Standard 1000 – Purpose,

Authority, and Responsibility

1.Interpretation:

The internal audit charter is a formal document that defines the internal audit
activity's purpose, authority, and responsibility.
The internal audit charter establishes the internal audit activity's position within the
organization, including the nature of the chief audit executive’s functional reporting
relationship with the board.
The internal audit charter authorizes access to records, personnel, and physical
properties relevant to the performance of engagements.
The internal audit charter defines the scope of internal audit activities.
Final approval of the internal audit charter resides with the board
2.Getting Started :

Internal Audit Charter:

A. A critical document that records the agreed-upon purpose, authority, and responsibility of an
organization's internal audit activity.
B. Created by the chief audit executive (CAE) in consultation with senior management and the board.
C. Based on the Mission of Internal Audit and the mandatory elements of The IIA's International
Professional Practices Framework (IPPF).
Key aspects of the internal audit charter:
A. Internal audit objectives and responsibilities.
B. Expectations for the internal audit activity.
C. CAE's functional and administrative reporting lines.
D. Level of authority required for the internal audit activity to perform engagements and fulfill its
agreed upon objectives and responsibilities.
Recommendations:
❑ CAE may need to confer with the organization's legal counsel or the board secretary regarding the
preferred format for charters and how to effectively and efficiently submit the proposed internal audit
charter for board approval.
3.Considerations for Implementation:
Key sections of an internal audit charter:
Introduction: This section explains the overall role and professionalism of the internal audit activity. It often cites relevant
elements of the International Professional Practices Framework (IPPF).
Authority: This section specifies the internal audit activity's full access to the records, physical property, and personnel required to
perform engagements. It also declares internal auditors' accountability for safeguarding assets and confidentiality.
Organization and reporting structure: This section documents the CAE's reporting structure. The CAE should
report functionally to the board and administratively to a level within the organization that allows the internal audit activity to fulfill its
responsibilities. This section may also delve into specific functional and administrative responsibilities.
Independence and objectivity: This section describes the importance of internal audit independence and objectivity and
how these will be maintained. For example, it may prohibit internal auditors from having operational responsibility or authority over
areas audited.
Responsibilities: This section lays out major areas of ongoing responsibility, such as defining the scope of assessments, writing an
internal audit plan, performing engagements, communicating the results, and monitoring corrective actions taken by management.
Quality assurance and improvement: This section describes the expectations for developing, maintaining, evaluating,
and communicating the results of a quality assurance and improvement program that covers all aspects of the internal audit activity.
Signatures: This section documents agreement among the CAE, a designated board representative, and the individual to whom the
CAE reports. It includes the date, names, and titles of signatories.
4. Considerations for Demonstrating Conformance :

1. The minutes of the board meetings during which the CAE initially discusses and then
formally presents the internal audit charter provide documentation of conformance.
2. The CAE retains the approved charter.
3. Typically, the CAE asks the board to create a standing annual agenda item to discuss,
update, and approve the internal audit charter as needed.
4. Evidence that the CAE periodically reviews the internal audit charter with senior
management and the board also exists in minutes from those meetings
Standard 1010 – Recognizing Mandatory
Guidance in the Internal Audit Charter

1.Interpretation:

The internal audit charter must state that the internal audit activity will follow the
IPPF, which includes the Core Principles, Code of Ethics, Standards, and Definition of
Internal Auditing.
The CAE should meet with senior management and the board to discuss the Mission
of Internal Audit and the IPPF, and to ensure that they understand and support the
internal audit activity's commitment to these principles.
2.Getting Started :

A. Before writing or revising the internal audit charter, the chief audit executive (CAE)
should review The IIA’s International Professional Practices Framework (IPPF) to
refresh their understanding of the Mission of Internal Audit and the mandatory
elements, including the Core Principles for the Professional Practice of Internal
Auditing, the Code of Ethics, the International Standards for the Professional
Practice of Internal Auditing (Standards), and the Definition of Internal Auditing.
B. The CAE is required to review the internal audit charter periodically and present it to
senior management and the board for approval (see Standard 1000 – Purpose,
Authority, and Responsibility).
C. It is helpful if the CAE knows the organization’s process for submitting the internal
audit charter for approval.
D. The CAE may also arrange a discussion of the charter with senior management and
the board as part of the periodic review and revision process.
3.Considerations for Implementation:

