For years, the Cybersecurity Maturity Model Certification (CMMC) felt like it was always on the horizon — something to prepare for “someday.” That time has ended. The rule is final, the date is real, and contractors across the defense industrial base (DIB) will see CMMC requirements appear in contracts beginning November.

The question now isn’t whether you’ll need CMMC. It’s whether you’ll be ready in time. 

Find out how Diligent’s solutions can help you get there.

Until now, most DIB companies operated under 

. If you’re a current DoD contractor, take a close look at your agreements. If you see 

 in your contract language, you’ve likely already been expected to comply with NIST 800-171 — and may have been self-attesting without realizing it. That system was always fragile: compliance was often a box-checking exercise, and enforcement was rare. CMMC changes that.

 You’ll need an independent C3PAO (Certified Third-Party Assessment Organization) to validate compliance at Level 2.

 If you’re not certified, you won’t be eligible to win or renew certain contracts.

 Unlike the past, you won’t be able to push major gaps into Plans of Action and Milestones (POA&Ms) and hope they’re overlooked.

The instinct for many organizations will be to wait — for clearer guidance, for budget approval, or for a signed contract that explicitly requires CMMC. But waiting is the biggest risk you can take, because:


There are only so many accredited assessors, and demand will spike once contracts start requiring certification. If you’re not in line early, you may not get certified in time.


Closing gaps — from MFA rollouts to logging improvements — can take months, sometimes a year plus. Many organizations underestimate the effort required.


If you can’t bid on contracts, competitors who invested early will step in. Once that business is lost, it’s hard to win back.

Real-world example: The contract that slips away

Picture a mid-sized manufacturer with steady DoD work. They know CMMC is coming but delay action, assuming they can ramp up once the rule “really takes effect.”

Then, a recompete contract hits. The RFP requires CMMC Level 2 certification. The company can’t submit a bid because they haven’t started. Their competitor — who already has a CMMC certification — wins the award.

Because certification must be in place at the 

there’s no chance to “fix it later.” By the time the manufacturer catches up, their foothold in the DIB supply chain has weakened — all because they assumed they had more time.

The organizations that move now will have clear advantages:

Complex fixes can be spread out over quarters instead of crammed into weeks.

 Early movers secure slots with C3PAOs before the rush.

 Being certified early isn’t just about compliance — it’s a differentiator in the market.

No company succeeds with CMMC alone. The process requires coordination across IT, security, compliance, and business leadership. This is where trusted partners matter:

 includes experienced advisory firms, accredited assessment organizations, and technology providers who have already helped dozens of companies navigate these same requirements. Leveraging that ecosystem shortens timelines and reduces risk.

If you’re still on the sidelines, here are the immediate steps to take:

Identify where you stand against NIST 800-171.

 Address high-impact gaps first, like MFA, logging, and access control.

 Don’t wait until contracts require certification to start building those relationships.

 CMMC isn’t a one-and-done exercise. Build processes and tools that make compliance sustainable.

CMMC isn’t a suggestion. It’s the new stage gate for doing business with the Department of Defense.

If you’re not certified at the time of award, you won’t be eligible — period. That means:

Lost subcontractor opportunities as primes refuse to take on noncompliant partners

Lost credibility as competitors demonstrate certification while you scramble to catch up

The totality of the work hasn’t changed — companies have always needed to secure their systems. What has changed is the enforcement. Certification is now the price of entry. Organizations that act now will protect their contracts and strengthen their position in the defense supply chain. Those that wait risk locking themselves out.

CMMC is here: Why waiting is the biggest risk

Boards rely on audit committees to provide independent oversight of financial reporting, internal controls, and risk management. As one of the cornerstones of 

, audit committees protect investor interests while ensuring regulatory compliance across complex business environments.

Modern audit committees face responsibilities that extend far beyond traditional financial oversight. NACD reported that 

 assign cybersecurity oversight to their audit committees. These governance bodies must navigate IT security, 

, and operational risk management alongside established auditing duties.

