Audit Committee Complaint Procedures: Rule 10A-3 and Whistleblower Intake Design

Rule 10A-3 under the Exchange Act sets requirements for the audit committees of listed issuers. One paragraph concerns complaints: the committee must set up procedures to receive, retain and treat complaints about accounting, internal accounting controls and auditing matters, and to let employees submit concerns confidentially and anonymously. Internal audit can test it directly. This post sets out what the rule says and how to design and test the process.

What Rule 10A-3 requires

Independence (b)(1). Each audit committee member must be a member of the issuer's board of directors and otherwise independent. Except for the exemptions in the rule, a member may not accept any consulting, advisory or other compensatory fee from the issuer or a subsidiary, and may not be an affiliated person of the issuer or a subsidiary.

Auditor oversight (b)(2). The audit committee, as a committee of the board, must be directly responsible for the appointment, compensation, retention and oversight of the work of any registered public accounting firm engaged for the purpose of preparing or issuing an audit report or performing other audit, review or attest services. That includes the resolution of disagreements between management and the auditor about financial reporting. The firm must report directly to the audit committee.

Complaints (b)(3). The committee must establish procedures for the receipt, retention and treatment of complaints the issuer receives regarding accounting, internal accounting controls or auditing matters, and for the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters.

Advisers (b)(4). The committee must have the authority to engage independent counsel and other advisers as it determines necessary to carry out its duties.

Funding (b)(5). The issuer must provide appropriate funding, as determined by the audit committee, for the registered public accounting firm's compensation, for advisers the committee engages, and for ordinary administrative expenses of the committee.

Designing the intake

A compliant complaint procedure has five parts.

1. Channels. At least one channel that accepts anonymous submissions, such as a third-party hotline or web form, plus an email address or postal route to the audit committee chair.
2. Scope. Accounting, internal accounting controls and auditing matters, and in practice any ethics or legal concern that could affect financial reporting.
3. Routing. Complaints about accounting or auditing go to the audit committee or its designee, not to the executive named in the complaint. Define a path for complaints involving the CFO, the CEO or the CAE.
4. Retention. A log of each complaint with a date received, category, assigned investigator, status, outcome and retention schedule. The rule's wording calls for receipt, retention and treatment.
5. Reporting. A periodic report to the committee, quarterly at least, with counts, categories, open items and aging, and a private session for sensitive matters.

Worked example

A listed company with 900 employees outsources its hotline to an independent provider. Complaints are delivered to the general counsel, who triages. The audit committee receives an annual summary.

Gaps against the rule's design: routing sends accounting complaints to the general counsel, who reports to the CEO, so complaints about the CEO's expense claims would route to the CEO's subordinate. The annual summary gives the committee little chance to oversee. Fixes: route any complaint mentioning the CEO, CFO, controller or general counsel directly to the audit committee chair; add a quarterly report with aging; give the committee a standing private session with the head of internal audit.

Testing the hotline

Internal audit can test the process under IIA Standard 9.4, which requires the internal audit plan to consider coverage of the effectiveness of the organization's compliance and ethics programs. A practical test:

• Walk through. Submit a test complaint through each channel, anonymous and named. Record the time to acknowledgment and to routing.
• Population. Obtain the provider's full log, not the summary the company prepares, and agree counts.
• Sample. Select complaints in each category and trace to investigation file, conclusion and any remediation.
• Retaliation indicators. For named complainants, check employment changes after the complaint date.
• Awareness. Check that the hotline is on the intranet, in the code of conduct and in training materials.
• Reporting. Compare what the committee received with the full log.

Findings go to the audit committee under the standards. IIA Standard 8.1 lists results of internal audit services among the items the chief audit executive reports to the board, and Standard 11.3 requires the chief audit executive to communicate themes identified across engagements.

Related legal context

Section 302 requires certifying officers to disclose fraud involving management or employees with a significant role in internal controls to the auditors and the audit committee, and the SEC guidance lists fraud by senior management as an indicator of a material weakness. A complaint that alleges such conduct therefore feeds the certification and deficiency processes. See /us/blog/sox-302-and-906-certifications-versus-section-404-reporting. The glossary entry on the SEC whistleblower program is /us/glossary/whistleblower-program.

Non-listed companies

Rule 10A-3 binds listed issuers through exchange listing standards. Private companies and nonprofits are not subject to it. The same intake design, log and committee reporting work there unchanged.

Pitfalls

• A hotline that is anonymous in theory but asks for a phone number.
• Complaints routed to the person complained about.
• No log, so retention and treatment cannot be shown.
• A committee that never sees the full complaint log.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• SEC, 17 CFR 240.10A-3, Listing standards relating to audit committees, paragraphs (b)(1) to (b)(5): https://www.ecfr.gov/current/title-17/section-240.10A-3
• Sarbanes-Oxley Act section 302(a)(5), 15 U.S.C. 7241: https://www.law.cornell.edu/uscode/text/15/7241
• The IIA, Global Internal Audit Standards (2024), Standards 8.1, 9.4, 11.3: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error