Standard 1000

Purpose Authority and Responsibility

The purpose, authority, and responsibility of
the internal audit activity must be formally
defined in an internal audit charter, consistent
with the Definition of Internal Auditing, the
Code of Ethics, and the Standards. The chief
audit executive must periodically review the
internal audit charter and present it to senior
management and the board for approval

Condition
The Charter was not approved by the Board.
The Charter was approved by Senior
Management, but no evidence of the
approval exists.
The Charter does not authorize access to
records, personnel, and physical properties
relevant to the performance of
engagements.
The Charter has not be assessed since it
was developed 10 years ago.

Recommendations
The Charter must be reviewed and approved by the
board. The charter should include a section that
grants authority to access the information (Records,
Personnel, and physical properties) necessary for
the IAD to accomplish its goals and be able to add
value to the company. There must be evidence of
the boards and senior managements approval of
the charter in order to grant the IAD some authority
within the organization. Saying it was approved and
not having proof is not enough. There must be
periodical assessments of the charters at least
annually.

Standard 1100
Independence & Objectivity
The internal audit activity must be
independent, and internal auditors
must be objective in performing their
work.

Observations
The CAE does not report functionally
to the Audit Committee.
The CAE reports to the SVP of Human
Resources
The CAE does not have direct
communication with the Board.
The CAE does not communicate
frequently with the Audit Committee.

Recommendations
In order to avoid independence issues the CAE
should report to the Audit Committee, the board of
directors, or another appropriate governing
authority within the corporation. Reporting directly
to the senior vice president of human resources
causes independence issues and objectivity issues.
The CAE needs to have access to a direct line of
communication with the Chair of the Audit
Committee and the members of the audit
committee or the chair of the board or full board if
necessary. Communication between the CAE and
the Audit Committee should be on a regular basis.

Recommendations 2
The meetings between the CAEs and the Audit
Committee or the Board should be attended whenever
they are scheduled (Quarterly) and should be held in
private. The CAE has to communicate the audit plan,
the budget, and any scope limitations to the audit
committee. In order to avoid independence issues the
Audit committee needs to be in charge of hiring the
CAE and not Management. Management can have
control of the compensation for the CAE; however, the
Audit committee needs to be consulted on the
adequacy of the compensation. The Audit committee
must evaluate the CAEs performance at least
annually.