Why Coordination Between Risk and Audit Committees Matters
Board risk and audit committees may review the same event from different perspectives. A weakness in a process, for example, may undermine a financial report and also affect the insurer’s exposure to a significant risk. If each committee assumes the other is responsible, the board may not receive timely oversight. If both committees independently request the same analysis, management may spend time producing duplicate reports while important issues receive less attention.
Effective coordination does not mean that the committees become interchangeable or that one committee takes over the other’s responsibilities. It means that their mandates are clear, significant issues reach the appropriate committee, and shared issues have an agreed lead and an efficient path for joint or sequential review. The board retains its overall oversight responsibility; committee delegation organizes its work rather than removing that responsibility.
The distinction is about the question being considered, not simply the name of the underlying topic. The risk committee asks whether exposures, aggregate effects, and responses are understood and consistent with the organization’s risk appetite. The audit committee asks whether reporting and controls are reliable and whether assurance work addresses relevant weaknesses. A single event can raise both sets of questions.
Separate Mandates, Shared Issues
A risk committee should not become the owner of every control review merely because controls affect risk. Nor should an audit committee assume responsibility for deciding how much risk the organization should accept. Each committee provides oversight within its mandate. Management remains responsible for operating the business and addressing issues; committees challenge, monitor, and escalate as appropriate.
Some topics naturally cross committee boundaries. A significant control failure might impair the accuracy of reported results and create uncertainty about a material risk exposure. In that case, the committees need enough information to discharge their separate responsibilities, but they do not necessarily need to repeat one another’s work. A useful arrangement is to identify a lead committee for the issue, specify what the other committee needs to receive, and agree on how conclusions will be communicated to the full board.
| Oversight question | Typical lead | Possible contribution from the other committee |
|---|---|---|
| Are material exposures and their aggregate implications understood? | Risk committee | Audit committee may share relevant assurance findings about the reliability of information or controls. |
| Are financial reporting processes and relevant controls reliable? | Audit committee | Risk committee may consider the effect of a weakness on the organization’s exposures and risk response. |
| Does an issue affect both risk exposure and reporting or controls? | Lead is designated by the charters and the issue’s primary oversight question. | The second committee receives a defined update or conducts a coordinated review within its mandate. |
This table describes a practical default, not a universal allocation. An organization may assign a topic differently under its charter or governing requirements. The important test is whether the actual arrangement is explicit, complete, and consistent with the committees’ authority.
A Practical Method for Coordinating Oversight
A responsibility matrix can make committee boundaries visible. For each significant issue, record the oversight question, lead committee, any supporting committee, information to be shared, and the route for escalation. This turns broad charter language into a usable working arrangement.
State what the board needs to oversee: exposure and risk response, reporting and control reliability, or both. Do not assign an issue solely by its label.
Use the charters and the primary oversight question to identify the committee responsible for the main review and recommendation.
For a shared issue, define whether the second committee receives a summary, reviews a particular implication, or participates in a joint discussion. Avoid vague instructions to “coordinate.”
Specify what is reported, when it is reported, and how unresolved or material matters reach the full board. A committee summary should not obscure a significant issue that requires board attention.
Compare planned reviews and reporting so the same work is not requested twice without purpose and no material oversight question is left unassigned.
The logic of the assignment check is straightforward. If each issue is assigned to one lead committee, the minimum number of lead assignments equals the number of distinct issues. Where an issue genuinely requires both committees’ attention, it creates an additional committee-issue assignment. Thus, the total assignment count is the number of distinct issues plus the number of additional committee assignments for shared issues. This count is a completeness check, not a measure of oversight quality: one well-defined joint review may be more useful than multiple overlapping requests.
Worked Examples
Worked Example: Assigning a Lead to Three Hypothetical Issues
A hypothetical insurer’s board receives three issues. First, a concentration of storm-related policies may exceed the organization’s stated risk tolerance. Second, a reconciliation weakness may cause reported balances to be misstated. Third, a model input control failure may affect both the reliability of a financial estimate and the insurer’s understanding of a material exposure. For each issue, identify the lead committee and the coordination needed.
Method. Classify each issue by its primary oversight question, then add a defined supporting role where the issue crosses mandates. The common mistake is to classify the third issue under only one committee because it has a single operational cause.
Issue 1: storm concentration. The main question is whether the exposure and its implications are consistent with the organization’s risk tolerance. The risk committee is the lead. The audit committee need not repeat the exposure review; it may receive an update if assurance work identifies a relevant reliability concern in the information used.
Issue 2: reconciliation weakness. The immediate oversight question is whether reported balances can be relied upon and whether the relevant controls are adequate. The audit committee is the lead. If the weakness has a material effect on the organization’s assessment of exposures, that implication should be communicated to the risk committee.
Issue 3: model input control failure. This issue has two distinct oversight questions: whether the financial estimate is supported by reliable inputs, and whether the failure changes the assessment of a material exposure. The audit committee leads on reporting and control reliability. The risk committee receives the exposure implication and considers it within its risk-oversight mandate. The committees should agree on what evidence is shared so neither assumes the other has addressed both questions.
