Internal Audit Mandate and Board and CAE Responsibilities
5 minutes
5 Questions
Under the IIA's Global Internal Audit Standards (2024), Domain III, Governing the Internal Audit Function, establishes how internal audit is authorized, positioned, and overseen. A central idea is the internal audit mandate (Standard 6.1). The mandate sets out the function's authority, role, and responsibilities. It may come from laws or regulations, or from the board. The mandate defines the scope of assurance and advisory services, and it is documented in the internal audit charter (Standard 6.2). The charter covers purpose, commitment to the Standards, reporting relationships, unrestricted access to records, personnel, and property, and the nature and scope of services. Each standard in this domain includes 'Essential Conditions', which describe how the board and senior management must support internal audit, alongside the CAE's own requirements. Board responsibilities include: (1) discussing with the CAE and senior management the appropriate authority, role, and responsibilities of internal audit; (2) approving the charter and reviewing it periodically; (3) championing the function and supporting unrestricted access; (4) establishing direct reporting to the board so the function stays independent, and approving decisions on the CAE's appointment, removal, and compensation; (5) approving the internal audit plan, budget, and resources; and (6) overseeing the Quality Assurance and Improvement Program, including external quality assessments at least once every five years. CAE responsibilities include: (1) helping the board understand internal audit's mandate and proposing the charter; (2) documenting the mandate and keeping the charter current; (3) maintaining direct, unrestricted communication with the board; (4) confirming organizational independence at least annually and disclosing any impairments; (5) reporting on plan performance and conformance with the Standards; and (6) managing resources and quality. For the CIA Challenge Exam, remember the distinction: the board authorizes, supports, and oversees internal audit, while the CAE proposes, implements, communicates, and reports. Together, these roles let internal audit deliver objective, credible assurance that strengthens governance and adds organizational value.
Internal Audit Mandate and Board and CAE Responsibilities: A Complete CIA Challenge Exam Guide
Overview
The internal audit mandate, together with the division of responsibilities between the board and the Chief Audit Executive (CAE), is the foundation of every effective internal audit function. Under the IIA's Global Internal Audit Standards (effective January 2025), this topic sits within Domain III: Governing the Internal Audit Function. It is covered mainly by three Principles:
- Principle 6: Authorized by the Board
- Principle 7: Positioned Independently
- Principle 8: Overseen by the Board
For the CIA Challenge Exam, expect scenario-based questions. They test whether you know who does what, when, and why. Most questions ask you to separate what the board must do from what the CAE must do.
Why It Is Important
Without a clear mandate, internal audit has no legitimate authority. Without that authority, it cannot reach the records, people or properties it needs to do its work.
The mandate and charter matter for five reasons:
- Legitimacy and authority: The mandate formally grants internal audit the right to perform its work. This prevents management from restricting its scope.
- Independence: Defined reporting lines protect internal audit from undue influence. The key arrangement is a functional reporting line to the board.
- Accountability: The board can hold the CAE accountable against an approved charter and plan. The CAE can hold the board to its oversight duties.
- Stakeholder trust: Regulators, external auditors and audit committees rely on a properly authorized and overseen function.
- Quality: Board oversight of resources and quality supports conformance with the Standards.
Exam writers favour this area because weaknesses here, such as a CAE reporting only to the CFO, are classic root causes of audit failure.
What It Is: Key Concepts and Definitions
1. Internal Audit Mandate
The mandate is the authority, role and responsibilities of the internal audit function. It may be granted by the board or by laws and regulations.
- In some public sector or regulated organizations, the mandate is set by statute.
- In most private organizations, it is set by the board through the charter.
2. Internal Audit Charter
The charter is the formal document that captures the mandate. It is drafted by the CAE and approved by the board (Standard 6.2). A conforming charter typically includes:
- The purpose of internal audit.
- A commitment to adhere to the Global Internal Audit Standards.
- The mandate: scope and types of services (assurance and advisory), board responsibilities, and CAE responsibilities.
- The organizational position and reporting relationships of the function.
- Access rights: unrestricted access to data, records, information, personnel and physical properties.
