audit by board vote and record it in the minutes. This documents that the full board received and reviewed it.
2. Turn management-letter comments into a corrective action list with owners and deadlines. Segregation of duties, timely bank reconciliations, and documented approval workflows are common fixes.
3. Check progress at the next few meetings, not just at the following year's audit.
4. Share the results appropriately. Board leadership should be comfortable providing audited financials to major funders, and your Form 990 should align with the audited numbers.

Common Red Flags for Board Members

Even without an accounting background, watch for warning signs around audit time:

• The audit is chronically late. Delays often signal disorganized records or something staff would rather not surface.
• The same control weakness appears year after year.
• Management resists letting the board meet the auditors alone.
• Large, unexplained adjusting entries that the auditors had to propose.
• Going-concern language or steadily shrinking net assets without a plan.
• Frequent auditor turnover initiated by the organization.

None of these automatically means wrongdoing, but each deserves a direct question and a straight answer.

Takeaway

The audit is not a staff chore to rubber-stamp; it is a board responsibility and a genuine oversight tool. Own the auditor relationship, meet with the auditors without staff at least once a year, actually read the footnotes and management letter, and turn every finding into a tracked action item. Do that consistently, and the audit becomes what it should be: an annual health check that builds trust with funders and keeps your organization honest with itself.