Foundations of internal auditing: purpose, authority, and services
Internal audit helps an organization understand whether its governance, risk management, and controls support its objectives. Its authority must be established, its role documented, and its work independent enough to report unwelcome findings. It evaluates and advises; management still runs the business.
Build the function before selecting a test
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Purpose | Connect the work to an organizational objective and the risks that threaten it. | Starting with a checklist before knowing what success looks like. |
| Mandate and charter | Establish authority and document responsibilities, positioning, and the services audit provides. | Assuming a department manager can redefine audit authority alone. |
| Service and accountability | Choose assurance or advisory work while keeping operational ownership outside audit. | Confusing access to records with authority to approve transactions. |
Purpose
Connect the work to an organizational objective and the risks that threaten it.
Avoid: Starting with a checklist before knowing what success looks like.
Mandate and charter
Establish authority and document responsibilities, positioning, and the services audit provides.
Avoid: Assuming a department manager can redefine audit authority alone.
Service and accountability
Choose assurance or advisory work while keeping operational ownership outside audit.
Avoid: Confusing access to records with authority to approve transactions.
A decision path you can use
- 1State the organizational objective
- 2Check authority and access
- 3Choose a service that answers the need
Understand the method
Work through the reasoning
Connect internal audit’s purpose to organizational objectives
Internal audit contributes an independent view of how an organization is governed, how it manages uncertainty, and whether its controls support its objectives. Begin with the objective rather than an isolated checklist. For a distributor, reliable deliveries depend on inventory information, supplier performance, and dispatch controls. An audit becomes useful when it explains how weaknesses in those arrangements threaten the delivery objective.
This perspective extends beyond checking accounting entries. Operational, technology, compliance, and culture-related matters can all affect objectives. The function needs authority, access, competence, and the ability to communicate unwelcome findings. A team can complete every planned checklist and still provide little value if its work ignores the organization’s important risks or cannot reach the people able to act.
Separate the mandate, charter, and engagement work program
The mandate establishes the function’s authority, role, and responsibilities. The charter records the arrangements that let it fulfill that mandate, including its position and reporting relationships, scope of services, and commitment to the applicable professional framework. A work program sits at a different level: it specifies procedures for a particular engagement. None of these documents substitutes for the others.
In a scenario, identify which document answers the question. A dispute about access to operational records concerns the function’s authority and charter. A question about whether to reconcile a shipment log concerns engagement procedures. Changing a work program cannot repair an inadequate mandate, and quoting the charter does not establish that a specific test was performed or that its evidence supports a conclusion.
Know what the board, management, and CAE contribute
The board provides oversight and authorizes the function’s position and authority. Senior management helps make the arrangements work across the organization. The chief audit executive translates the mandate into an effective function and communicates when conditions prevent its fulfillment. Board approval matters because the departments being reviewed should not unilaterally decide what internal audit may examine or report.
The CAE therefore needs more than a signature on a document. Access restrictions, inadequate resources, or incompatible responsibilities must be discussed through the established oversight channels. Management can contribute information and challenge factual accuracy without owning the auditor’s conclusion. Keep those roles distinct: audit evaluates and advises; management runs operations; the board oversees the organization and the audit function.
Choose a service that answers the stakeholder’s need
Assurance examines evidence against criteria and communicates a conclusion. Advisory work contributes advice, facilitation, or insight without taking operational responsibility. The same risk can prompt either service. A planned warehouse redesign may benefit from advisory comments about access controls; the live warehouse may later require assurance that access restrictions actually operate as intended.
Scope and evidence must follow the service. A workshop cannot prove quarterly control performance. Conversely, an assurance finding does not make audit the owner of the corrective action. The service choice should be explicit enough that recipients understand what they will receive, what they must decide themselves, and what uncertainties remain after the work is completed.
Recognize when the function cannot fulfill its purpose
A seemingly strong audit department may have weak foundations if management can suppress reports, remove difficult subjects from scope, or deny essential records. Independence is a practical condition, not a box on an organization chart. Competence matters too: formal access to a complex system has little value if the team cannot evaluate the evidence it obtains.
Look for the constraint that blocks the intended contribution. Resolve authority and access problems through the mandate and reporting structure; resolve skill gaps through staffing, support, or a justified change in work. Document the effect of unresolved constraints. Replacing missing evidence with optimistic wording produces a report, but it does not restore the function’s ability to provide useful assurance.
Original teaching example
Apply the method to a decision
The scenario
A warehouse director refuses to provide stock adjustment records, saying internal audit is only allowed to examine finance. The charter covers operational controls and grants access needed for audit work.
The decision
The CAE should address the access restriction using the established mandate and escalation channels.
The first issue is authority and access, not which inventory sample to select. Replacing the missing records with an informal conversation would leave the restriction unresolved and weaken the eventual conclusion.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A new subsidiary is missing from the charter discussion
The situation
A group acquires a logistics subsidiary. Its local management says the parent’s internal audit team may review finance but cannot examine dispatch operations. The group’s risk assessment identifies delivery disruption as a major exposure.
Reason through it
The CAE should clarify the mandate, applicable organizational arrangements, and access authority with the relevant oversight bodies. The risk is operational but still affects the group’s objectives. The team must establish an authorized basis for the work and assess its capabilities before planning detailed dispatch tests.
Take the decision
Resolve the authority and access question first. Then define an engagement that connects dispatch controls to delivery risk, rather than accepting finance-only coverage as equivalent assurance.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Is a mandate the same as an audit work program?
No. The mandate establishes the function’s authority and responsibilities. A work program describes procedures for a particular engagement, such as testing stock adjustments against approvals.
Does internal audit only review financial reporting?
No. Its authorized services can address operational, technology, compliance, and other risks affecting organizational objectives. The mandate, charter, risk assessment, and available capabilities determine appropriate coverage.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Foundations of Internal Auditing (35% of Part 1). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Domain I; Standards 6.1, 6.2, and 7.1. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 1: Internal Audit Fundamentals. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.