Internal audit charter: what it should include

An internal audit charter turns the board’s expectations of internal audit into agreed, written terms: what the function is for, what it may examine, who it reports to and how its quality is checked. Under the IIA’s Global Internal Audit Standards, effective since 9 January 2025,¹ the charter carries more weight than before, because Standard 6.2 sets a minimum content and the board’s own responsibilities for approving and reviewing it are spelt out.² This guide explains what an internal audit charter should include, section by section, with a checklist mapped to the Standards and notes for the UK public sector and education.

For the wider context, see our earlier articles on what changed in the Global Internal Audit Standards and how to prepare for an external quality assessment.

What an internal audit charter is

The Standards define the internal audit charter as a formal document that includes the internal audit function’s mandate, organisational position, reporting relationships, scope of work, types of services and other specifications. The mandate is a related but distinct idea: the function’s authority, role and responsibilities, which may be granted by the board, by laws and regulations, or both. The charter is where the mandate is documented or referenced.²

There is no prescribed format. The IIA notes that model charters exist but expects the chief audit executive to tailor the charter to the organisation, and where laws or regulations comprehensively cover what a charter would contain, they may be substituted for it.² In practice, a good charter runs to a few pages. It should not be confused with the audit committee’s terms of reference, which set out the committee’s duties. The charter sets out the function’s terms, and the two documents should be consistent with each other. If you are setting up an internal audit function, the charter is one of the first documents to agree, because the risk assessment, plan and resourcing all depend on it.

Internal audit charter checklist

The table below maps typical charter sections to their source. Items marked “required” are requirements in the Standards; “recommended” items come from the Standards’ considerations for implementation and are expected by most assessors.²

Charter section	What to include	Source	Status
Purpose	The Purpose of Internal Auditing from Domain I	Standard 6.2	Required
Standards	Commitment to adhering to the Global Internal Audit Standards, and any other standards or codes used alongside them	Standards 6.2 and 4.1	Required
Mandate	Authority, role and responsibilities, including any legal or regulatory requirements	Standards 6.1 and 6.2	Required
Scope and services	Scope of coverage and types of service (assurance, advisory, any others)	Standard 6.2	Required
Board and management	The board’s responsibilities and its expectations of management’s support	Standard 6.2	Required
Position and reporting	Organisational position, functional reporting to the board and administrative reporting	Standards 6.2 and 7.1	Required
Non-audit roles	Any ongoing roles of the chief audit executive beyond internal audit, the nature of the work and the safeguards	Standard 7.1	Required where applicable
Administrative arrangements	How internal audit’s HR administration and budget, the chief audit executive’s expenses and their performance review are approved	Standard 6.2 considerations	Recommended
Independence safeguards	How impairments are identified, handled and disclosed, and how often safeguards are re-evaluated	Standard 6.2 considerations	Recommended
Access	Unrestricted access to data, records, information, personnel and physical properties	Standard 6.2 considerations; Standard 6.3	Recommended
Communication	Nature and timing of reporting to the board and senior management	Standard 6.2 considerations; Standard 8.1	Recommended
Audit process	Communication with management during engagements and how disagreements are handled	Standard 6.2 considerations	Recommended
Quality	Expectations for internal and external quality assessments and how results are reported	Standard 6.2 considerations; Standards 8.3 and 8.4	Recommended
Approval and review	Who approves the charter, any other approvals, and how often it is reviewed	Standard 6.2	Required (approval); recommended (review frequency)
UK public sector alternatives	Permanent alternatives to Domain III essential conditions and alternative resource management arrangements	UK public sector Application Note	Required where applicable

Mandate and purpose

Standard 6.2 requires the charter to specify, at a minimum, the Purpose of Internal Auditing; a commitment to adhering to the Global Internal Audit Standards; the mandate, including the scope and types of services and the board’s responsibilities and expectations regarding management’s support; and the function’s organisational position and reporting relationships.² Quoting the purpose statement word for word is the simplest way to meet the first point. If you also follow other requirements, such as the Chartered IIA Code or the UK public sector Application Note, Standard 4.1 expects internal audit communications to cite them as well, so name them in the charter.

