A company is creating an internal audit function. The board wants a formal document that defines the function's purpose, authority, independence, scope, and reporting line to the audit committee. Which document should be created?
Select an answer to reveal the explanation.
Short Explanation
Think of the audit charter as the birth certificate and job description of the audit team: why it exists, what it can look at, and who it answers to. Without it, your auditors can be told 'that's off limits'. The trap is the audit report, which is what comes out of an audit, not what authorizes it.
Full Explanation
An audit charter is the governing document for an audit function. Approved by the board or audit committee, it establishes the function's purpose, its authority to access records, personnel, and facilities, its independence from the activities it audits, the scope of its work, and its reporting relationships. The charter is a scoping artifact: it determines what the function may examine and gives auditors the mandate to do so, which is why it appears with frequency under scoping in the audit objective. A statement of work defines deliverables, schedule, and price for a specific engagement with a vendor, such as an external firm hired for one audit; it does not establish a permanent internal function's authority or independence. A risk register lists identified risks with owners, ratings, and treatments; the audit function may use it to plan work, but it does not define the function itself. An audit report communicates the results of a completed audit, including findings and recommendations; it is an output of the function rather than the document that creates and empowers it. Exam caveat: reporting directly to the audit committee rather than to the managers being audited is what preserves independence, so the reporting line in the charter matters as much as the scope. Operational check: confirm the charter is approved by the audit committee and reviewed on a defined schedule.