CIA-1 - Foundations of Internal Auditing (35% of the exam) - Section A.2
Explain the internal audit mandate and the responsibilities of the board and the chief audit executive in establishing the authority, role, and responsibilities of the internal audit function.
Describe the internal audit mandate as the authority, role, and responsibilities the board grants to the function, and distinguish who does what: the chief audit executive proposes and maintains the mandate, while the board and senior management approve it and hold ultimate accountability. Recognise the chief audit executive's role in keeping the mandate current as the organisation and its risks change.
lock_openFree sampleFoundations of Internal Auditingmedium
Northgate Bank's audit committee is reviewing who is accountable for the internal audit function's authority and standing. The chief audit executive drafts and maintains the mandate, and senior management provides day-to-day support and resources. Where does ultimate accountability for the internal audit mandate rest?
AWith the board, which approves the mandate and holds ultimate accountability for the internal audit function's authority, role, and responsibilities.check_circle Correct
BWith the chief audit executive, because the person who drafts and maintains the mandate necessarily bears final accountability for how adequate its terms are.
CWith senior management, because the function reports to management administratively and depends on management for its people, its systems, and its budget.
DWith the external auditor, whose annual opinion on the financial statements confirms that the internal audit mandate has remained appropriate throughout the year.
The board approves the internal audit mandate and holds ultimate accountability for the function's authority, role, and responsibilities. Accountability for the mandate follows approval authority. The board grants and approves the mandate and oversees the function, so it holds ultimate accountability, while the chief audit executive proposes and maintains the mandate and management supplies administrative support and resources.
Why A is correct: The board approves the mandate and provides oversight, so it holds ultimate accountability for internal audit's authority, role, and responsibilities, making this the correct statement of where accountability rests.
Why B is wrong: Drafting and maintaining the mandate is genuinely the chief audit executive's task, which makes this tempting, but proposing a mandate is not the same as holding ultimate accountability for it, so this is wrong.
Why C is wrong: Administrative reporting and resourcing do sit with management, which makes this plausible, but administrative support is not ultimate accountability for the mandate, so attributing it to management is incorrect.
Why D is wrong: The external auditor is independent of the organisation and opines on the financial statements, not the internal audit mandate, so assigning accountability for the mandate to the external auditor is wrong.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
Senior management, rather than the board, grants the internal audit function its formal authority.
errorWhy it is wrong: Management supports internal audit, but the authority behind the mandate is granted by the board, not by senior management.
Broaden the mandate at once by updating the internal audit charter, then notify the board of the expanded authority after the revised charter has taken effect.
errorWhy it is wrong: Keeping the charter current is sensible, which makes this tempting, but changing the mandate unilaterally usurps the board's approval role and is wrong because approval must come before the change takes effect.
The scope statement the chief audit executive prepares each year to schedule individual engagements.
errorWhy it is wrong: This is tempting because the annual plan does define what will be audited, but the plan operates within the mandate rather than being the mandate itself.