Internal Audit Charter.

It’s a document which I think isn’t given the importance it deserves, but given the Internal Audit Charter s both a requirement of the International Standards for the Professional Practice of Internal Auditing (Standards) and recently released Code of Practice, it’s something which evidently holds a lot of value.

So what is the Internal Audit Charter?

As defined by the Institute of Internal Auditors: “The internal audit charter is a formal document that defines the internal audit activity’s purpose, authority, and responsibility. The internal audit charter establishes the internal audit activity’s position within the organization; authorizes access to records, personnel, and physical properties relevant to the performance of engagements; and defines the scope of internal audit activities.”

Sounds pretty straight forward right. The Standards reiterate all of this with section 1000 – Purpose, Authority, and Responsibility, specifically calling out what must be included in the Charter: “The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter, consistent with the Mission of Internal Audit and the mandatory elements of the International Professional Practices Framework (the Core Principles for the Professional Practice of Internal Auditing, the Code of Ethics, the Standards, and the Definition of Internal Auditing). The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval.”

A full copy of the Standards can be downloaded here.

Recently, the Chartered Institute of Internal Auditors released a Code of Practice. The Code also requires audit functions to have an Internal Audit Charter, but goes one step further in stating that it be published and made available to the public. The Code, which can be downloaded here, says: “The primary role of internal audit should be to help the board and executive management to protect the assets, reputation and sustainability of the organisation. It does this by assessing whether all significant risks are identified and appropriately reported by management to the board and executive management; assessing whether they are adequately controlled; and by challenging executive management to improve the effectiveness of governance, risk management and internal controls. The role of internal audit should be articulated in an internal audit charter, which should be publicly available.”

Given that both the Standards and Code reference the need for an Internal Audit Charter, there must be a reason for it. A great example is the recent issues relating to financial statement audits in the UK. It’s become evidence through the Brydon Review that there was an expectation gap between what audit firms provide and what companies expect. Documents, such as the Internal Audit Charter, can help avoid these expectation gaps within a business, but also set the standard when it comes audits role, responsibilities and ways of working.

There are many ways to build your Internal Audit Charter, and its important to make sure it is fit and appropriate for your organisation. To provide a quick run down of what you can include in your Internal Audit Charter, again, look no further than the Chartered IIA. The team have pulled together a very simple list of what should be included in your Charter:

• Mission – the purpose and function of the internal audit activity
• Objectives – the provision and nature of assurance activities and (possibly) consulting activities
• Role and scope of workIndependence – how is independence established and maintained
• Access – unrestricted to records, personnel and physical property
• Reporting – reporting lines to show independence
• Responsibilities – don’t forget other roles such as responsibility for fraud investigations
• Planning – approach to planning, resources and budgets
• Quality – arrangements for quality assurance and improvement programme

A copy of the full Chartered IIA article on why the Internal Audit Charter is important, can be read here.

Our template is a bit of a hybrid. We have looked at a range of publicly available Internal Audit Charters, various templates and the requirements of both the Standards and the Code of Practice to pull together a template which attempts to pull in each of these various sources. At the end of the day tho, this template is only a guide and should be adjusted to suit your business.