Year-End Is Coming: Seven Questions Every Audit Committee Should Be Asking

By Joseph Jalbert September 3, 2026

As year-end approaches, audit committees at community banks and credit unions have an important opportunity to shift their focus from reviewing historical results to challenging assumptions, evaluating risks, and ensuring the institution is prepared for the year ahead.

The most effective audit committees do more than receive reports and review financial statements. They ask thoughtful questions. They challenge management’s conclusions when appropriate. They seek to understand not only what happened during the year, but also where future risks may emerge.

Regulators, external auditors, and boards increasingly expect audit committees to provide meaningful oversight of financial reporting, internal controls, risk management, and governance activities. Responsibilities often include reviewing significant accounting estimates, evaluating internal control matters, overseeing the audit process, monitoring compliance, and understanding key risks facing the institution.

As institutions prepare for year-end reporting and the annual audit process, below are seven questions audit committees should consider asking management and their auditors.

1. What are the most significant estimates in the financial statements, and what has changed since last year?

Every financial institution relies on estimates in preparing its financial statements. Some estimates are relatively routine, while others involve significant management judgment and can have a material impact on reported results.

For many institutions, areas requiring heightened attention include:

• Allowance for credit losses (ACL)
• Fair value measurements
• Valuation of acquired assets and liabilities in a business combination
• Deferred tax assets
• Other real estate owned and collateral valuations
• Goodwill and other intangible assets

The audit committee should understand not only the estimates themselves, but also the key assumptions driving them.

A useful follow-up question is:

If management had made a different assumption, would the conclusion have changed significantly?

Understanding the sensitivity of significant estimates often provides greater insight than understanding the estimate itself.

2. Does our ACL methodology continue to reflect current portfolio risks?

Although CECL implementation is now several years behind us, the allowance remains one of the most significant estimates in a financial institution’s financial statements.

Many institutions have experienced changes in economic conditions, portfolio composition, concentrations, and borrower performance over the past several years. Audit committees should challenge management to explain whether the methodology continues to appropriately capture those risks.

Questions may include:

• Have there been significant changes in portfolio composition?
• Are qualitative factor adjustments still supportable?
• How are economic forecasts being incorporated?
• Have any model limitations been identified?
• Have validation findings been adequately addressed?

The goal is not for audit committee members to become CECL experts. Rather, they should understand management’s process and be comfortable that the estimate remains reasonable and well supported.

3. Are there emerging credit risks that may not yet be reflected in historical performance?

Financial reporting often reflects historical information. Audit committees, however, should also focus on what is developing beneath the surface.

Community financial institutions continue to monitor various areas of potential concern, including commercial real estate concentrations, interest rate pressures on borrowers, liquidity challenges, and segments of the loan portfolio showing early signs of stress.

A question worth asking is:

If we were building the loan portfolio today, are there areas where we would make different decisions?

The answer may reveal risks that have not yet manifested themselves in charge-offs or nonperforming assets but nevertheless warrant attention.

4. What internal control issues should the committee be most concerned about?

Audit committees are often informed of identified deficiencies, but the more important discussion is understanding what those deficiencies reveal about the control environment.

Strong governance includes reviewing management’s assessment of internal controls and monitoring the resolution of identified weaknesses and deficiencies.

Rather than simply asking whether any issues were identified, consider asking:

• What control failures occurred during the year?
• What trends are emerging?
• Are we relying too heavily on key individuals?
• Have staffing shortages impacted control execution?
• Are there manual processes that create unnecessary risk?

As technology continues to evolve, institutions should also understand controls surrounding data integrity, cybersecurity, vendor management, and artificial intelligence tools that may be used throughout the organization.

5. Have we adequately evaluated our third-party risk environment?

Today’s financial institutions rely heavily on third-party service providers. Core processors, loan platforms, digital banking providers, fintech partners, and cloud-based applications all play critical roles in operations.

As reliance on third parties increases, so does the need for oversight. Audit committees should understand:

• Which vendors are considered critical
• Whether vendor monitoring procedures are operating effectively
• Whether SOC reports and other control reports are being reviewed timely
• Whether any significant cybersecurity incidents or control deficiencies have been reported

The committee should also ask management whether any new vendor relationships or technology initiatives introduced risks that may not have existed in prior years.

6. Are we prepared for upcoming accounting, regulatory, and reporting developments?

One of the most valuable functions of an audit committee is helping management avoid surprises.

Year-end presents an ideal opportunity to discuss developments on the horizon.

Questions may include:

• Are there upcoming accounting standards that could impact us?
• Have regulators identified new areas of focus?
• Are there emerging disclosure requirements we should anticipate?
• Are there industry developments that may affect our strategy or reporting processes?

Even if a change will not affect the current year’s financial statements, understanding it early often allows institutions to implement changes more efficiently and avoid last-minute challenges.

7. What keeps management and the auditors up at night?

This may be the most important question on the list. Audit committees often receive detailed reports, dashboards, and presentations. But some of the most valuable insights emerge through simple conversation.

Ask management:

What is your biggest concern heading into year-end?

Then ask the auditors the same question.

The answers may highlight risks involving financial reporting, staffing, internal controls, information technology, credit quality, vendor relationships, or strategic initiatives.

Importantly, this question often reveals issues that may not yet appear on formal risk reports or board presentations.

A Final Thought

The best audit committee meetings are rarely the ones that spend the most time reviewing financial statements. They are the meetings where committee members ask thoughtful questions, challenge assumptions, and encourage meaningful dialogue between management and both internal and external auditors. A deeper level of engagement leads to learning and greater understanding, which leads to successfully implemented improvements and efficiencies the next time around.

Year-end should not be viewed solely as a compliance exercise or a review of historical results. It is also an opportunity to evaluate whether the institution’s governance processes, control environment, and financial reporting framework are keeping pace with a changing risk landscape.

By asking the right questions, audit committees can help strengthen oversight, improve transparency, and better position their institutions for the year ahead.

And in many cases, the value is not found in the answers themselves; it is found in the conversations those questions create.