Internal audit play a pivotal role within the organization in ensuring its success and realization of its business objectives by providing the executive management and the board audit committee information and objective assurance on internal control system, risk management and governance. To ensure effectiveness of the internal audit function, the mandate of the internal audit department must be clearly defined, agreed by stakeholders and approved by the organization’s Board of Directors.
The Board Audit Committee and Executive Management who are the key stakeholders in every organization are to ensure that the internal audit function are empowered and have sufficient authority to effectively discharge its duties. Therefore, the internal audit function must derive its authority from the board audit committee and management of the organization. Where sufficient mandate has been given to the internal audit function, resources required to fulfil the mandate flows naturally. This is not the case where mandate is incomplete, which will always lead to inadequate resourcing of the function.
The authority of the internal audit function is documented in its internal audit charter. The internal audit charter stipulates the role of the internal audit function within the organization, the structure of the department and reporting line through the management to the Board of Directors who are the highest decision making arm within the organization. In determining its role, discussions are usually held among members of executive management and the board audit committee to scope what services should be provided and priorities of the internal audit function. The roles, responsibilities, authorities and reporting lines of the internal audit function are defined primarily to support the board audit committee in discharging its duties. As such, it is best practice to review the board audit committee charter alongside the internal audit charter on annual basis to ensure synchronization and relevance.
The mission and scope of work for the department should be defined, accountability of the Chief Audit Executive (CAE) must be determined while the independence of the internal audit function must be guaranteed by the management and the board audit committee. The charter should be clear on who the CAE reports to and responsible for while a statement about auditor’s open and free access to information across the organization should be included in the charter to aid the department in the effective discharge of its duties. The standard of practice adopted by the internal audit department should be included in the charter to underscore the department’s compliance with best practice and acceptable framework for internal audit practice. In most cases, International Standards for the Professional Practice of Internal Auditing, as promulgated by the Institute of Internal Auditors (IIA) are usually adopted.