3. The Board
The board is the highest-level body charged with governance. Examples include a board of directors, an audit committee, or a supervisory board. If no board exists, the Standards' references to the board apply to the group or person charged with governance, such as the head of a public entity.
4. Senior Management
Senior management is the highest level of executive management, typically headed by the CEO. It supports the internal audit function and usually receives the CAE's administrative reporting line.
5. Chief Audit Executive (CAE)
The CAE is the leadership role responsible for managing the internal audit function in line with the charter and the Standards. Job titles vary, for example Head of Internal Audit or Director of Audit. The CAE must have the qualifications needed to lead the function (Standard 7.2).
6. Essential Conditions
A major feature of the 2024 Standards is the set of Essential Conditions. These are actions the board and senior management should take so that internal audit can operate effectively.
- The CAE cannot force the board to act.
- The CAE must communicate the Essential Conditions to the board and senior management.
- The CAE must also report the impact on the function if these conditions are not met.
How It Works: Responsibilities by Standard
Standard 6.1: Internal Audit Mandate
Board (Essential Conditions):
- Discusses with the CAE and senior management the appropriate authority, role and responsibilities of internal audit.
- Approves the mandate.
- Ensures the mandate is reviewed periodically.
CAE:
- Provides information to help the board and senior management set the mandate. This includes considering stakeholder expectations, risks and any regulatory requirements.
- Documents the mandate, normally in the charter.
- Discusses changes in circumstances with the board, such as new regulations or a merger.
Standard 6.2: Internal Audit Charter
Board:
- Discusses the charter with the CAE and senior management.
- Approves the charter and any revisions.
CAE:
- Drafts and maintains the charter.
- Presents it for board approval.
- Reviews it periodically to confirm it still fits the organization's needs.
- Communicates significant changes.
Standard 6.3: Board and Senior Management Support
Board:
- Champions internal audit so it can fulfil its mandate.
- Works with senior management to give the CAE unrestricted access to the board.
- Ensures the CAE is positioned to fulfil the mandate.
Senior management:
- Supports the function's recognition across the organization.
- Provides access and cooperation.
CAE:
- Builds relationships with the board and senior management.
- Communicates the value of internal audit.
Standard 7.1: Organizational Independence
Board:
- Establishes a direct reporting relationship with the CAE.
- Approves the CAE's appointment and removal.
- Provides input on the CAE's performance evaluation and remuneration.
- Ensures internal audit is free from interference in setting its scope, performing work and communicating results.
- Meets periodically with the CAE without senior management present (private sessions).
CAE:
- Confirms the organizational independence of internal audit to the board at least annually.
- Discloses any interference or impairment, and its implications.
- If the CAE holds roles beyond internal audit, such as compliance or risk management, the CAE discusses this with the board, documents it, and puts safeguards in place. For example, another party provides assurance over those areas.
Reporting lines:
- The ideal structure is a functional reporting line to the board. This covers the charter, plan, budget, CAE appointment and removal, and results.
- Alongside it sits an administrative reporting line to a senior executive, usually the CEO. This covers day-to-day matters such as budgeting processes, HR administration and facilities.
Standard 7.2: CAE Qualifications
Board:
- Approves the CAE's roles and responsibilities.
- Identifies the qualifications, experience and competencies required.
- Ensures the CAE is appropriately hired and evaluated, together with senior management.
CAE:
- Maintains and develops the competencies needed to lead the function.
Standard 8.1: Board Interaction
Board:
- Communicates its perspectives on the organization's strategies, objectives and risks.
- Sets expectations for how often and how the CAE reports.
- Makes appropriate inquiries of management and the CAE to determine whether scope or resource limitations exist.
CAE:
- Reports on the function's performance, results, significant risks, plan changes and conformance with the Standards.
- Communicates risk acceptance issues. If management has accepted a level of risk the CAE considers unacceptable, the CAE escalates it to the board.
Standard 8.2: Resources
Board:
- Approves the internal audit budget and resource plan, including financial, human and technological resources.
CAE:
- Evaluates whether resources are sufficient.
