How do internal controls and risk management relate to corporate governance, and what is the audit committee's role?

• A. Internal controls mitigate risk and ensure accurate reporting; risk management identifies and mitigates risks; the audit committee oversees controls and risk disclosures.
• B. They are unrelated to governance; the audit committee handles only audit scheduling.
• C. Internal controls only address IT security; risk management is a legal compliance issue; the audit committee has no oversight role.
• D. The audit committee manages day-to-day risk decisions.

Answer: (A)

Internal controls and risk management are essential to how a company governs itself. Internal controls are the processes and procedures that help ensure reliable financial reporting, safeguard assets, promote compliance with laws, and support effective operations. Risk management is the ongoing practice of identifying, assessing, and addressing threats that could prevent the organization from achieving its objectives. Together, they provide the information, safeguards, and accountability that good governance relies on.

The audit committee plays a crucial oversight role. It is typically made up of independent directors and is responsible for overseeing the integrity of financial reporting, the effectiveness of internal controls over financial reporting, and the organization’s risk management framework. It reviews what management and the internal and external auditors are doing, monitors whether control deficiencies are being addressed, and ensures that disclosures about risks and controls are complete and accurate. This oversight helps maintain trust with investors and other stakeholders by keeping management accountable and ensuring that the control environment remains strong.

Other options miss the mark because governance encompasses more than just scheduling audits or IT security. Internal controls extend beyond IT; risk management covers a broad range of threats beyond legal compliance; and the audit committee does not manage day-to-day risk decisions, but oversees and challenges management’s handling of risk and the reporting of that risk.