The Internal Audit Charter: Purpose, Authority and Responsibility

An internal audit charter gives the organisation a shared understanding of the function's role before a difficult review tests that understanding.

For a beginner, three questions make the idea concrete: why does the team exist, what enables its work, and what is it accountable for?

A first-time audit function

Consider a fictional organisation establishing internal audit for the first time. The board wants a clearer view of whether important business processes are working as intended. The new audit lead proposes an initial review of supplier onboarding.

Before fieldwork starts, a manager asks whether auditors can inspect supplier records. Another asks whether internal audit will now approve every new supplier. A third wants all observations sent only to the purchasing manager.

These questions reveal different expectations. Assume the organisation has a board responsible for oversight and management responsible for day-to-day operations. Here, board means the body overseeing the organisation; its legal name and allocation of duties depend on the governance structure. The example is a teaching scenario, not an actual company or an allegation.

Purpose: why this function exists

The charter records the function's mandate and place in the organisation. Its preparation involves the chief audit executive, board and senior management; board approval gives the arrangement formal governance support.

In our fictional organisation, the practical purpose is to help oversight understand whether supplier-onboarding safeguards can be relied on and where improvement is needed. The question is broader than finding an incorrect form. It concerns whether the process supports the organisation's objectives.

The charter is not a list of this year's assignments. A plan selects particular reviews; the charter establishes the broader role within which those reviews are performed.

Authority: what enables the review

For the supplier review, the team needs appropriate records, explanations and access to relevant staff. A clear mandate helps people understand why that information is requested and how unresolved restrictions will be raised.

In the case, the audit lead explains the purpose of the requested supplier records, arranges secure access and clarifies who can resolve a disagreement. This is a more workable approach than either accepting an unexplained refusal or treating an access provision as permission to disregard confidentiality.

Secure handling and lawful safeguards should be arranged without treating confidentiality as a blanket reason to withhold relevant evidence. Unresolved restrictions need the agreed escalation route.

Access to information does not mean authority to run the purchasing process. The ability to inspect a supplier's approval history is different from the responsibility to approve the supplier.

Responsibility: what the team must deliver

The charter clarifies the services, reporting relationships and expectations attached to the function. In the fictional review, the audit team must explain its conclusions with evidence, communicate limitations and report through the agreed governance arrangements.

Suppose the supplier file cannot be linked to an approval record. The auditor should investigate the gap before labelling it an unauthorised supplier. The missing link might reflect an archive problem, an incomplete extract or absent approval. Each possibility needs evidence.

Management remains responsible for the operating decision and any corrective action. Internal audit can evaluate and advise without quietly becoming the owner of the control it will later assess.

Make the agreement usable

For this organisation, a useful discussion tests the charter against everyday questions. Who helps resolve a denied access request? Where does the audit lead raise a significant disagreement? What happens if a proposed advisory assignment would place the team in a management role?

The answers need to fit the organisation's actual governance and applicable legal requirements. This lesson illustrates the business meaning of a charter; it is not a complete charter template or a checklist of every professional requirement.

A signed document also cannot substitute for competent people, practical resources and genuine support. The organisation needs to notice when the written mandate and everyday practice diverge.

Practice: draw the mandate map

Place “Internal audit” at the centre. Add three branches: purpose, authority and responsibility. Under each, write one answer for the supplier-onboarding case and one unresolved question to discuss with the appropriate governance body.

Self-check: if the audit team can inspect supplier records, should it therefore approve new suppliers? No. Review access and operating ownership answer different questions.

The value of the charter is the shared understanding it enables. It helps the organisation resolve role questions deliberately, rather than improvising authority when a review becomes uncomfortable.