The internal audit charter should recognize the mandatory elements of the IPPF
(International Professional Practices Framework).
The CAE (Chief Audit Executive) can do this by including specific statements in the
charter, such as the example provided in the text.
Alternatively, the CAE can use language and content throughout the charter that
require conformance with the Mandatory Guidance.
The CAE's discussion of the internal audit charter with senior management and the
board provides a good opportunity to explain the Mission of Internal Audit and the
mandatory elements of the IPPF.
After the charter has been adopted, it is important for the CAE to monitor The IIA's
Mandatory Guidance and to discuss any changes that may be warranted during the
next charter review.
4. Considerations for Demonstrating Conformance :

The internal audit charter must recognize the Core Principles for the Professional
Practice of Internal Auditing, the Code of Ethics, the Standards, and Definition of
Internal Auditing as mandatory elements.
Conformance with this requirement may be evidenced through the written and
approved internal audit charter, as well as the minutes of meetings during which
these mandatory elements and the Mission of Internal Audit were discussed with
senior management and the board.
Conformance may also be demonstrated through the minutes from meetings during
which the Chief Audit Executive (CAE) discussed periodic reviews of the charter.
 Standard 1100 – Independence
and Objectivity
1.Interpretation:
The internal audit: activity must be independent, and internal auditors must be objective in performing their
work.
Independence: Internal audit must be independent in order to be effective. This means that it must be free from
any influences that could compromise its objectivity.
Dual reporting relationship: The chief audit executive should have a dual reporting relationship to senior
management and the board. This helps to ensure independence and direct access to the highest levels of the
organization.
Threats to independence: Threats to independence can come from a variety of sources, including individuals,
engagements, functions, and the organization as a whole. These threats must be managed at all levels.
Objectivity: Internal auditors must be objective in order to perform their work effectively. This means that they
must have an unbiased mental attitude and not subordinate their judgment to others.
Threats to objectivity: Threats to objectivity can also come from a variety of sources. These threats must be
managed at all levels.
2.Getting Started :

Independence:
1. Independence means that internal audit is free from conditions that could threaten its ability to perform its duties
in an unbiased manner.
2. Internal audit is not considered independent if it reports to the function it is auditing, or if the chief audit
executive (CAE) has functional responsibilities broader than internal audit, such as risk management or
compliance.
3. The CAE needs the help of the board and senior management to address independence effectively.
4. The CAE, the board, and senior management should reach a shared understanding of internal audit's
responsibility, authority, and expectations, as well as organizational placement and reporting lines.
5. The internal audit charter will reflect the decisions reached regarding internal audit's responsibility, authority, and
expectations, as well as organizational placement and reporting lines.
Objectivity:
1. Objectivity means that internal auditors have an unbiased mental attitude.
2. The CAE should understand policies or activities within the organization and within internal audit that could
enhance or hinder objectivity.
3. Internal audit may customize organization wide policies to address internal audit roles specifically, or may develop
other relevant policies specifically for internal audit, such as policies pertaining to training requirements.
3.Considerations for Implementation:
The chief audit executive (CAE) should report functionally to the board and administratively to a member of
senior management, such as the CEO. This ensures that the CAE has direct access to the board for sensitive
matters and sufficient organizational status.
The CAE should not have operational responsibilities beyond internal audit, as this could impair objectivity. If the
CAE does have operational responsibilities, safeguards should be implemented to limit the impairment.
Many CAEs have an internal audit policy manual or handbook that describes expectations and requirements for
an unbiased mindset. This policy manual should include:
a) The critical importance of objectivity to the internal audit profession.
b) Typical situations that could undermine objectivity.
c) Actions the internal auditor should take if he or she becomes aware of a current or potential objectivity
concern.
d) Reporting requirements where each internal auditor periodically considers and discloses conflicts of
interest.
The CAE should hold routine workshops or training on objectivity for all internal auditors.
The CAE should avoid assigning team members to engagements where there is a potential objectivity
impairment.
The CAE should design the internal audit performance evaluation and compensation system in a way that does
not impair internal auditor objectivity.
4. Considerations for Demonstrating Conformance :

A. Multiple items may indicate conformance with the internal audit standard.
B. These items include:
1. The internal audit charter itself.
2. An organization chart with reporting responsibilities.
3. An internal audit policy manual that includes policies on independence,
objectivity, addressing conflicts, and performance evaluation.
4. Training records.
5. Conflict-of-interest disclosure forms.
6. Documentation showing disclosure of impairments, if applicable.