The internal audit activity is undergoing a self-assessment as part of its quality assurance and improvement program Which of the following observations must be addressed in order for the internal…

Question

Options

• AThe internal audit charter does not identify which audit services are outsourced
• BThe internal audit charter has not been reviewed by the legal department
• CThe internal audit charter has not been approved by the board within the past year
• DThe internal audit charter does not describe the authority of the internal audit activity

• A
  11% (4)
• B
  6% (2)
• C
  3% (1)
• D
  80% (28)

Explanation

Option D is correct because IIA Standard 1000 explicitly requires that the internal audit charter formally define the purpose, authority, and responsibility of the internal audit activity - all three elements are mandatory, so a missing authority description is a direct nonconformance that must be remedied.

Option A is wrong because the Standards contain no requirement that the charter identify which services are outsourced; cosourcing arrangements are governed by other provisions, not charter content rules. Option B is wrong because the Standards require board approval of the charter, not legal department review - legal review is a discretionary organizational practice, not a Standards mandate. Option C is wrong because Standard 1000 requires the CAE to present the charter to the board "periodically" for approval, but "periodically" is not defined as annually; failing to get annual re-approval is therefore not automatically a conformance gap.

Memory tip: Think of the charter as the internal audit activity's "birth certificate" - it must state WHO the activity is (purpose), WHAT it can do (authority), and WHAT it must do (responsibility). If any of those three pillars is missing, you fail the Standards - no exceptions.

No community discussion yet for this question.