Internal Audit Charter [Complete Guide 2024]

Are you trying to develop or improve the internal audit charter for your internal audit activity? If so, you are at the right place. This quick but comprehensive guide answers the most asked questions on the subject. It also offers a free internal audit charter template populated with better practices and clear instructions to develop a high-quality charter for your organization.

Before we start, here is the list of topics covered in this guide. If you are trying to find something specific, please click on the relevant section:

Introduction

Internal Audit is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. We all know that, right?

Now for an internal audit function to add value and improve an organization’s operations, it must have clearly defined marching orders from the board of directors and the senior management. These marching orders are what we call an internal audit charter.

An internal audit charter is to the internal audit activity what a constitution is to a country. Yes, internal audit functions without charters and countries without constitutions do exist. But the ones with clearly defined charters tend to function well and resolve differences in a structured way.

What is an internal audit charter?

Let’s look at the formal definition. The International Standards for the Professional Practice of Internal Auditing define it as follows: 

“The internal audit charter is a formal document that defines the internal audit activity’s purpose, authority, and responsibility. The internal audit charter establishes the internal audit activity’s position within the organization; authorizes access to records, personnel, and physical properties relevant to the performance of engagements; and defines the scope of internal audit activities.”

Why is the internal audit charter important?

The charter provides the organization with a blueprint for how the internal audit will operate. It helps the board of directors to indicate the value it places on internal audit’s independence.

It also provides the internal audit with the needed authority to carry out its tasks. That is unconstrained access to records, personnel, and physical properties relevant to performing its work.

The charter can describe the activities of the internal audit function and the support it will receive from senior management and the board to perform the same.

Finally, it serves as a high-level framework to measure the effectiveness of the internal audit activity.

Who prepares the internal audit charter?

The Chief Audit Executive (CAE) should draft the internal audit charter and lead the discussion around it until its final approval. The CAE may be designated by some other title in your organization. However, we will use the CAE designation here as reference.

Model internal audit charter

If you are looking for a sample internal audit charter of a company, download this editable draft from our resource library. It is pre-populated with better practices and contains clear instructions to customize it for your organization.

Alternatively, you may draft the document from scratch. But it is better to use the template to save some time.

What should an internal audit charter include?

The document may look slightly different in various organizations. However, the following elements should at least make part of it:

Introduction

Explain the overall role, mission, and purpose of the internal audit activity. 

Authority

Articulate the internal audit activity’s full access to the records, physical property, and personnel required to perform engagements. Also, describe internal auditors’ accountability for safeguarding assets and confidentiality. 

Professional Standards

It may not be compulsory to adopt authoritative guidance like International Standards for the Professional Practice of Internal Auditing. But it is highly recommended to adopt them and make a statement to this effect in the internal audit charter.

Do you need support to enable or assess your internal audit function’s conformance with the said standards? If so, please feel free to reach out.

Organization and reporting structure

Include the chief audit executive’s reporting lines. The CAE should report functionally to the board and administratively to a level within the organization that allows the internal audit to fulfill its mandate. Ideally, the functional reporting line rests with the Audit Committee Chair and the administrative one stays with the CEO.

Also, specify what comprises functional and administrative responsibilities to ensure proper segregation of dual reporting lines.

Independence and objectivity

Highlight the importance of internal audit independence and objectivity. And how these will be maintained, e.g., barring internal auditors from having operational responsibility or authority over areas being audited. 

Responsibilities

Describe major areas of ongoing responsibility. These include defining the scope of assessments, writing an internal audit plan, submitting the plan to the board for approval, performing engagements, communicating the results, providing a written engagement report, and monitoring corrective actions taken by management. 

Quality assurance and improvement

Describe the expectations for maintaining a quality assurance and improvement program that covers all aspects of the internal audit activity.

Signatures

Document the approval of the charter by obtaining signatures. This section includes the date, names, and titles of signatories. 

How to prepare the internal audit charter?

The process of developing an internal audit charter may include the following steps:

• Develop an initial draft, using the aforementioned template, based on a preliminary understanding of the organization.

• Interview senior management and board of directors/ audit committee chairman. Build an understanding of the purpose, scope, authority and expectations from the internal audit activity. Learn what in management and the board’s views are the key risks to the organization.

• Obtain and review the audit committee charter, which contains the committee’s terms of reference. Understand the committee’s powers and responsibilities regarding the internal audit activity. If there is a need, do recommend necessary amendments therein for the internal audit to function effectively.

• Obtain and review your organization’s written policies and procedures. If these are not well documented, develop a high-level understanding of the organization by meeting key process owners.

• Develop a list of auditable entities – the audit universe. These may be the processes or the departments etc. depending on how the organization is structured.

• Discuss with external auditors the key issues identified during their engagements.

• Develop a high-level risk assessment for your organization.

• Now update the draft using all these insights.

Before you submit the draft for approval, do you need an independent quality review of the same? If so, you may reach out to us in confidence.

Who approves the internal audit charter?

The final approval of the internal audit charter must be obtained from the board of directors or equivalent authority. 

Following are some important considerations in the approval process:

• The draft should first be discussed with the senior management and other appropriate levels of management. Senior management means the CEO (or equivalent) and the appropriate level of management means the C-Suite. Do not involve almost everyone from the organization in that discussion; it’s counterproductive.

• Exercise due care that any clauses critical to the purpose, authority, and responsibility are not deleted from the draft during the discussion with the management. Conflicting points of view, if any, should be presented before the board for final decision thereon.

• The CAE may also need to discuss with the legal counsel or the company secretary the proper approach and format to seek the board’s approval.

• Once the draft has been accepted at both the senior management and board level, the same must be signed off by the aforementioned signatories.

Review of internal audit charter

The internal audit charter should be reviewed on at least an annual basis. More often if the circumstances so require.

Although it is a formal and approved document, this is not something that cannot be amended. Ensure that it is still relevant and addresses the issues that the organization and the internal audit activity are facing. 

Include all of the activities that the internal audit activity will undertake in the coming two to three years. This does not mean you have to do these activities. But it will save you from moving the board every now and then for revisions in the document.

Internal audit charter vs internal audit manual

An internal audit charter is a high-level document that establishes the internal audit function’s position with the organization. The internal audit manual, on the other hand, is a rather detailed compilation of policies and procedures to guide day-to-day internal audit activities. 

An internal audit manual usually contains the audit process, the methodologies for conducting the audit, templates to be used, and people to contact. As such, it facilitates orientation and saves time on training newly appointed audit staff.

Way forward

Hope you are now clear on how to develop a high-quality internal audit charter for your organization. If you still have any questions, let us know in the comments below. We would love to hear from you.

Once the charter is approved, the next step is to develop detailed internal audit policies and procedures for maintaining an effective and efficient internal audit function. If you need support in developing the same or a quality review of your draft policies and procedures manual, let us know!

In addition to free guides like this, we are building some quality resources for multiple enterprise functions which can help you improve your organization without breaking the bank. If you are not subscribed already, please sign-up for free so that we may update you when those resources are available for download:

Do you know someone who can benefit from this guide? Use the social share buttons below to show them that you care.

Thank you!