According to IIA guidance, which of the following most appropriately justifies the CEO's decision that the internal audit activity shall be responsible for risk management and investigation at a…

Question

Options

• AThe recommendation of the parent office external auditors.
• BThe provisions of the internal audit charter
• CThe authority of the CEO.
• DThe level of proficiency of the chief audit executive

• A
  13% (5)
• B
  80% (32)
• C
  5% (2)
• D
  3% (1)

Explanation

Option B is correct because, per IIA Standards, the internal audit charter is the foundational document that formally establishes the internal audit activity's purpose, authority, and responsibilities - including any expanded scope like risk management or investigations. The charter, approved by the board, is the only authoritative basis for defining what internal audit is responsible for within an organization.

Why the distractors fail:

• A - External auditors have no authority to define the internal audit activity's mandate; their recommendations carry no governance weight over IA's charter.
• C - While CEOs hold significant authority, IIA guidance requires the charter to be approved by the board (or equivalent governance body), not unilaterally dictated by the CEO. CEO preference alone is insufficient justification.
• D - The CAE's proficiency level may influence capability, but it does not justify the scope of responsibilities; authority must come from governance documents, not individual competence.

Memory tip: Think of the charter as internal audit's "constitution" - everything IA is authorized to do must trace back to it. If a question asks what justifies IA's authority or responsibilities, the charter is almost always the answer.

No community discussion yet for this question.