CIA-1 - Foundations of Internal Auditing (35% of the exam) - Section A.3
Recognize the requirements of an internal audit charter, including the components required by the Global Internal Audit Standards and the importance of board approval.
Identify the internal audit charter as the formal document that records the function's purpose, authority, and responsibility, and list the components the Global Internal Audit Standards require it to contain. Recognise that the charter must be discussed with the board and senior management and formally approved by the board, giving the function its standing within the organisation.
lock_openFree sampleFoundations of Internal Auditingeasy
Under the Global Internal Audit Standards, before an internal audit charter can take effect, whose formal approval of the charter is required?
AThe chief audit executive, who issues it under delegated authority from management.
BSenior management alone, whose sign-off establishes the function's operating authority.
CThe board, whose formal approval of the charter is required by the Standards.check_circle Correct
DThe external audit firm, whose annual review ratifies the document each year.
Board approval of the internal audit charter is a requirement of the Global Internal Audit Standards. Board approval anchors internal audit's independence and mandate at the highest governance level, which is why the Standards place the charter's formal approval with the board rather than with management.
Why A is wrong: The chief audit executive drafts and proposes the charter, but issuing it under delegated authority is not the approval step the Standards require.
Why B is wrong: Senior management is consulted on the charter, yet management sign-off by itself does not satisfy the Standards, which reserve formal approval for the board.
Why C is correct: The Standards require the board to formally approve the internal audit charter, reinforcing the function's independence and its accountability to the board.
Why D is wrong: External auditors may read the charter, but they have no authority to approve or ratify it, so this confuses an external assurance provider with the board.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
The annual engagement schedule and the resources budgeted for each planned review.
errorWhy it is wrong: This describes the internal audit plan, which is derived from the charter but is a separate operational document, so it is not what the charter itself must record.
Treat the chief executive's sign-off as sufficient, because the chief executive holds executive authority over the internal audit function.
errorWhy it is wrong: Executive authority makes this tempting, but the charter records internal audit's purpose, authority and responsibility and must be approved by the board, so a chief executive sign-off alone does not satisfy the requirement.
Send the charter straight to the board for approval, since senior management has no role at all in the charter of an independent function.
errorWhy it is wrong: This overstates independence; the Standards expect the charter to be discussed with senior management as well as approved by the board, so skipping that discussion is incorrect.