2.3 The Internal Audit Charter

The internal audit charter is the formal governance document that makes purpose and mandate enforceable inside the organization. Under Standard 6.2 Internal Audit Charter of the 2024 Global Internal Audit Standards, the chief audit executive must develop and maintain a charter that meets defined minimum content requirements, discuss it with the board and senior management, and obtain board approval. For Section A3 of the IAP / CIA Part 1 syllabus, know the required components cold and be ready to apply them in governance scenarios.

Why the Charter Matters

Without a current, board-approved charter:

• Authority to access records and people can be challenged.
• Scope disputes become personality contests rather than governance decisions.
• Reporting lines and independence expectations stay ambiguous.
• Quality assessors lack a baseline for evaluating conformance.

The charter is not a marketing brochure. It is the board’s written authorization and expectation set for the internal audit function.

---

Required Minimum Components (Standard 6.2)

At a minimum, the charter must specify the internal audit function’s:

1. Purpose of Internal Auditing — Align with Domain I (create, protect, and sustain value through independent, risk-based, objective assurance, advice, insight, and foresight).
2. Commitment to adhering to the Global Internal Audit Standards — Explicit pledge that the function will conform to the Standards.
3. Mandate — Including:
   • Scope and types of services to be provided
   • The board’s responsibilities and expectations regarding management’s support of the internal audit function
   • (Cross-reference Standard 6.1)
4. Organizational position and reporting relationships — Typically functional reporting to the board/audit committee and administrative reporting to a sufficiently senior executive; supports Standard 7.1 on organizational independence.

Common Additional (Useful) Content

Implementation considerations often encourage charter language on topics such as:

• Authority to allocate resources within the approved plan and budget process
• Access rights to data, systems, personnel, and physical locations
• Responsibility to communicate results, themes, and risk acceptances as required
• Coordination/reliance on other assurance providers
• CAE appointment, removal, and performance-input processes involving the board
• Administrative matters (human resources administration, expense approval) that must not undermine functional independence

These details help operationalize independence and support, even when the Standards’ “at a minimum” list is shorter.

---

Discuss With the Board and Senior Management

Standard 6.2 requires the CAE to discuss the proposed charter with the board and senior management to confirm it accurately reflects their understanding and expectations of the internal audit function.

Why Both Groups?

Skipping senior management discussion can produce a charter the board loves but the organization cannot operationalize. Skipping the board reduces the charter to a management policy without proper authorization.

Essential Conditions Snapshot

In Domain III terms, board essential conditions around the charter typically include discussing topics that should be included for an effective function, approving the charter, and reviewing it with the CAE as organization and risks change. Senior management communicates expectations that should be considered for inclusion—without seizing approval authority from the board.

---

Board Approval and Evidence

Board approval is mandatory. Practical conformance evidence often includes:

• Audit committee / board meeting minutes showing discussion and approval
• A signed or formally accepted charter version with effective date
• A schedule for periodic review (commonly annual, though the Standards emphasize periodic review tied to changing circumstances—not a magic quarterly rule)

If management “approves” a charter but the board never does, the organization has not met Standard 6.2’s governance intent.

---

Maintaining and Reviewing the Charter

The CAE’s duty is ongoing: develop and maintain. Periodic review with the board and senior management should consider:

• Strategy changes, restructuring, or new regulated activities
• Persistent impairments, scope conflicts, or resource shortfalls
• Updates to the Global Internal Audit Standards or legal mandate requirements
• Lessons from quality assessments (internal or external)
• Clarity problems discovered during engagements (for example, disputed access rights)

When review identifies needed changes, the CAE updates the draft, rediscusses with board and senior management, and seeks fresh board approval of the revised charter.

Charter vs. Related Documents

Do not confuse plan approval with charter approval. A board can approve a plan yet still need a current charter establishing the function’s mandate and reporting lines.

---

Scenario Walkthroughs

Scenario A — Missing element: A charter describes reporting lines and access rights but never mentions adherence to the Global Internal Audit Standards. Issue: It fails a minimum Standard 6.2 component. Fix: CAE revises the charter to include an explicit Standards commitment, discusses with board and senior management, and obtains board approval.

Scenario B — Management-only “approval”: The CEO signs a new charter after a reorganization; the audit committee is informed afterward as a courtesy. Issue: Board approval is missing. Fix: Present the charter for formal board/audit committee approval; document the discussion in minutes.

Scenario C — Stale charter after Standards update: The organization still uses a 2017-era charter citing the old IPPF definition and Code of Ethics structure, with no Domain I purpose language and no explicit “mandate” section. Issue: Content is outdated relative to the 2024 Standards. Fix: Refresh purpose language, add/clarify mandate and Standards commitment, realign reporting-relationship wording, discuss, and re-approve.

---

Exam Playbook for Section A3

When a question asks what must be in the charter, start with the four minimum buckets: purpose, Standards commitment, mandate (scope/services + board/management support expectations), and organizational position/reporting relationships. When a question asks about process, remember the sequence:

1. CAE develops/maintains the draft.
2. CAE discusses with board and senior management.
3. Board approves.
4. CAE reviews periodically and repeats the cycle when change is needed.

Connect back to prior sections: the charter is where purpose (A1) and mandate (A2) become organizational law. If you can explain that linkage in one sentence, you are ready for Section A governance items.