TIAPS Module 1 Audit and Assurance workbook

According to The IIA Position Paper: The Internal Audit Charter, the document should
contain the following:
• Internal audit mission and purpose.
• Reference to or inclusion of the mandatory elements of the IPPF by which the
internal audit function will be governed. (Recognizing the mandatory elements of the
IPPF in the charter is a requirement of Standard 1010 – Recognizing Mandatory
Guidance in the Internal Audit Charter.)
• Authority, clarifying the functional and administrative reporting relationships and the
role of the governing body in upholding the authority of the internal audit function.
• Independence and objectivity, ensuring the head of internal audit will safeguard the
independence of the function and the objectivity of auditors, applying safeguards
when required, and reporting threats and limits to independence and objectivity to
the governing when they arise.
• Scope to confirm the internal audit’s responsibility for providing assurance and
advice on the adequacy and effectiveness of governance, risk management, and
internal control.
• Responsibilities of the head of internal audit.
• Requirements for a quality assurance and improvement program, including an
external quality review at least once every five years. 30
Without sufficient authority, the internal audit function is unable to fulfil its mandate. Its work
may be obstructed by managers who are not interested or who would prefer to avoid scrutiny
for whatever reason. Internal audit may also be constrained by limited resources or by being
denied access to information it needs to complete its work. There is a close link between
authority and independence. The pronouncements of the internal audit function are more
likely to be considered authoritative if it operates independently but it is only able to do that if
it has sufficient force behind it, whether by legislation or the endorsement of the governing
body (ideally both).
According to the IIA, to ensure the internal audit function has sufficient authority, the
governing body (or audit committee) is expected to:
• Approve the internal audit charter.
• Approve the internal audit plan.
• Approve the internal audit budget and resource plan.
• Receive timely communications on performance relative to the internal audit plan.
• Approve the appointment and removal of the head of internal audit (typically in
response to discussions with and recommendations from senior management).
• Approve the remuneration of the head of internal audit (typically in response to
discussions with and recommendations from senior management).
• Make appropriate inquiries of management and the head of internal audit to
determine if there are any inappropriate scope or resource limitations.
• Ensure the head of internal audit has unrestricted access to, and can communicate
and interact directly with, the governing body without management present.
30
IIA Position Paper: The Internal Audit Charter, The Institute of Internal Auditors, 2019
33