The committee operates independently from management, with certified public accountants reporting directly to the committee rather than company executives. This structure ensures objective oversight of external auditor selection, compensation, and performance while maintaining the integrity of financial reporting processes.

In this guide, we'll cover the following:

Who should be a member of the audit committee

12 responsibilities of the audit committee

How chief audit executives can support today's audit committees

How Diligent transforms audit committee effectiveness

The audit committee is responsible for helping independent auditors oversee the corporation's financial reporting system in a process independent of management. This foundational role has expanded to address contemporary governance challenges. They achieve financial and operational oversight through:

Providing vital oversight of the corporation's financial reporting processes, internal controls, and independent auditors

Serving as a check and balance over the company's financial reporting practices

Granting a forum for discussing financial concerns candidly and objectively

Managing cybersecurity risk oversight — now assigned to 64% of S&P 500 audit committees

Boards appoint audit committees composed of between three and seven board directors who aren't part of the corporation's management.

Who should be a member of the audit committee?

Modern audit committee composition emphasizes competency-based selection alongside enhanced independence requirements. Audit committees should have at least one individual on the committee who is considered a financial expert.

This focus on talent and expertise reflects broader governance trends. According to the NACD Audit Committee Practices Report, 92% of survey respondents indicated finance and internal audit talent as the primary responsibility of the audit committee. The same research shows that 89% of committees agree that internal audits have a high level of understanding of business operations, highlighting the importance of leveraging this expertise for effective oversight.

The audit committee chair should be a certified public accountant (CPA) or otherwise considered a financial expert; however, it’s not necessary for all members of the committee to be financial professionals. For companies operating under the 

, the Act requires corporations to appoint only independent members to the audit committee. The Act also requires companies to disclose whether they have appointed at least one financial expert to the audit committee.

Enhanced independence requirements for 2025

Enhanced independence requirements reflect evolving governance expectations. 

 has implemented policy clarifications for 2025 that establish a minimum five-year cooling-off period for former CEOs before they can serve on audit committees. The policy specifically states that ISS will recommend voting against any director who has served as CEO within the past five years and is a member of the audit committee.

Even after the cooling-off period, independence is assessed case-by-case, and former CEOs must be classified as independent by ISS to qualify for audit committee service. These restrictions address potential conflicts of interest and ensure the committee maintains objective oversight of financial matters.

While the audit committee is responsible for performing the audit, they are also responsible for other essential tasks related to the audit and the corporation’s 

. Audit committee responsibilities encompass many oversight responsibilities, including fraud prevention, ethics and compliance, oversight of the independent auditor and involvement with external communications. Core oversight functions:

 The audit committee ensures that the company’s risk management plan is well-defined and effective. Management should discuss the company’s policies and guidelines that govern risk management. Both parties should be knowledgeable about major financial risk exposures and the steps managers should take to monitor and control risks.

 This is a crucial function of the audit committee, as it requires members to promptly and consistently address allegations or violations of the 

. Audit committees must protect individuals who come forward with reports of questionable employee behavior. The company must have a fair process for addressing violations of ethics or compliance, which should include regular 

: An essential part of the audit committee's duties is to be responsible for appointing, compensating and overseeing the duties of the independent auditor. This responsibility extends to resolving any disagreements with management. Audit committee members should meet with the independent auditor at least quarterly.

 Audit committee members’ roles require them to oversee and make suggestions for improving the company’s internal operations and processes. Proper oversight of the 

 requires companies to enlist the help of independent internal auditors to ensure the integrity and transparency of the processes.

: During the annual audit, the audit committee meets separately with external auditors to examine matters that need to be discussed privately. It’s important for audit committees to work toward preventing fraud. Auditors with forensic audit expertise are adept at detecting willful accounting errors and anomalies. Because of their unique relationship with external auditors and the importance of their duties, audit committees must have authority over their budgets and the management of external auditors.