- Communicates the impact of insufficient resources to the board.
Standard 8.3: Quality
Board:
- Discusses the quality assurance and improvement program (QAIP) with the CAE.
- Approves performance objectives for the function.
CAE:
- Develops and maintains the QAIP.
- Communicates results to the board and senior management.
Standard 8.4: External Quality Assessment
Board:
- Discusses the need for and timing of the EQA.
- Approves the scope and frequency of the EQA.
- Considers the assessor's or assessment team's independence and qualifications.
Requirements:
- An EQA must be performed at least once every five years.
- At least one assessor must hold an active CIA designation.
CAE:
- Develops the EQA plan with the board.
- Reports EQA results and action plans.
Quick Reference: Who Does What?
Board APPROVES:
- Mandate and charter
- Internal audit plan, budget and resource plan
- CAE appointment and removal
- CAE roles and responsibilities
- Performance objectives
- EQA scope and frequency
Board PROVIDES INPUT on:
- CAE performance evaluation and remuneration
CAE DRAFTS, COMMUNICATES and CONFIRMS:
- Drafts the charter, plan and QAIP
- Communicates the Essential Conditions
- Communicates resource and scope limitations
- Confirms independence annually
- Escalates unacceptable risk acceptance
Senior management SUPPORTS:
- Access, cooperation and administrative reporting
Exam Tips: Answering Questions on Internal Audit Mandate and Board and CAE Responsibilities
1. Separate who approves from who drafts. If an option says the CAE approves the charter or audit plan, it is almost certainly wrong. The CAE drafts and proposes; the board approves.
2. Look for the functional versus administrative split. When a question asks about the best reporting structure, choose the answer with a functional line to the board or audit committee. Reporting functionally to the CFO or controller compromises independence.
3. CAE appointment and removal belong to the board. Senior management may participate and give input, but the board approves. An answer where the CEO alone fires the CAE signals an independence impairment.
4. Remember the numbers.
- Independence is confirmed at least annually.
- An EQA is required at least every five years.
- At least one EQA assessor must hold an active CIA.
5. Escalation logic. If the CAE faces a scope limitation, resource shortfall, interference, or unacceptable risk acceptance by management, the correct action is to communicate or escalate to the board. Avoid answers where the CAE ignores the issue or resigns immediately. Also avoid answers where the CAE accepts the limitation silently.
6. Essential Conditions are not CAE obligations to perform. They are board and senior management actions. The CAE's obligation is to communicate them and report the consequences if they are not met. The CAE cannot be blamed for the board's inaction, but must be transparent about it.
7. Mandate versus charter.
- The mandate is the authority, role and responsibilities. It may come from law.
- The charter is the document that records the mandate.
- If laws already define the mandate, the charter should still reflect it.
8. Non-audit roles need safeguards. In a scenario where the CAE also manages risk management or compliance, the best answer involves three steps: discussing it with the board, documenting it, and implementing safeguards. A common safeguard is independent assurance over those areas by another party. This role is not automatically prohibited, but it is not acceptable without safeguards.
9. Private sessions. Questions about how the board can obtain candid views usually point to the board meeting the CAE without management present.
10. Use the 'most appropriate' or 'best' filter. Several options may be partly true. Choose the one that:
- most directly protects independence, or
- most closely reflects the specific wording of the Standards, or
- assigns responsibility to the correct party.
11. Watch for absolute words. Options with 'always', 'never' or 'only' are often traps. The exception is where the Standards are explicit, such as the board approving the charter.
12. No board? If the scenario describes an organization without a formal board, apply the requirements to the person or group charged with governance. Do not conclude that the requirements do not apply.
Sample Question Walkthrough
Question: The CEO has reduced the internal audit budget, so several high-risk areas in the approved plan cannot be audited. What should the CAE do first?
Reasoning:
- The board approves the budget and plan.
- Insufficient resources must be communicated to the board, together with their impact on coverage (Standard 8.2).
Best answer: Inform the board of the resource limitation and its effect on the plan's risk coverage.
Wrong options to reject:
- Quietly reprioritizing the plan without telling the board.