Check. There are three distinct issues and four committee-issue assignments: one for each issue’s lead, plus one supporting assignment for the shared model-control issue. The allocation covers both dimensions of the third issue without requiring duplicate reviews of the other two. A different lead could be appropriate if the insurer’s charters specify one, but the shared responsibility still needs to be explicit.
Worked Example: Counting Assignments Without Confusing Them With Issues
A hypothetical board’s annual oversight map lists two issues assigned only to the risk committee, two assigned only to the audit committee, and two shared issues that each require attention from both committees. Calculate the number of distinct issues and the total number of committee-issue assignments.
Method. Count each distinct issue once, then count each committee’s assignment to that issue. The common mistake is to report the number of distinct issues as the number of assignments.
There are \(2+2+2=6\) distinct issues. The two risk-only issues generate 2 assignments, and the two audit-only issues generate 2 assignments. Each of the two shared issues generates 2 assignments, one to each committee, so the shared issues generate \(2\times2=4\) assignments.
Check. The total is 8 assignments across 6 distinct issues. The difference, 2, is exactly the two additional assignments created by giving each shared issue a second committee. Saying there are 6 assignments would count the shared issues only once and understate committee workload.
Worked Example: Coordinating a Significant Control Finding
A hypothetical insurer’s audit committee receives a significant finding about a control used to prepare a quarterly risk report. The finding does not establish that the insurer’s exposure has changed, but it does mean that management cannot yet confirm the report’s accuracy. The next risk committee meeting is scheduled later in the quarter. Determine a practical coordination sequence.
Method. Separate the confirmed control finding from the unresolved risk implication, then give each committee a defined task and establish an escalation route. The common mistake is either to wait for the next scheduled meeting without notifying the risk committee or to treat the unverified report as a confirmed change in exposure.
First, preserve the audit committee’s lead. The audit committee oversees the finding’s implications for reporting reliability and the relevant control response under its charter. It should receive a clear account of what is known, what remains uncertain, and what follow-up is planned.
Second, provide a timely, qualified update to the risk committee. The risk committee needs to know that the report may be unreliable and which conclusions may therefore need caution. The update should distinguish verified exposure information from information not yet validated; it should not state that the exposure has changed when the finding only concerns report reliability.
Third, set a review point and escalation condition. The committees should identify when validated information is expected and what would cause the matter to go to the full board before the next regular meeting, such as evidence that a material exposure is outside the approved tolerance. The board’s authority and applicable escalation requirements remain controlling.
Check. The audit committee retains the reporting-and-control review, while the risk committee receives the information needed to judge exposure implications. A qualified update prevents both a communication gap and an unsupported conclusion about the risk position.
Common Coordination Failures
- Assuming a shared issue has no lead. Both committees may be involved, but one should be identified as responsible for organizing the primary review and recommendation.
- Using the same label to infer the same responsibility. “Model risk,” “capital,” or “controls” can raise different questions. Classify the oversight question rather than relying on a topic name.
- Sending the same material to both committees without tailoring. Shared access to information may be appropriate, but each committee should know what it is expected to consider and what decision or recommendation is sought.
- Allowing committee coordination to delay escalation. A significant matter should reach the board through the organization’s established route when committee review alone is insufficient or too slow.
- Treating oversight as management action. Committees challenge and monitor; management remains responsible for carrying out operations and responding to findings.
- Assuming that a committee’s review replaces the other’s. A control review does not automatically settle the risk implications, and a risk discussion does not automatically establish that reporting controls are reliable.
Check Your Understanding
For each hypothetical case, identify the appropriate lead or coordination arrangement. Answers are included for checking.
- A hypothetical insurer identifies that the portfolio’s exposure to one peril may be inconsistent with its approved risk tolerance. Which committee should normally lead the oversight discussion? (Answer: The risk committee, subject to its charter.)
- A hypothetical quarter-end review finds a weakness in the process used to support reported balances, with no identified change in the insurer’s risk exposure. Which committee should normally lead, and what should be the focus? (Answer: The audit committee should lead on reporting reliability and relevant controls.)
- Two risk-only issues, three audit-only issues, and one issue assigned to both committees appear on an oversight map. How many distinct issues and committee-issue assignments are there? (Answer: 6 distinct issues and 7 assignments: \(2+3+(1\times2)=7\).)
- A control weakness may affect both a financial estimate and the reliability of an exposure report. Give a suitable division of oversight. (Answer: The audit committee leads on reporting and control reliability; the risk committee receives and considers the implications for exposure oversight, with information and escalation agreed.)
- A shared issue appears on both committee agendas, but neither charter or agenda note says which committee is responsible for coordinating the review. What is the main governance weakness, and what should be clarified? (Answer: Lead accountability is unclear; designate a lead, specify the other committee’s role, and set the information-sharing and escalation route.)