 The role of the audit committee requires them to be familiar with the processes and controls for financial reporting and internal controls. This requires working with members of management, independent auditors and internal auditors to acquire adequate knowledge about the company’s financial reporting and internal controls. The committee uses this information to determine whether the company’s financial reporting processes are designed and operating effectively.

 Audit committee responsibilities require committee members to know and understand regulatory requirements, like the NYSE and NASDAQ auditing requirements. These regulations require audit committees to review any significant changes in accounting principles and the adequacy of internal controls.

 Financial analysts, ratings agencies and other financial experts rely on audit committees to oversee earnings releases, SEC filings containing financial information and other financial reports to ensure they’re transparent and fair. Audit committee teams are also responsible for working with legal teams to ensure that disclosures are accurate and complete, and include reporting on financial trends.

 The audit committee should allow management adequate time to review and comment on the audit committee’s annual audit findings. An important function of an audit committee is to provide management with an 

 and final management letter that offers recommendations on how to comply with best practices for financial reporting and internal controls.

Expanded audit committee responsibilities

oversight is one of the priorities for modern audit committees. Committees must schedule monthly cybersecurity risk reviews and develop proactive governance approaches to guide organizations through innovation while maintaining cybersecurity practices.

, committees must embed AI oversight into their frameworks. Committee members should implement quarterly AI governance assessments to monitor the use of AI in financial reporting, internal control over financial reporting, risk management and compliance — even when the board maintains primary oversight.

Environmental, Social, and Governance (ESG)

 reporting has become a core responsibility, driven by expanding regulatory requirements and stakeholder expectations. Committees must broaden their governance focus to address increasing social, political, and ethical challenges while navigating internal and external reputational risks.

Audit committees are responsible for so much more than annual reports. The varied role of the audit committee necessitates that it address a wide range of challenges, including:

Their ongoing activities can strengthen compliance and bolster good governance, but only with the support of effective chief audit executives (CAE).

CAEs champion internal audits for management and the board, creating a culture that encourages internal audits to lead with strategic insights.

With committees now overseeing cybersecurity risk and managing AI governance responsibilities, CAEs must proactively identify risks across these expanded domains. Modern internal audit teams must collaborate with committees to address challenges across traditional financial controls, cybersecurity oversight, and emerging technology governance.

As AI is implemented across organizations, internal audit functions are providing advisory services to set up processes and controls for AI governance. CAEs must work with committees to establish AI-specific control frameworks while ensuring traditional financial reporting controls remain effective.

This dual focus on emerging technology governance and established control frameworks positions internal audit as an operational partner for committees managing expanded oversight complexity.

The evolution of artificial intelligence and automation technologies is transforming how audit committees operate and fulfill their oversight responsibilities. Modern governance platforms address three critical areas that enhance committee effectiveness.

1. Enhanced board book preparation and risk intelligence

Traditional board book preparation consumes weeks involving manual compilation of financial data and compliance documentation.

 transforms audit committee meeting management through AI-enhanced capabilities that automate material creation and distribution. The platform organizes agendas and minutes while securing sensitive documents through enterprise-grade security, with electronic signature integration and real-time risk reporting dashboards.

2. Intelligent meeting preparation and data analytics

 transforms audit committee oversight by providing comprehensive data analytics that enable 100% data coverage rather than traditional sampling-based approaches. The platform aggregates and tests financial and operational data while automating controls testing to deliver evidence-based insights that surface anomalies for committee review.

3. Enhanced risk detection and control monitoring

 provides comprehensive solutions for planning, executing, and reporting internal audits that directly support audit committee oversight roles. The platform offers advanced AI-powered analytics to uncover insights, automate testing, and enable real-time risk monitoring. Committees receive curated, actionable information about internal controls, financial reporting, and emerging risks through centralized functions that produce impactful, visual reports.

