A new chief audit executive asks for the charter and receives a two-page memo signed by the chief financial officer in 2016. Nothing in it mentions the board. That single fact tells you the function has no authority the board recognizes, and the exam builds whole questions on it.
The internal audit charter is a formal written document that establishes the internal audit function's purpose, authority, and responsibility inside the organization. It is the instrument through which the board grants the function its mandate. Without it, every access request, every scope decision, and every escalation depends on goodwill rather than authority.
The Global Internal Audit Standards treat the charter as the foundation of the function's standing. The exam tests three things about it: the charter components the Standards require, why the charter is discussed with the board and senior management, and why board approval of the charter matters. Keep those three questions separate in your head, because stems often satisfy one and quietly fail another.
Common mistakes
- Treating management approval as sufficient. A charter signed off by the executive committee or the CFO gives the audited party control of the auditor's mandate. Approval must come from the board.
- Confusing discussion with approval. The CAE discusses the charter with senior management; that is required and it is not consent. Only the board approves.
- Omitting the board's own obligations. Candidates recall access and scope but forget the charter must state what the board commits to: approving the charter, plan, budget, and resource plan, and handling CAE appointment, removal, and compensation discussions.
Bottom line
- The charter is a formal written document establishing the internal audit function's purpose, authority, and responsibility, and it is the source of the function's mandate.
- Required content: purpose and mandate, commitment to the Global Internal Audit Standards and ethics principles, types of services, scope of work, authority and unrestricted access, independence and objectivity positioning, reporting relationships, board responsibilities toward the function, and CAE qualifications.
- Access language must reach records, systems, personnel, physical property, and locations, not just accounting records.
- The chief audit executive discusses the charter with both the board and senior management before approval, to align expectations, surface access constraints, and secure cooperation.
Exam shortcut
Scan the stem for the approver first. If anyone below the board signed off (CEO, CFO, executive committee, audit committee chair acting alone), that is the answer regardless of how complete the document looks. Content quality never cures a bad approval. Second scan: read the access clause for limiting words. "Financial," "accounting," "parent company," "upon request," and "with management consent" are all planted defects.
The full lesson (about 2,718 words, 18 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 3
Browse all free CIA Part 1 lessons or jump into free CIA Part 1 practice questions.