Choosing and Using an External Auditor Properly

An audit that only checks the numbers is not the audit your governance actually needs

Boards that have crossed the threshold discussed in the previous article, and now need an external reviewer or auditor, often treat the engagement as a straightforward procurement decision. Get a quote, check the price, sign the letter. The reality carries more governance weight than that, both in who is legally entitled to do the work and in what an audit actually examines.

Who Can Actually Do The Work

For a large registered charity, where the ACNC Act requires an audit, that audit must be carried out by a registered company auditor, an audit firm, or an authorised audit company, terms defined by reference to the Corporations Act 2001. This is not a title an accountant can claim casually. For a medium charity choosing a review rather than a full audit, the reviewer can be a registered company auditor or, more flexibly, a current qualified member of one of the relevant professional bodies, CPA Australia, Chartered Accountants Australia and New Zealand, or the Institute of Public Accountants. Whichever pathway applies, the reviewer or auditor must provide your charity with a signed, written independence declaration, a requirement under section 60-40 of the ACNC Act, confirming they meet the ethical independence standards set by the Accounting Professional and Ethical Standards Board. Non-charitable associations should check the auditor requirements in the Corporations Act or their state or territory Act.

What An Audit Actually Looks At

A common misconception treats an audit as a narrow check of the accounting figures alone. An ACNC audit or review is focused on the financial report, but the auditor may ask for board minutes, policies and evidence of internal controls, and must report certain matters, so governance records still matter. This connects directly to the discipline this series has argued for throughout: minutes that capture decisions and reasoning, discussed in the previous quarter, are not just a legal record protecting individual directors, they are precisely the kind of document an auditor may reasonably ask to see when forming a view on the financial report.

An audit is focused on the numbers, but much of the evidence behind them is governance evidence. A board that prepares only the ledger for its auditor misses much of the value an audit relationship can provide.

The Rotation Question, Answered Honestly

Unlike ASX-listed companies, which face specific statutory audit partner rotation requirements, there is no ACNC rule requiring auditor rotation for registered charities, although your auditor's own professional independence standards may require partner rotation for some larger entities. This is worth stating plainly rather than assuming a rule exists that does not. That absence, however, is not a reason to leave the question unexamined. A long-standing auditor relationship brings institutional knowledge of your organisation. It can also, over enough years, drift toward the same familiarity risk this series has raised elsewhere in different contexts, a relationship comfortable enough that hard questions stop getting asked. The board's Finance, Audit and Risk committee, discussed in the previous article, is precisely the body that should periodically and deliberately consider this question, rather than defaulting to indefinite tenure purely out of inertia.

• Confirm your auditor or reviewer holds the correct qualification for your charity's size tier, and obtain their independence declaration as a matter of course, not an afterthought.
• Prepare governance documents and minutes for the audit process with the same seriousness as financial records, since an auditor may ask to see both.
• Have the Finance, Audit and Risk committee periodically and consciously review the auditor relationship, including whether continued familiarity still serves the organisation or has quietly become a comfort the board hasn't examined.
• Treat findings from a review or audit as input for governance improvement, not merely a compliance box, since the auditor's management letter often identifies control weaknesses and areas for improvement.
• Give the Finance, Audit and Risk committee time to meet the auditor without management present at least once a year, so concerns can be raised freely.

An external audit or review, engaged properly and taken seriously, is one of the few independent checks a board receives on how well it is stewarding the organisation. Treating it as a procurement task rather than a governance relationship wastes most of its real value.

This is one of the practical governance topics built into our Board Director course, alongside the papers, tools and frameworks that turn the principle into your board's actual practice. Explore the course →

Annie Gibbins

General education, not legal, financial, tax, clinical or governance advice. Confirm specifics at the relevant primary source or with your own qualified adviser. Nexus Leadership is operated by Lipstick Consulting Pty Ltd · ABN 15 619 120 482.