These integrated systems address expanded oversight responsibilities that committees manage, from cybersecurity risk assessment to AI governance monitoring.

Strengthen your audit committee effectiveness

Modern audit committees face expanded responsibilities spanning financial oversight, cybersecurity, AI governance, and ESG reporting that manual processes cannot effectively support.

Organizations that combine skilled committee members with integrated technology platforms achieve sustainable governance excellence through real-time risk visibility and proactive decision-making.

Ready to modernize your audit committee operations? Discover how Diligent's integrated governance platform streamlines oversight responsibilities while strengthening compliance and risk management. 

 to see how leading enterprises are transforming their audit committee effectiveness.

The audit committee: What it is and its role

This article originally appeared in our August 28 edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe 

My colleague Josh Black, Vice President of Editorial at Diligent, doesn’t use words like “eventful” and “unconventional” lightly. So, when I saw them front and center in the editor’s forward of this year’s Proxy Season Review, which Diligent Market Intelligence prepares in association with Olshan Frome Wolosky and Campaign Management, I paid even more attention than usual.

“It is difficult to recall a more eventful or unconventional proxy season since the first year of the pandemic,” Black declared. 

Relentless market volatility is only part of it

. Activists have beena dopting new tactics and advancing stronger director candidates to achieve their desired objectives, especially in the U.S. “It feels very much like an inflection point,” Black added.

Proxy season 2025: Evolving shareholder engagement strategies

In this year’s review, his team examines this inflection point, connecting the dots between what we’ve seen in this year’s proxy season and what these trends mean for boards and advisors right now. Here are a few key takeaways, starting with shareholder engagement.

You’ve probably observed a noted decline in proactive communications by institutional investors lately. Regulatory developments, like revised guidance on Schedule 13D/G eligibility, are a big part of this.“ Norms have unmistakably evolved,” Campaign Management CEO and Founder Michael Fein pointed out in his analysis. “Institutional investors paused outreach, reassessed compliance exposure, and pulled back from dialogue just as several proxy campaigns were gathering momentum.”

Shareholders still care deeply about board structure, accountability, and transparency — critical contributors to strong corporate performance in uncertain times.

In the first half of the year, 33 governance-focused proposals passed with majority support. Board composition has been a common target, with director shuffles at Phillips 66 and Penn Entertainment far from isolated anomalies. We’ve also seen a significant increase in withhold campaigns for driving director changes and other demands.

2. Make real-time data and shareholder sentiment a board priority

Amid this perfect storm of new tactics, heightened scrutiny and radio silence from institutional investors, it’s harder than ever to anticipate vote dynamics and activist positioning.

Is a withhold campaign targeted pressure for governance enhancements, or a prelude to a full-blown proxy fight? Your company’s future depends on answering questions like these quickly and well. And this means moving beyond historical data, guesswork and ad hoc interpretation to real-time intelligence.

Now is the time to invest in systems and processes that deliver accurate, actionable data on investor sentiment, proxy trends, and governance benchmarks.

It’s time to look beyond business as usual for shareholder engagement as well. This means rethinking how your organization interacts with institutional investors. What new touchpoints can you leverage to fill in communication gaps? How can you proactively share your governance story — especially future-focused strategies and positive milestones — in a way that responds to current trends and sentiment?

Think about harnessing all of the data collected in the steps above, like 

 and proposal outcomes, to shape your narrative. “The 2025 proxy season made clear that activists will not sit on the sidelines waiting for more ideal economic conditions,” Andrew Freedman, Chair of Olshan Frome Wolosky’s Shareholder Activism Practice Group, warned in this year’s review. And here’s what he recommends: “Stay prepared to respond to well-crafted demands and sharp strategies, underscored by an unwavering focus on performance and accountability.”

Keep reading for more on the 2025 proxy season

Dive into our full analysis — AI, ESG, 2025’s wildest campaigns and much more — in the full report: The Proxy Season Review 2025.

