Three things audit committee chairs are quietly asking for in 2026 that they were not asking for two years ago.
CFOs still framing audit committee prep the same way they did in 2023 are quietly falling behind what the room now expects.
One: a real view on cyber and IT resilience inside the CFO's remit
The CFO is now expected to know the state of it, name the risks, and have a plan.
This has moved from CIO territory into the CFO's board scope faster than most CFOs have caught up. The reasons are structural. Cyber events increasingly have direct financial materiality. Insurance premiums are being priced based on control maturity. Regulators are asking finance leaders to sign off on positions that used to sit two functions away.
The CFO who walks into an audit committee meeting in 2026 without a substantive view on cyber and IT resilience is the CFO the chair privately mentions to the CEO afterwards. Not as a criticism, as a gap.
What "having a view" actually means:
- A specific list of the three or four most material IT risks facing the business.
- A named position on each: what the current control is, what the residual risk is, what the mitigation plan is.
- A relationship with the CIO or Head of IT strong enough that the CFO can defend those positions without checking.
None of this requires the CFO to become a cyber expert. It requires the CFO to have built the relationship with whoever is, and to have brought that view into the audit committee room.
Two: ESG data quality, not just ESG reporting
Not the reporting itself. The underlying data.
Chairs want to know the CFO can defend the numbers under scrutiny, not just publish them. The distinction matters because ESG reporting has moved from a marketing exercise to a diligence-grade disclosure in most sectors. Investors and buyers now interrogate the numbers.
The CFO who has treated ESG as a communications workstream is going to struggle in the next audit committee meeting where the chair asks: "Where does that emissions number actually come from, and how sure are we of it?"
Three things the strongest CFOs are now doing on ESG data:
- Naming the specific source system for each ESG metric that goes into the annual report.
- Applying the same materiality and audit thinking to ESG data as to financial data.
- Being willing to say "we do not have that number to the standard I would want, and here is the plan to get there."
The willingness to name gaps honestly is often what impresses the audit committee chair most.
Three: a clearer view of the second-tier finance team
Audit committee chairs are increasingly asking to meet the FD, the Head of FP and A, and the Head of Tax directly, not just the CFO.
Where those relationships do not exist, they are pushing for them to be built.
The reason is not distrust of the CFO. It is a governance shift. Audit committees increasingly want to hear from the people doing the work, not only the person representing the work. In part because they want depth on technical questions the CFO may not be able to answer to the standard the chair wants. In part because they want visibility on succession.
CFOs who welcome this shift and actively introduce their second layer to the audit committee tend to be trusted more, not less. CFOs who insulate the audit committee from their team read as defensive.
The practical implication: at the next audit committee meeting, bring the Head of FP and A or the Head of Tax to present a section directly. Not the whole meeting. A focused 15-minute section on a specific technical topic where that person is closer to the detail than you are.
What this means for CFO hiring at listed or IPO-track businesses
The audit committee capability required of CFOs at listed or IPO-track businesses has quietly widened.
Not just prior listed-company reporting experience. Not just Big Four pedigree. Actual comfort with:
- Cyber and IT resilience as a CFO-level topic.
- ESG data governance, not just ESG reporting.
- Introducing and defending a second-tier finance team to audit committee scrutiny.
At the CFO-search stage, these are legitimate first-tier requirements now. They were "nice to have" in 2023. They are "must have" in 2026.
If you are running a CFO search for a listed or IPO-track business, or preparing an existing CFO for a materially more demanding audit committee dynamic, get in touch.
