When Assurance Becomes a Veto: The Audit Committee as Transformation Blocker
Each actor optimised locally, and the organisation ended up with a diminished future that no single person chose.
The Committee That Learned to Say No
There is a particular quiet that now settles over a board when a transformation proposal reaches the audit committee. It is not the quiet of careful scrutiny. It is the quiet of people calculating their own exposure. In the months since public confidence in corporate reporting collapsed, I have watched the audit committee move from the margin of the transformation conversation to its centre — and, in moving, become the place where ambition is quietly managed downward.
The pattern that recurs across organisations of every size is the same. A committee constituted to provide assurance has begun, almost without anyone deciding it should, to arbitrate strategy. The questions it asks are no longer only is this being reported honestly? but should we be doing this at all? And because the mood of the moment rewards caution above almost everything else, the answer it reaches for, more often than not, is no.
How Assurance Became a Veto
The audit committee was never designed to decide. Its purpose, as every governance code since Cadbury has set out, is to give the board independent comfort that the numbers are sound, the controls are working, and the external auditor is genuinely independent. It is an assurance function. Assurance and decision-making are different activities, requiring different information, different temperaments, and different accountabilities.
What I have observed is a steady erosion of that boundary, accelerated sharply by the events of the past year. Three forces have pushed the committee across the line:
- Fear has raised the status of the cautious voice. In a climate where directors read about personal liability over breakfast, the member who counsels delay is heard as prudent and the member who counsels action is heard as reckless. The asymmetry is new, and it is powerful.
- The committee has the last look. Because assurance sits late in the governance sequence, the audit committee often sees a proposal after the board has warmed to it — and a late, narrow, risk-framed question can unravel months of work in twenty minutes.
- Nobody owns the cost of refusal. A committee that stops a flawed programme is thanked. A committee that stops a sound one is never blamed, because the road not taken leaves no wreckage to inspect.
That third force is the one the profession understands least, and it is the one that matters most.
An audit committee is measured, almost entirely, on the failures it prevents. It is measured not at all on the opportunities it forgoes. Until that asymmetry is corrected, governance will default to refusal — not because directors are timid, but because the scoreboard only counts in one direction.
Risk Aversion as the Default Setting
I want to be precise about the claim. The problem is not that audit committees ask hard questions; hard questions are the whole point of them. The problem is that risk aversion has quietly become the default — the position the committee returns to when it is uncertain, tired, or short of time. And transformation, by its nature, arrives at the committee wrapped in uncertainty. It cannot be otherwise. A programme that could be fully evidenced in advance would not be a transformation; it would be a purchase.
So the committee faces, again and again, a proposal it cannot fully de-risk, in a climate that punishes visible failure, with a scoreboard that ignores invisible cost. The rational individual response — protect yourself, ask for more analysis, defer the decision — aggregates into an organisational posture that no one chose and few would defend if it were stated plainly: we would rather forgo a good outcome than risk a visible bad one.
“The organisations that will struggle most in the coming years are not those that lack ambition. They are those whose ambition must survive a body rewarded solely for preventing loss.”
The Programme That Dies at the Gate
I have watched this happen closely enough to describe the mechanics. A transformation programme is conceived because someone in the business can see that the current way of operating will not hold. It is worked up over months. It gathers sponsors. It reaches the board, which is broadly persuaded. And then it goes to the audit committee for the assurance step — and there, in a meeting whose remit is supposedly narrow, it meets a question it cannot fully answer, because no honest transformation can answer every question in advance. The benefits are probabilistic; the risks are concrete. The committee, doing what the moment rewards, asks for more work.
The programme returns three months later, thinner, more cautious, its bolder elements pruned to survive the room. What is finally approved is safe, and it is also too small to matter. No one in that sequence behaved unreasonably. That is the point. Each actor optimised locally, and the organisation ended up with a diminished future that no single person chose. This is what I mean when I say risk aversion has become a default rather than a decision. Defaults are invisible precisely because no one has to argue for them.
What the Textbooks Miss
Read the governance literature and you will find the audit committee described almost entirely in terms of what it protects against: fraud, misstatement, control failure, auditor capture. This is not wrong. In the current climate it is urgently right. But it is half a picture, and the missing half is where transformation dies.
The internal-control thinking that the Turnbull guidance brought into the mainstream was a genuine advance — it asked boards to understand risk as something to be managed across the whole enterprise, not audited once a year. But in practice I have seen its language conscripted for a narrower purpose: to furnish a committee with a vocabulary of objection. Where is the risk assessment? becomes less a genuine question than a mechanism of delay. The framework meant to make organisations think about risk more intelligently is used, too often, to help them avoid risk altogether. That is not what its authors intended, and it is not the same thing.
What a More Effective Committee Would Do
I am not arguing for a weaker audit committee. A weak one, in this environment, would be a disaster. I am arguing for a committee that understands the true shape of its accountability — and for a board that refuses to let assurance masquerade as strategy. In the organisations that handle this well, and there are some, I see a consistent set of habits:
- They separate the assurance question from the decision. The committee is asked, explicitly, is this proposal honestly represented and are its risks properly understood? — not should we proceed? The second question is returned, deliberately, to the board that owns the strategy.
- They name the cost of no. Every recommendation to defer or decline is accompanied by an honest statement of what is being given up. Not to shame caution, but to make it visible, so that it can be weighed rather than assumed.
- They put transformation risk in front of the committee early. A proposal seen in draft, when it can still be shaped, invites partnership. The same proposal seen only at the final gate invites veto. Sequence is not a detail; it is most of the outcome.
- They distinguish the risk of acting from the risk of standing still. The most disciplined committees I have observed insist that both appear in the paper. An organisation that only ever quantifies the risk of change will, reliably, stop changing.
None of this weakens assurance. It restores it to its proper scope, and it forces the accountability for direction back to where it belongs.
The Reckoning Ahead
The pressures that have empowered the audit committee are not going to ease soon; if anything, the regulatory response now taking shape will deepen them. That is precisely why the profession needs to be clear-eyed now, before the habits harden. An assurance body that has drifted into strategy will not drift back on its own. It will need a board willing to say, plainly, that preventing every loss is not the same as governing well — and that an organisation which cannot transform because its governance only knows how to refuse has not managed its risk. It has merely relocated it, from the balance sheet to the future.
The audit committee is not the enemy of transformation. But an audit committee that has quietly become the board’s default answer very much is. The distinction is the whole of the matter, and in the anxious climate of this moment it is the easiest thing in the world to lose.