Want regular access to original research in the field of GRC? Bookmark our 

 for the latest surveys, podcasts and reports.

2025 proxy recap: Pivotal shifts for the road ahead 

Boardroom Confidence Erodes In August Poll Amid Washington ‘Chaos’

Survey finds a growing number of public company directors forecast flat growth for the rest of the year, despite new tax cuts. The big opportunity? AI adoption.

After months of tariff-fueled ups and downs, America's public company board members appear to have found some emotional equilibrium about the state of the economy—but it's hardly optimistic.

The latest reading from our Director Confidence Index, a quarterly poll of public company board members in the U.S. conducted by Corporate Board Member and Diligent Institute, finds directors’ perception of the current business environment unchanged since Q2, with little expectation for improvement in the year to come.

Directors rate current conditions at 4.9 out of 10, a modest improvement from last quarter's 4.4 but still well below the 6.7 optimism they expressed at the end of last year.

Meanwhile, their 12-month forecast holds steady q/q at 4.8 out of 10, suggesting a potential plateau for business, amid the competing Washington forces of tariffs, potential Fed cuts and the OBBB.

“We expect higher inflation, rising unemployment and a possible recession, potentially leading to stagflation,” said one director polled, attributing these events to “ongoing tariffs and other policies of the current administration.”

Others point to nascent signs of increasing unemployment, overvalued stock markets and weakening consumer demand, all of which they attribute to DC decision-making rather than any underlying economic fragility. “Chaos at the federal level making investment decisions riskier,” explained one director, echoing several others who said tariffs and geopolitical uncertainty are impacting consumer behavior as well as corporate strategies.

At the same time, manyexpect tailwinds fromthe One Big Beautiful Bill, the influx of foreign investments and the settling of trade agreements, which they say help support business growth. As one director put it: “Stable tax rates, tariffs which are in place and understood, and significant corporate and foreign investment in new plants and services” are driving his optimism.

The likelihood that the Fed will cut rates at their upcoming meeting is also helping curb the negative impact of Washington-imposed headwinds. “I expect tariffs will be settled, interest rates will be lower, and the overall confidence of the consumer will improve,” one director said, explainingher 12-month forecastfor business of 6 out of 10.

Overall though, our August poll shows a deep erosion indirectors’ outlook, with many morepredicting economic conditions will deteriorate in the near term: 37 percent vs. 21 percent in Q2. 

Corporate forecasts for the months ahead remain about where they were last quarter:

65 percent expect revenues to increase over the next 12 months, unchanged from Q2.

56percent expect profits to increase during that same period, vs. 59 percent in Q2.

42 percent plan to increase capital expenditures in that period, vs. 41 percent in Q2.

Against this backdrop, directors say the biggest opportunities for their company can be found in AI adoption (64 percent),with several also finding opportunities in M&A and strategic partnerships (58 percent). 

Corporate Board Member, a division of Chief Executive Group, has been the market leader in board education for 20 years. The quarterly publication provides public company board members, CEOs, general counsel and corporate secretaries decision-making tools to address the wide range of corporate governance, risk oversight and shareholder engagement issues facing their boards. Corporate Board Member further extends its thought leadership through online resources, webinars, timely research, conferences and peer-driven roundtables. The company maintains the most comprehensive database of directors and officers of publicly traded companies listed with NYSE, NYSE Amex and Nasdaq.

Diligent Institute informs, educates, and connects leaders to champion modern governance. We provide original, cutting-edge research on the most pressing issues in corporate governance; certifications and educational programs that equip leaders with the knowledge and credentials needed to guide their organizations through existential challenges; networks that convene directors and corporate executives to share best practices and insights; and awards and recognition programs that celebrate the accomplishments of those who champion modern governance. Learn more at 

Diligent

Blog

CMMC is here: Why waiting is the biggest risk

The audit committee: What it is and its role

Your Data Matters