Principle 6 says the function receives its mandate from the board, or from applicable law in certain public sector environments. Under Standard 6.1, the chief audit executive must give the board and senior management the information needed to establish the mandate, coordinate with other internal and external assurance providers to clarify respective roles, document or reference the mandate in the board-approved charter, and include any legal requirements where the mandate is prescribed in law or regulation. The considerations suggest the chief audit executive formally considers, at least annually, whether changes in circumstances justify revisiting the mandate.²

For the financial services, private and third sectors, the Chartered IIA’s Internal Audit Code of Practice adds that the purpose and mandate should be set out in a charter that is publicly available.³ In UK local government, CIPFA’s Code of Practice for the Governance of Internal Audit explains that the primary mandate comes from statutory regulations, so the charter must include the mandate derived from those regulations plus any additional mandate the authority agrees, and must set out internal audit’s reporting line to the audit committee.⁴

Authority and access

The Standards explain that internal audit’s authority comes from its direct reporting relationship to the board, and that this authority allows free and unrestricted access to the board and to all activities across the organisation, including records, personnel and physical property. Among the board’s essential conditions in Standard 6.3 is working with senior management to give internal audit unrestricted access to the data, records, information, personnel and physical properties it needs, and asking whether any restrictions on scope, access, authority or resources are limiting the function.²

The Chartered IIA Code goes further for organisations that follow it: internal audit should have unrestricted and timely access to key management information, including board and executive committee papers, and the right to attend and observe executive committee meetings and other key management decision-making forums.³ When drafting the access clause, it helps to be specific:

• Cover electronic systems and data, not only paper records, so that data analytics is not obstructed.
• Extend access to subsidiaries, joint arrangements and, through contract terms, outsourced service providers.
• State how internal audit will protect the confidentiality of what it sees.
• Set out what happens if access is refused or delayed, usually escalation to the audit committee chair.

Independence and reporting lines

Standard 7.1 requires the chief audit executive to document in the charter the function’s reporting relationships and organisational positioning, as determined by the board, and to confirm the function’s organisational independence to the board at least annually. Where the chief audit executive has ongoing roles beyond internal auditing, the responsibilities, nature of the work and safeguards must be documented in the charter, and where those areas are subject to internal audit, assurance must come from an alternative source, such as an objective, competent external provider reporting independently to the board. Where non-audit responsibilities are temporary, an independent third party must provide assurance over them during the assignment and for the following 12 months.²

The board’s essential conditions under Standard 7.1 include establishing a direct reporting relationship with the chief audit executive, authorising their appointment and removal, providing input to their performance evaluation and remuneration, and giving them opportunities to raise significant and sensitive matters, including in meetings without senior management. The Standards describe administrative reporting to the chief executive or equivalent as leading practice and suggest the charter sets out how internal audit’s HR administration and budgets, the chief audit executive’s expenses and their performance review are approved.²

The Chartered IIA Code is more prescriptive: the primary reporting line should be to the chair of the board audit committee, the chair should be responsible for appointing and removing the chief audit executive, and any administrative line should be to the chief executive, although in the private and third sectors another senior manager may be agreed with the audit committee chair.³ These provisions only work if the audit committee has the experience to use them. Where that is lacking, an independent audit committee member or non-executive with internal audit experience can make the reporting line effective in practice.

Scope of work

The considerations for Standard 6.1 describe scope as the entire breadth of the organisation for which internal audit provides services. That may be all activities, assets and personnel, or a defined subset, and it may specify the nature of services, such as assurance only or assurance and advisory. Services may be described simply as assurance and advisory, or more specifically, for example performance auditing or investigations.² Advisory services are defined as advice to stakeholders without providing assurance or taking on management responsibilities.²

Two points are worth testing when you draft the scope clause. First, the Standards require the audit plan to consider coverage of information technology governance, fraud risk and the effectiveness of compliance and ethics programmes,² so the charter should not exclude these areas. Second, organisations following the Chartered IIA Code should note that it calls for unrestricted scope and lists areas internal audit should include, such as organisational culture, risk appetite, financial crime and fraud, and technology and cyber risk.³ If internal audit carries out investigations or consultancy-style projects, say so, and say how objectivity is protected when it later audits the same area.