- Asking external auditors to cover the gap without board involvement.
- Resigning.
Summary
The board authorizes, positions and oversees internal audit. The CAE drafts, leads, communicates and confirms. Senior management supports.
When answering exam questions, ask three things:
- Who has the authority?
- Is independence protected?
- Has the issue been communicated to the board?
Mastering these patterns will help you answer most questions in this area with confidence.
The internal audit mandate, together with the division of responsibilities between the board and the Chief Audit Executive (CAE), is the foundation of every effective internal audit function. Under the IIA's Global Internal Audit Standards (effective January 2025), this topic sits within Domain III: Governing the Internal Audit Function. It is covered mainly by three Principles:
- Principle 6: Authorized by the Board
- Principle 7: Positioned Independently
- Principle 8: Overseen by the Board
For the CIA Challenge Exam, expect scenario-based questions. They test whether you know who does what, when, and why. Most questions ask you to separate what the board must do from what the CAE must do.
Why It Is Important
Without a clear mandate, internal audit has no legitimate authority. Without that authority, it cannot reach the records, people or properties it needs to do its work.
The mandate and charter matter for five reasons:
- Legitimacy and authority: The mandate formally grants internal audit the right to perform its work. This prevents management from restricting its scope.
- Independence: Defined reporting lines protect internal audit from undue influence. The key arrangement is a functional reporting line to the board.
- Accountability: The board can hold the CAE accountable against an approved charter and plan. The CAE can hold the board to its oversight duties.
- Stakeholder trust: Regulators, external auditors and audit committees rely on a properly authorized and overseen function.
- Quality: Board oversight of resources and quality supports conformance with the Standards.
Exam writers favour this area because weaknesses here, such as a CAE reporting only to the CFO, are classic root causes of audit failure.
What It Is: Key Concepts and Definitions
1. Internal Audit Mandate
The mandate is the authority, role and responsibilities of the internal audit function. It may be granted by the board or by laws and regulations.
- In some public sector or regulated organizations, the mandate is set by statute.
- In most private organizations, it is set by the board through the charter.
2. Internal Audit Charter
The charter is the formal document that captures the mandate. It is drafted by the CAE and approved by the board (Standard 6.2). A conforming charter typically includes:
- The purpose of internal audit.
- A commitment to adhere to the Global Internal Audit Standards.
- The mandate: scope and types of services (assurance and advisory), board responsibilities, and CAE responsibilities.
- The organizational position and reporting relationships of the function.
- Access rights: unrestricted access to data, records, information, personnel and physical properties.
3. The Board
The board is the highest-level body charged with governance. Examples include a board of directors, an audit committee, or a supervisory board. If no board exists, the Standards' references to the board apply to the group or person charged with governance, such as the head of a public entity.
4. Senior Management
Senior management is the highest level of executive management, typically headed by the CEO. It supports the internal audit function and usually receives the CAE's administrative reporting line.
5. Chief Audit Executive (CAE)
The CAE is the leadership role responsible for managing the internal audit function in line with the charter and the Standards. Job titles vary, for example Head of Internal Audit or Director of Audit. The CAE must have the qualifications needed to lead the function (Standard 7.2).
6. Essential Conditions
A major feature of the 2024 Standards is the set of Essential Conditions. These are actions the board and senior management should take so that internal audit can operate effectively.
- The CAE cannot force the board to act.
- The CAE must communicate the Essential Conditions to the board and senior management.
- The CAE must also report the impact on the function if these conditions are not met.
How It Works: Responsibilities by Standard
Standard 6.1: Internal Audit Mandate
Board (Essential Conditions):
- Discusses with the CAE and senior management the appropriate authority, role and responsibilities of internal audit.
- Approves the mandate.
- Ensures the mandate is reviewed periodically.
CAE:
- Provides information to help the board and senior management set the mandate. This includes considering stakeholder expectations, risks and any regulatory requirements.
- Documents the mandate, normally in the charter.
- Discusses changes in circumstances with the board, such as new regulations or a merger.
Standard 6.2: Internal Audit Charter
Board:
- Discusses the charter with the CAE and senior management.
