Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Audit Charter: Purpose and Contents
The question the charter answers
Sooner or later every auditor hears it: “Who says you’re allowed to look at our systems?”
The answer is the audit charter: a short, formal document that creates the audit function and gives it the right to see what it needs. It’s approved by the board of directors or the audit committee, and that approval is where audit’s authority comes from.
Think of a police warrant card. An officer’s authority doesn’t come from how confident they are; it comes from the card, which comes from the state. An auditor’s authority comes from the charter, which comes from the board.
ITAF requires the audit function’s purpose, responsibility, authority and accountability to be documented in a charter approved at the appropriate level.
What’s in it
| Element | What it says | Why it matters |
|---|---|---|
| Purpose | Why audit exists and what value it adds | Sets expectations |
| Authority | Unrestricted access to records, assets, systems, premises and people | Lets the auditor get evidence |
| Responsibility and scope | What audit may examine, and which standards it follows (such as ITAF) | Defines the playing field |
| Independence | Functional reporting to the audit committee; administrative to senior management | Protects objectivity |
| Accountability | How audit reports results and how its own performance is measured | Keeps audit itself accountable |
| Relationships | How audit works with external auditors and regulators | Avoids duplicated effort |
| Review | How often the charter is reviewed, usually annually | Keeps it current |
What’s not in it
The charter deals with principles, so it’s short (often a few pages) and rarely changes. Things that change every year or every audit live elsewhere:
- the annual audit plan (what gets audited this year)
- audit programs and test steps for individual audits
- sample sizes, staffing and timing
Charter, plan and engagement letter
An engagement letter is used for one specific audit, especially when the work is done by an external firm or an outsourced provider. It sets out the objectives, scope, responsibilities, deliverables, timing and fees for that job. Internal audit often uses an engagement memo or terms of reference for the same purpose.
| Audit charter | Engagement letter | |
|---|---|---|
| Covers | The whole audit function | One specific audit |
| Approved by | Board or audit committee | Client management and the audit provider |
| Lasts | Ongoing, reviewed periodically | Until the audit ends |
Using the charter
Example. A new head of IS audit finds the database team refusing read access, saying “audit isn’t allowed in production”. The head of audit shows them the charter’s access clause. If they still refuse, the matter goes to the audit committee, which approved the charter in the first place.
If there’s no charter at all, the fix is to write one and get it approved by the board or audit committee.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Which document gives the IS auditor authority to perform the audit? | The audit charter |
| Who should approve the audit charter? | The board or audit committee, not IT management |
| What should the auditor do when denied access? | Rely on the charter, then escalate to the audit committee |
| Where is an outsourced engagement’s scope defined? | The engagement letter |
| What should the charter establish about reporting? | Functional reporting to the audit committee |
In short
- The audit charter is the document that sets up the audit function: its purpose, authority, responsibility and accountability.
- It's approved by the board or audit committee. That approval is where audit's authority comes from.
- It gives audit unrestricted access to records, systems, premises and people needed for audits.
- It sets the reporting lines: functional to the audit committee, administrative to senior management.
- It's short and high level, and should be reviewed regularly (usually annually).
- An engagement letter covers one specific audit, often by an external or outsourced provider. The charter covers the whole audit function.
Exam traps
- The charter does NOT contain the annual audit plan or detailed test steps.
- If an auditee refuses access, the auditor points to the charter first, then escalates.
- IT management or the CIO doesn't approve the charter. The board or audit committee does.
- A charter that hasn't been reviewed for years is a finding in itself.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What's in it
Charter, plan, engagement letter