The standard quarterly internal audit report answers the question "what has the function been doing?" A committee chair needs a different question answered: "where is this airline exposed, and is anyone doing something about it?" The gap between those two questions explains why audit committee papers grow thicker each year while directors privately admit they learn little from them. The remedy is not more reporting. It is a smaller pack, built around five exhibits, each of which either supports a decision or has no place at the table.
Exhibit 1: Coverage against the real risk universe
One page. Down the side, the airline's material risk entities — commercial, operational, financial and technology — expressed in business language: revenue management, interline settlement, fuel hedging, maintenance contracts, disruption cost, cyber resilience. Across the top: when each was last audited, by whom (internal audit, external specialist, regulator, second line), and the state of the last opinion. The point of the exhibit is what it makes impossible to hide — entities carrying significant money that have never been examined by anyone. A committee that sees this page quarterly will never again approve an audit plan by turning pages of methodology.
Exhibit 2: Ageing of critical actions
Not a list of open findings — an ageing profile. How many high-rated actions are open; how long each has been open against its original due date; how many times each has been re-dated and on whose authority; and which executives own the oldest ones, by name. The re-dating column is the one that changes behaviour. A finding re-dated three times has stopped being a remediation item and become a decision by management not to act, and the committee should discuss it in exactly those terms.
A pack is decision-useful when every exhibit can finish the sentence: "and therefore the committee is asked to…"
Exhibit 3: Thematic root causes
Individual audit reports fragment the picture; the committee needs it reassembled. Once a quarter, internal audit should look across its recent findings and answer: what keeps recurring? Common airline themes include manual workarounds where systems fail to talk to each other, contract entitlements not tracked after signature, exception approvals that bypass stated authority limits, and controls that decay at outstations far from head office. A committee acting on one systemic theme achieves more than one processing twenty isolated findings — because themes point at causes, and causes have budget and ownership implications the committee can actually influence.
Exhibit 4: The forward risk view
Everything above looks backward. The fourth exhibit looks out: what is changing in the next two to four quarters that alters the airline's risk profile — a reservations or revenue accounting system migration, a new codeshare or joint venture, fleet entry into service, a distribution-strategy shift, new consumer-protection regulation — and what assurance, if any, is planned around each change. This is where the committee earns the "audit and risk" part of its name. It is also the exhibit that most reliably provokes useful disagreement between the CFO and the CAE, which is precisely its function.
Exhibit 5: Gaps in the assurance map
The final exhibit lays the three lines against the risk universe and marks where assurance is thin, duplicated or absent. Airlines are unusual in how much external assurance they already receive — safety and operational audits under regulatory and industry schemes, external financial audit, security oversight — and this exhibit stops the committee from mistaking that density in one corner for coverage of the whole. The recurring discovery is an inversion: heavily assured operational domains, and commercially material domains — pricing, partner settlement, contract recovery — where nobody holds an opinion at all.
The discipline that makes it work
- Fixed format, every quarter. The value is in the trend. Exhibits that change shape each meeting cannot show movement.
- Business language throughout. If an exhibit needs audit vocabulary to be understood, it is not finished.
- A decision attached to each exhibit. Approve, challenge, escalate or accept — but never merely "note".
- Fifteen pages or fewer. Anything the pack cannot say in five exhibits belongs in an appendix nobody is obliged to read aloud.
Where to start
Do not redesign the whole pack at once. Ask the CAE to produce Exhibit 1 — coverage against the real universe — for the next meeting, alongside the existing report. The discussion it triggers will tell the committee which of the remaining four exhibits it needs most urgently, and the rest of the pack can be rebuilt one quarter at a time on the strength of it. Where the exhibits reveal gaps the in-house function cannot yet fill — a commercial domain never audited, an assurance map never drawn — that is a resourcing conversation for the committee to have with open eyes, not a reason to soften the exhibit.