Audit Committee Buckets explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Not a checklist of sections. Three areas of responsibility — and the third one contains a decision about whether to stay.
Why buckets rather than a list of sections
The framing is deliberate: the audit committee role can be stratified under a few broad buckets. I have found that it makes more sense to view the role in terms of those buckets, rather than through the lens of a checklist of sections of some laws.
And on the underlying knowledge: I believe that the knowledge and the skills typically possessed by a chartered accountant are good enough for an individual to become a member of the audit committee of a public company. The requirement is principally from corporate laws, with SEBI regulations added for a listed company, and for a chartered accountant it would require a little bit of brushing up.
The first of the audit committee buckets — financial reporting
The first bucket relates to financial reporting. This includes accounting and reporting to shareholders every quarter in case of a listed company. This bucket includes interaction with the statutory auditors because they are an integral player in the finalization of the accounts for reporting. Therefore, a broad knowledge and overview of how accounts are closed, and financial reports generated is critical. It is also important to understand the statutory auditor's role and responsibilities, so that you can ensure high quality.
Bucket two — risk management
The second bucket is of risk management and related actions. In some companies, there may be a separate risk committee, but in any case, the output of that committee, in the form of a Risk Register, would come to the audit committee only. This is because the Audit Committee's statutory role is to ensure that risks are being managed properly.
Internal audit is a major risk mitigation tool. The audit committee members need to be aware of the strategy, structure and processes in the internal audit area. They can then get the best out of the internal auditors and ensure that internal audit emerges as an effective and sustained risk mitigation tool for the company.
The third bucket relates to compliance and vigil mechanisms. This area is a specific and can be understood and operationally managed through checklists.
Then the warning: we need to keep in mind that operational excellence in this area does not guarantee full compliance effectiveness. This area could also contain tricky grey issues that escape the operational compliance framework. Such issues may not be easily resolvable.
That is the limitation of every checklist. A compliance calendar records whether filings were made on time; it says nothing about a practice that is not clearly prohibited, not clearly permitted, and quietly material.
The method proposed for reaching those issues is unusual and good: for reaching to such issues, that may not be formally reported, one has to wear two hats — one of a compliance auditor and the other of a businessperson. This helps in understanding whether the grey area is likely to be fatal to the company or not.
The compliance hat asks whether the practice is defensible. The business hat asks what happens if it is challenged — the commercial and reputational consequence. Neither question alone identifies the issues that matter.
And then the sentence that distinguishes this from ordinary committee guidance: this approach also helps to understand whether the grey area will ever turn white and acceptable. If you conclude that it will always stay grey, you may want to decide whether you will continue as an audit committee member or not.
A grey area is tolerable while it is being resolved. One that will never resolve is a permanent exposure carried by whoever chairs or sits on the committee — and the honest conclusion may be to leave.
The three audit committee buckets summarised
| Bucket | Core content | Key relationship |
|---|---|---|
| Financial reporting | Quarterly and annual accounts; how accounts are closed | Statutory auditors |
| Risk management | Risk register; ensuring risks are managed properly | Internal auditors |
| Compliance and vigil | Checklists, plus the grey areas they miss | Compliance head; whistleblower channel |
For an average chartered accountant, these three buckets are easily manageable if he or she follows a meticulous and methodical organized approach.
Common mistakes
- Managing the audit committee buckets as a checklist of statutory sections.
- Letting a risk register stop at a separate risk committee.
- Treating a clean compliance checklist as compliance effectiveness.
- Carrying a permanent grey area without deciding whether to continue.