2.2 Mandate, Board & CAE Responsibilities

After Domain I explains why internal auditing exists, Domain III explains who authorizes it to act. The 2024 Global Internal Audit Standards introduce internal audit mandate as a clear governance concept: the board-authorized authority, role, and responsibilities of the internal audit function. On IAP / CIA Part 1 Section A, you must know what a mandate is, who sets it, how the CAE contributes, and how board and senior management support differ.

Principle 6: Authorized by the Board

Principle 6 states that the board establishes, approves, and supports the mandate of the internal audit function. Three related standards sit under this principle:

Do not treat “mandate” and “charter” as interchangeable. The mandate is the authorized empowerment (authority/role/responsibilities). The charter is the formal document that records the mandate plus purpose, Standards commitment, and organizational positioning. They usually live in one board-approved charter document, but the Standards still distinguish the concepts.

---

What the Mandate Contains

Standard 6.1 frames the mandate as the combination of:

1. Authority — What internal audit is empowered to do (for example, unrestricted access to records, personnel, and physical properties needed to fulfill engagements; authority to allocate resources within the approved plan).
2. Role — Where the function sits in the governance system (independent assurance and advisory provider to board and senior management—not a substitute for management).
3. Responsibilities — What the function is expected to deliver (risk-based assurance and advice aligned to the purpose statement; communication of results; coordination with other assurance providers as appropriate).

The mandate empowers the function to provide the board and senior management with objective assurance, advice, insight, and foresight—language that deliberately echoes Domain I.

Scope and Types of Services

Part of establishing the mandate is agreeing the scope and types of services internal audit will provide (assurance engagements, advisory/consulting-type services, special investigations, and so on). The CAE helps the board and senior management make that determination and coordinates with other internal and external assurance providers so roles do not collide or leave coverage gaps.

In jurisdictions where law or regulation already defines all or part of the mandate (common in some public-sector settings), the charter must still reflect those legal requirements.

---

CAE Responsibilities in Establishing the Mandate

The chief audit executive does not unilaterally invent the mandate. The board authorizes it. The CAE’s job is to enable an informed board decision:

• Provide the board and senior management with the information necessary to establish the internal audit mandate.
• Help them understand options for scope and types of services.
• Coordinate with other assurance providers to clarify who does what.
• Document or reference the mandate in the internal audit charter, which the board approves.
• Periodically assess whether changes in circumstances justify a fresh discussion about the mandate with the board and senior management.
• If circumstances have changed, discuss whether the authority, role, and responsibilities still enable the function to achieve its strategy and objectives.

Changes That Often Trigger Reassessment

---

Board Responsibilities (Essential Conditions Lens)

Domain III uses essential conditions—actions the board (and senior management) must take for effective governance of internal audit. For the mandate, board responsibilities typically include:

• Discuss with the CAE and senior management the appropriate authority, role, and responsibilities of the internal audit function.
• Approve the internal audit charter that includes the mandate, including scope and types of services.
• Support the mandate so the function can operate with the access and stature it needs.
• Protect the conditions that make the mandate meaningful: independence, resources, and open communication channels with the CAE.

If the board never discusses or approves the mandate/charter, the function may exist administratively but lack the governance authorization the Standards require.

---

Senior Management Responsibilities

Senior management’s role is supportive, not a substitute for board authorization:

• Participate in discussions about the mandate so operational realities and enterprise risks inform scope.
• Communicate management’s expectations that should be considered (without converting internal audit into a management-controlled inspection unit).
• Provide the access, information, and organizational support the approved mandate requires.
• Reinforce throughout the organization that internal audit’s board-authorized role is legitimate and must be respected.

Exam Trap: Who Approves What?

A common wrong answer is “the CFO approves the internal audit mandate.” Administrative reporting to a senior executive may exist, but mandate authorization belongs with the board.

---

Scenario Walkthrough

Scenario: After a global expansion, management asks internal audit to “stay out of overseas subsidiaries for two years.” The existing charter still claims organization-wide authority. What should the CAE do first under Standard 6.1 thinking?

Preferred approach: Treat the restriction as a potential change affecting the mandate. Assess whether circumstances require discussion with the board and senior management. Do not quietly accept a de facto rewrite of authority by management alone. Document the issue, explain the impact on the function’s ability to fulfill its strategy and purpose, and seek board direction—updating the charter/mandate if the board intentionally changes scope, or restoring access if the board reaffirms organization-wide authority.

How Mandate Links Forward

• To purpose (A1): The mandate exists so the function can deliver Domain I’s assurance, advice, insight, and foresight.
• To charter (A3): The mandate must be written into or referenced by the charter.
• To independence and oversight: Authority without independent positioning is hollow; board oversight without a clear mandate is vague.

Master this triad for Section A: purpose → mandate → charter, with the CAE facilitating and the board authorizing.