IT Audit Charter: Purpose, Scope, and Authority
Learn what an IT audit charter is, what it should contain, and why it is critical for IS audit independence. Essential CISA exam knowledge.
The Foundation of the Audit Function
The IT audit charter is a formal document that defines the purpose, authority, and responsibility of the IS audit function within an organization. It is the foundational governance document that establishes the audit function's mandate and independence. For CISA exam candidates, understanding the charter's role and contents is essential.
Purpose of the Audit Charter
The audit charter serves several critical functions:
- Establishes legitimacy: The charter formally authorizes the audit function to perform its work within the organization.
- Defines independence: By specifying reporting relationships and organizational placement, the charter supports the audit function's independence from the areas it audits.
- Sets expectations: The charter communicates the audit function's role to management, staff, and stakeholders.
- Provides authority: The charter grants the audit function the right to access people, systems, records, and facilities necessary to conduct audits.
Key Components of an Audit Charter
A well-drafted IT audit charter should include the following elements:
Mission and Objectives
A clear statement of the audit function's mission, which typically centers on providing independent, objective assurance and consulting services that add value and improve the organization's operations.
Scope of Activities
The charter should define the scope of the audit function's activities, including:
- The types of audits performed (compliance, operational, financial, IT, integrated)
- The areas and systems subject to audit
- Any limitations on scope (though ideally, the charter should grant unrestricted scope)
Authority and Access
The charter must explicitly grant the audit function:
- Unrestricted access to all records, personnel, physical properties, and IT systems relevant to audit activities.
- Authority to allocate resources, set frequencies, select subjects, determine scope, and apply techniques necessary to accomplish audit objectives.
- The right to obtain necessary assistance from personnel in areas being audited.
Reporting Relationships
The charter should specify:
- Functional reporting: The Chief Audit Executive (CAE) should report functionally to the audit committee or board of directors. This relationship supports independence by ensuring the audit function is not subordinate to the areas it audits.
- Administrative reporting: The CAE typically reports administratively to the CEO or equivalent senior executive for day-to-day operational matters.
Independence and Objectivity
The charter should affirm the audit function's independence from the activities it audits and the objectivity of its staff. It should state that auditors will have no operational responsibility or authority over the activities they review.
Accountability
The charter should describe how the audit function is held accountable, including periodic reporting to the audit committee on audit plan progress, significant findings, and resource adequacy.
Approval and Review
The audit charter should be:
- Approved by the audit committee or board: This high-level approval reinforces the charter's authority and the audit function's organizational standing.
- Reviewed periodically: The charter should be reviewed at least annually and updated as needed to reflect changes in the organization, regulatory environment, or professional standards.
- Communicated broadly: The charter should be shared with management and staff so that everyone understands the audit function's role and authority.
CISA Exam Focus
The CISA exam frequently tests knowledge about the audit charter. Key points to remember: the charter is a mandatory requirement under ISACA standards; it must be approved by the highest level of authority (typically the audit committee or board); it should grant unrestricted access to information and personnel; and it establishes the organizational independence of the audit function. If presented with a scenario where the audit function lacks a charter or where the charter restricts access, recognize this as a significant governance deficiency.