- Approves the charter and any revisions.
CAE:
- Drafts and maintains the charter.
- Presents it for board approval.
- Reviews it periodically to confirm it still fits the organization's needs.
- Communicates significant changes.
Standard 6.3: Board and Senior Management Support
Board:
- Champions internal audit so it can fulfil its mandate.
- Works with senior management to give the CAE unrestricted access to the board.
- Ensures the CAE is positioned to fulfil the mandate.
Senior management:
- Supports the function's recognition across the organization.
- Provides access and cooperation.
CAE:
- Builds relationships with the board and senior management.
- Communicates the value of internal audit.
Standard 7.1: Organizational Independence
Board:
- Establishes a direct reporting relationship with the CAE.
- Approves the CAE's appointment and removal.
- Provides input on the CAE's performance evaluation and remuneration.
- Ensures internal audit is free from interference in setting its scope, performing work and communicating results.
- Meets periodically with the CAE without senior management present (private sessions).
CAE:
- Confirms the organizational independence of internal audit to the board at least annually.
- Discloses any interference or impairment, and its implications.
- If the CAE holds roles beyond internal audit, such as compliance or risk management, the CAE discusses this with the board, documents it, and puts safeguards in place. For example, another party provides assurance over those areas.
Reporting lines:
- The ideal structure is a functional reporting line to the board. This covers the charter, plan, budget, CAE appointment and removal, and results.
- Alongside it sits an administrative reporting line to a senior executive, usually the CEO. This covers day-to-day matters such as budgeting processes, HR administration and facilities.
Standard 7.2: CAE Qualifications
Board:
- Approves the CAE's roles and responsibilities.
- Identifies the qualifications, experience and competencies required.
- Ensures the CAE is appropriately hired and evaluated, together with senior management.
CAE:
- Maintains and develops the competencies needed to lead the function.
Standard 8.1: Board Interaction
Board:
- Communicates its perspectives on the organization's strategies, objectives and risks.
- Sets expectations for how often and how the CAE reports.
- Makes appropriate inquiries of management and the CAE to determine whether scope or resource limitations exist.
CAE:
- Reports on the function's performance, results, significant risks, plan changes and conformance with the Standards.
- Communicates risk acceptance issues. If management has accepted a level of risk the CAE considers unacceptable, the CAE escalates it to the board.
Standard 8.2: Resources
Board:
- Approves the internal audit budget and resource plan, including financial, human and technological resources.
CAE:
- Evaluates whether resources are sufficient.
- Communicates the impact of insufficient resources to the board.
Standard 8.3: Quality
Board:
- Discusses the quality assurance and improvement program (QAIP) with the CAE.
- Approves performance objectives for the function.
CAE:
- Develops and maintains the QAIP.
- Communicates results to the board and senior management.
Standard 8.4: External Quality Assessment
Board:
- Discusses the need for and timing of the EQA.
- Approves the scope and frequency of the EQA.
- Considers the assessor's or assessment team's independence and qualifications.
Requirements:
- An EQA must be performed at least once every five years.
- At least one assessor must hold an active CIA designation.
CAE:
- Develops the EQA plan with the board.
- Reports EQA results and action plans.
Quick Reference: Who Does What?
Board APPROVES:
- Mandate and charter
- Internal audit plan, budget and resource plan
- CAE appointment and removal
- CAE roles and responsibilities
- Performance objectives
- EQA scope and frequency
Board PROVIDES INPUT on:
- CAE performance evaluation and remuneration
CAE DRAFTS, COMMUNICATES and CONFIRMS:
- Drafts the charter, plan and QAIP
- Communicates the Essential Conditions
- Communicates resource and scope limitations
- Confirms independence annually
- Escalates unacceptable risk acceptance
Senior management SUPPORTS:
- Access, cooperation and administrative reporting
Exam Tips: Answering Questions on Internal Audit Mandate and Board and CAE Responsibilities
1. Separate who approves from who drafts. If an option says the CAE approves the charter or audit plan, it is almost certainly wrong. The CAE drafts and proposes; the board approves.
