Why is the audit charter considered critical?

• A. It is the source of internal audit's authority.
• B. It establishes the organization's risk appetite.
• C. It defines IT control standards.
• D. It prescribes auditing techniques.

Answer: (A)

The audit charter is the formal authorization that establishes the internal audit activity’s authority, scope, and responsibilities. It legitimizes the function by defining its purpose, its right to access records, personnel, and physical properties, and its reporting line to the board or audit committee. This formal backing protects the independence and objectivity of internal audit, enabling it to conduct reviews and investigations without undue interference and to communicate results to governance bodies. With a clear charter, planning, prioritization, and execution of audits are aligned with organizational objectives, and the audit activity can operate with the confidence that it has the necessary authority to obtain the information it needs. By contrast, risk appetite, IT control standards, and prescribed auditing techniques are governed by other bodies or frameworks—the board or management sets risk appetite, IT standards come from IT governance, and auditing methods come from professional standards and the audit methodology—so they are not the charter’s primary purpose.