Charters in education and the UK public sector

Academy trusts in England work within the Academy Trust Handbook, which requires a programme of internal scrutiny to provide independent assurance to the board. The Department for Education’s good practice guide sets out four delivery options: an in-house internal auditor, a bought-in internal audit service, a non-employed trustee, or a peer review by another trust’s chief financial officer. It explains that independence is achieved by scrutineers reporting directly to the audit and risk committee, which reviews and approves a risk-based programme each year, and it provides illustrative terms of reference for that committee.⁵

For schools, academy trusts, colleges and universities, the practical lesson is that the committee’s terms of reference and any engagement letter with a bought-in provider do not, on their own, set out internal audit’s mandate, access rights and reporting lines. Where a trust or institution uses an in-house or bought-in internal audit service that works to the Global Internal Audit Standards, a short charter approved by the audit and risk committee fills that gap and gives the trustees a clear basis for holding the provider to account.

Across the UK public sector, the Global Internal Audit Standards have applied with the Relevant Internal Audit Standard Setters’ Application Note to engagements commenced on or after 1 April 2025. Where governance structures mean the Domain III essential conditions cannot be met as written, alternatives must be agreed with the board or audit committee and, if permanent, explained in the audit charter. Where the chief audit executive cannot manage financial, human and technological resources independently of the organisation’s processes, the charter must set out the alternative approaches that apply.⁶ In local government, the audit committee must approve the charter or recommend its approval, and the CIPFA Code lists the role internal audit would normally have, including access to the authority’s interests in collaborative and arm’s-length arrangements.⁴

Review and approval

The chief audit executive must discuss the proposed charter with the board and senior management to confirm it reflects their understanding and expectations. The board’s essential conditions are to discuss what else the charter should contain, to approve it, and to review it with the chief audit executive when circumstances change, such as the appointment of a new chief audit executive or changes in the organisation’s risks.²

The Standards suggest the board and chief audit executive agree how often the charter is reviewed. The considerations for Standard 6.1 list circumstances that may justify revisiting the mandate: a notable change in the Standards, a significant acquisition or reorganisation, significant changes in the board or senior management, significant changes to strategy, objectives or risk profile, and new laws or regulations.² An annual review alongside the audit plan is a sensible default.

Keep the evidence. The Standards give minutes of the meeting that discussed and approved the charter, and the approved charter with its approval date, as examples of evidence of conformance, and an external quality assessment should review the adequacy of the mandate and charter.² A practical approval routine is:

1. Draft or update the charter against the checklist above.
2. Discuss the draft with senior management and the audit committee chair, and record changes.
3. Present the final draft to the board or audit committee for discussion and approval, and minute the decision.
4. Record the version and approval date on the document and publish it where your governance code expects.
5. Diarise the next review and note the triggers that would bring it forward.

How we can help

We draft and review internal audit charters as part of setting up an internal audit function, and check existing charters against the Standards in our internal audit quality reviews and EQA. We also provide independent audit committee members and non-executives who can oversee the function the charter establishes, and we work with education providers, including academy trusts. To discuss your charter, book a free 20-minute call.

Frequently asked questions

Who approves the internal audit charter?

The board, which in most organisations means the audit committee acting for the board. The chief audit executive prepares the charter and must discuss it with the board and senior management before approval. In UK local government, the audit committee approves the charter or recommends it for approval to those charged with governance.

How often should an internal audit charter be reviewed?

The Global Internal Audit Standards leave the frequency for the board and chief audit executive to agree, and recommend periodic review. An annual review alongside the audit plan is a sensible default, with earlier review after events such as a new chief audit executive, a reorganisation, significant changes in risk or new legislation.

What is the difference between the internal audit mandate and the charter?

The mandate is internal audit's authority, role and responsibilities, granted by the board or by law. The charter is the formal document that records the mandate together with the function's purpose, scope, reporting lines and other arrangements. The Standards require the mandate to be documented or referenced in the board-approved charter.

References

1. The Institute of Internal Auditors, 16 January 2025. The IIA Celebrates the Effective Date of the Global Internal Audit Standards
2. The Institute of Internal Auditors, 9 January 2024. Global Internal Audit Standards
3. Chartered Institute of Internal Auditors, September 2024 (effective from January 2025). Internal Audit Code of Practice: Principles on effective internal audit in the financial services, private and third sectors
4. CIPFA, February 2025 (in force from 1 April 2025). Code of Practice for the Governance of Internal Audit in UK Local Government
5. Department for Education and Education and Skills Funding Agency, 14 February 2024. Internal scrutiny in academy trusts
6. Relevant Internal Audit Standard Setters (published by CIPFA), December 2024. Application Note: Global Internal Audit Standards in the UK Public Sector