2. Look for the functional versus administrative split. When a question asks about the best reporting structure, choose the answer with a functional line to the board or audit committee. Reporting functionally to the CFO or controller compromises independence.
3. CAE appointment and removal belong to the board. Senior management may participate and give input, but the board approves. An answer where the CEO alone fires the CAE signals an independence impairment.
4. Remember the numbers.
- Independence is confirmed at least annually.
- An EQA is required at least every five years.
- At least one EQA assessor must hold an active CIA.
5. Escalation logic. If the CAE faces a scope limitation, resource shortfall, interference, or unacceptable risk acceptance by management, the correct action is to communicate or escalate to the board. Avoid answers where the CAE ignores the issue or resigns immediately. Also avoid answers where the CAE accepts the limitation silently.
6. Essential Conditions are not CAE obligations to perform. They are board and senior management actions. The CAE's obligation is to communicate them and report the consequences if they are not met. The CAE cannot be blamed for the board's inaction, but must be transparent about it.
7. Mandate versus charter.
- The mandate is the authority, role and responsibilities. It may come from law.
- The charter is the document that records the mandate.
- If laws already define the mandate, the charter should still reflect it.
8. Non-audit roles need safeguards. In a scenario where the CAE also manages risk management or compliance, the best answer involves three steps: discussing it with the board, documenting it, and implementing safeguards. A common safeguard is independent assurance over those areas by another party. This role is not automatically prohibited, but it is not acceptable without safeguards.
9. Private sessions. Questions about how the board can obtain candid views usually point to the board meeting the CAE without management present.
10. Use the 'most appropriate' or 'best' filter. Several options may be partly true. Choose the one that:
- most directly protects independence, or
- most closely reflects the specific wording of the Standards, or
- assigns responsibility to the correct party.
11. Watch for absolute words. Options with 'always', 'never' or 'only' are often traps. The exception is where the Standards are explicit, such as the board approving the charter.
12. No board? If the scenario describes an organization without a formal board, apply the requirements to the person or group charged with governance. Do not conclude that the requirements do not apply.
Sample Question Walkthrough
Question: The CEO has reduced the internal audit budget, so several high-risk areas in the approved plan cannot be audited. What should the CAE do first?
Reasoning:
- The board approves the budget and plan.
- Insufficient resources must be communicated to the board, together with their impact on coverage (Standard 8.2).
Best answer: Inform the board of the resource limitation and its effect on the plan's risk coverage.
Wrong options to reject:
- Quietly reprioritizing the plan without telling the board.
- Asking external auditors to cover the gap without board involvement.
- Resigning.
Summary
The board authorizes, positions and oversees internal audit. The CAE drafts, leads, communicates and confirms. Senior management supports.
When answering exam questions, ask three things:
- Who has the authority?
- Is independence protected?
- Has the issue been communicated to the board?
Mastering these patterns will help you answer most questions in this area with confidence.
Test mode:
CIA Challenge - Internal Audit Mandate and Board and CAE Responsibilities Example Questions
Test your knowledge of Internal Audit Mandate and Board and CAE Responsibilities
Question 1
According to IIA Standards, what element must be included in the internal audit charter regarding the chief audit executive's access to records and personnel?
Question 2
According to IIA Standards, how often must the chief audit executive report to senior management and the board on internal audit performance relative to its plan?
Question 3
Which activity is generally considered outside the acceptable scope of the chief audit executive's role to preserve objectivity?
Unlock Premium Access
Certified Internal Auditor Challenge Exam
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 2865 Superior-grade Certified Internal Auditor Challenge Exam practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CIA Challenge: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Internal Audit Mandate and Board and CAE Responsibilities questions
67 questions (total)
Other Internal Audit Professionalism and Quality concepts
Confidentiality and Appropriate Use of InformationDisclosing Nonconformance with the StandardsImpairments to Individual ObjectivityImpairments to Internal Audit IndependenceInternal Audit KPIs and Scorecard MetricsInternal Audit's Role in Risk Management and the Three LinesQuality Assurance and Improvement Program