An internal audit charter is the board-approved document that establishes an internal audit function’s authority, defines what it can examine, and sets how it reports to leadership. Under the Global Internal Audit Standards that took effect in January 2025, every internal audit function must operate under one, and the charter must cover four minimum elements: the purpose of internal auditing, a commitment to follow the Standards, the function’s mandate and scope of services, and its organizational position and reporting relationships.1The Institute of Internal Auditors. Global Internal Audit Standards Without a current, board-approved charter, the audit team has no recognized standing to examine the organization and no protection when its findings are unwelcome.
What the 2025 Standards Require
The Institute of Internal Auditors (IIA) replaced the old International Professional Practices Framework in January 2025 with the Global Internal Audit Standards.2The Institute of Internal Auditors. Global Internal Audit Standards – IPPF Framework The charter requirement now lives in Standard 6.2, under Domain III (Governing the Internal Audit Function). If your charter still cites the old Attribute Standard 1000, it needs updating.
Standard 6.2 places responsibility for developing and maintaining the charter on the chief audit executive (CAE). A companion requirement in Standard 6.1 adds that the document must also spell out the board’s responsibilities and the expectations for how management will support the audit function.1The Institute of Internal Auditors. Global Internal Audit Standards Together, the two standards turn the charter into both a statement of purpose and a grant of operating authority.
Purpose and Mandate
The charter opens by explaining why the internal audit function exists and what it is expected to deliver. This section should articulate the function’s role in evaluating governance, risk management, and internal controls, and it should capture the board’s expectations for the function along with what management must do to support it.1The Institute of Internal Auditors. Global Internal Audit Standards
Scope of Services
The scope section draws the boundaries of what the audit team can examine and what services it provides. An organization might limit coverage to specific geographic regions, business units, or financial processes, or grant coverage across all activities, assets, and personnel. The charter should also state whether the function provides assurance services only, or both assurance and advisory services.1The Institute of Internal Auditors. Global Internal Audit Standards A clear scope prevents disputes later about whether a particular department or process is within reach.
Access to Records, Personnel, and Property
The document must grant the audit team free and unrestricted access to all records, personnel, and physical property needed to carry out engagements.1The Institute of Internal Auditors. Global Internal Audit Standards In practice, that means auditors can review payroll data, general ledger entries, executive communications, and confidential contracts without needing permission from the department being reviewed. It also means physical inspections to verify that assets exist.
The charter should make clear that no employee or department head can withhold information during a legitimate engagement. Having the access right written into a board-approved policy converts what could be a confrontation into a straightforward reference to policy.
Reporting Lines and Independence
Reporting structure is where most of the charter’s protective power comes from. The Standards continue the dual-reporting model the IIA has long recommended: a functional reporting line to the board or its audit committee, and an administrative reporting line to a senior executive, ideally the CEO.3Institute of Internal Auditors. Implementation Guide Standard 1100 Independence and Objectivity
The functional line is the important one. It connects the CAE directly to the board, so audit results reach an independent body rather than someone whose department just received an unfavorable finding. The board receives the audit plan, reviews significant findings, and approves changes to the charter itself. The administrative line handles operational logistics such as expense reimbursements, office space, and day-to-day communications.
The IIA specifically recommends that the CAE report administratively to the CEO rather than the CFO or another executive whose function is routinely subject to audit.3Institute of Internal Auditors. Implementation Guide Standard 1100 Independence and Objectivity Placing internal audit under the CFO creates inherent tension when the team needs to report financial control weaknesses.
Protecting the CAE
Strong charters include provisions requiring the board to participate directly in hiring, evaluating, and removing the CAE, so management cannot unilaterally fire the CAE after receiving unwelcome findings.4The Institute of Internal Auditors. The Internal Audit Charter – A Blueprint to Assurance Success The charter should also give the CAE unrestricted access to the board without management present and require the board to approve the CAE’s compensation.
The board should periodically ask both management and the CAE whether any scope limitations or resource constraints are interfering with the function’s work.4The Institute of Internal Auditors. The Internal Audit Charter – A Blueprint to Assurance Success That regular check guards against the quieter form of interference: starving the function of resources instead of confronting it.
Budget Authority
Under Standard 10.1, the CAE must develop a budget covering everything the function needs to execute its strategy, including staffing, training, and technology. That budget goes to the board for approval, not just to management.1The Institute of Internal Auditors. Global Internal Audit Standards If the approved budget falls short, the CAE must promptly tell both the board and senior management what the shortfall means for audit coverage. The charter should reflect this authority and the board’s role in funding, because broad scope on paper cannot deliver meaningful assurance without resources behind it.
A Note on Sarbanes-Oxley
Organizations sometimes assume the Sarbanes-Oxley Act of 2002 requires a formal internal audit function. It does not. SOX Section 404 requires public company management to assess and report on the effectiveness of internal controls over financial reporting, and requires the external auditor to attest to that assessment.5U.S. GAO. Sarbanes-Oxley Act – Compliance Costs Are Higher for Larger Companies but More Burdensome for Smaller Ones The law doesn’t mandate an internal audit department or a charter. Most public companies maintain a strong internal audit function anyway because it’s one of the most effective ways to satisfy SOX. If your organization is subject to regulatory obligations that shape audit priorities, the charter should reference them.
Drafting and Approval
The IIA offers a model charter tool and customization guide as a starting point.6The Institute of Internal Auditors. Model Internal Audit Charter Tool and Users Guide It is designed for customization, not copy-paste adoption. Every field needs to reflect the actual reporting titles, committee names, and service types used in your organization. A charter that reads like a generic template signals to the board and to external quality assessors that the function has not thought carefully about its own environment.
Final approval rests with the board. The CAE typically presents the final draft at a board or audit committee meeting, where it is discussed and formally approved.1The Institute of Internal Auditors. Global Internal Audit Standards Both the board chair (or audit committee chair) and the CAE sign, converting the draft into an enforceable corporate policy.
Reviews and Updates
Review the charter at least annually to keep it aligned with organizational changes.4The Institute of Internal Auditors. The Internal Audit Charter – A Blueprint to Assurance Success Annual is a floor. Standard 6.2 specifically identifies hiring a new CAE and changes in the organization’s risk profile as events that should trigger an out-of-cycle review.1The Institute of Internal Auditors. Global Internal Audit Standards Mergers, acquisitions, significant restructurings, and new regulatory obligations fall into the same category. A charter written for a domestic manufacturer does not serve the same company after it acquires operations on three continents.
What’s at Stake Without One
Every internal audit function must undergo an external quality assessment at least once every five years. If the assessor finds that the function lacks a proper charter or that the charter does not meet the Standards, the function cannot claim conformance with the Global Internal Audit Standards.7The Institute of Internal Auditors. Quality Services Frequently Asked Questions A CAE who claims conformance anyway faces ethical disciplinary sanctions from the IIA.8IIA Customer Support. What Are the Repercussions of Not Undergoing an External QA
The practical fallout is just as significant. Without a charter that explicitly grants access to records and personnel, auditors have no enforceable right to the information they need. Without board-approved reporting lines, management can quietly redirect audit resources away from high-risk areas. And without documented protections for the CAE, the person responsible for honest reporting has no job security when the findings are unfavorable.