Governance Design

The Internal Audit Charter

The governance document that defines everything else -- and why most charters are not doing that job.

Why the charter matters What employee ownership changes What a modern charter must include The annotated framework Keeping it current

Key takeaways — read this first

The charter establishes every authority the CAE needs to operate -- unrestricted data access, independence, AI and automated process scope, and direct audit committee access. Authorities not named in the charter are not protected.
In an employee-owned company, ESOP plan administration, valuation input controls, and fiduciary oversight belong explicitly in audit scope.
CAE administrative reporting to the CFO is workable -- but requires three explicit charter safeguards: audit committee authority over CAE appointment and removal, unrestricted direct committee access, and equal coverage of finance and accounting.
The charter must be reviewed and approved by the audit committee annually. A charter last updated before 2024 is already out of alignment with current IIA Standards.
The annotated framework on this page provides ready-to-use language for each charter section with governance reasoning.

Why the Charter Matters More Than Most Functions Treat It

The internal audit charter is the governance document that establishes the CAE's authority to do everything the modern role requires -- unrestricted access to data and systems, independence from management in scope decisions, the right to audit automated and AI-driven processes, and direct access to the audit committee. It is not administrative paperwork. It is the foundation every other function capability depends on.

The 2024 IIA Global Internal Audit Standards are explicit: the charter must be reviewed and approved by the board or audit committee at least annually. A charter that has not been updated since the last standards revision does not reflect the authorities the function currently needs. In a modernizing organization navigating digital transformation, ERP transition, and AI governance responsibilities, an authority that is not named in the charter is an authority that can be walked back -- one access denial, one scope conversation at a time.

A charter that does not explicitly establish those authorities does not protect them. And in a modernizing function navigating enterprise transition, digital transformation, and growing advisory responsibilities, an unprotected authority is an authority that management or IT or finance can informally walk back -- one access denial, one scope conversation, one "that's not really an audit issue" at a time.

The charter is the CAE's governance tool. Treating it that way means reviewing it annually, updating it when standards change, and presenting it to the audit committee as a living document rather than a historical artifact.

IIA 2024 Standards requirement

The 2024 Global Internal Audit Standards require the internal audit charter to be reviewed and approved by the board or audit committee at least annually. If your charter has not been reviewed since the last standards update, it is already out of alignment.

What Employee Ownership Changes

Most charter guidance is written for publicly traded companies, where the audit committee's primary accountability runs to external shareholders. Employee-owned companies -- and ESOP structures in particular -- have a different accountability picture, and it changes what the charter needs to say.

In an employee-owned company, the employees are the shareholders. Their retirement security is directly tied to the company's financial integrity, operational performance, and the accuracy of the annual ESOP valuation. That raises the stakes on audit independence and the quality of financial oversight considerably -- not as an abstract governance principle, but as a direct fiduciary obligation to the people who own the business.

The ESOP structure introduces three specific considerations that most boilerplate charters do not address:

Consideration 1

ESOP plan administration belongs in audit scope

The charter should explicitly include ESOP plan administration, trustee process integrity, and the controls around annual valuation inputs. These are not incidental -- they are among the highest-consequence processes the audit function can touch. The employees whose wealth depends on those processes deserve the same rigorous coverage as any other high-risk area.

Consideration 2

The CAE's governance positioning matters more, not less

In a public company, the audit committee's independence is reinforced by SEC requirements and stock exchange listing rules. In an employee-owned company, those external reinforcements are absent or reduced. The charter is often the primary governance document that establishes the CAE's independence, the audit committee's authority, and the function's organizational positioning. It has to do more work than in a publicly traded structure.

Consideration 3

The CFO reporting line requires explicit independence safeguards

CAE administrative reporting to the CFO is common in employee-owned companies and is a workable structure -- but the charter must be explicit about what that reporting line does and does not authorize. The CFO's organization is within audit scope. The audit committee, not the CFO, holds authority over the CAE's appointment, performance evaluation, and removal. The CAE has direct, unrestricted access to the audit committee independent of the administrative reporting line. All three of those points should be named in the charter, not implied.

ERISA fiduciary context

ESOP trustees and plan administrators carry ERISA fiduciary duties. An internal audit function that provides credible assurance over ESOP plan administration and valuation process integrity is directly supporting those obligations -- and the charter should reflect that scope.

What a Modern Charter Must Include

The following elements represent the minimum scope for a charter aligned to IIA 2024 Standards in an employee-owned company with a modernizing audit function. Each one addresses a gap that commonly appears in inherited or outdated charters.

Element 1

Purpose and Authority

A clear statement of the function's purpose: to provide independent, objective assurance and advisory services that add value and improve the organization's operations. The charter should establish the CAE's authority to access all records, personnel, and systems necessary to perform audit work -- without qualification, exception, or the requirement to route requests through management. "Access as needed" is not sufficient. The authority must be stated as unrestricted.

Element 2

Organizational Independence

The charter must establish two distinct reporting lines and name them explicitly. The CAE reports administratively to the CFO for day-to-day operational purposes. The CAE reports functionally to the audit committee -- meaning the committee holds authority over the CAE's appointment, compensation, performance evaluation, and removal. The CAE has direct, unrestricted access to the audit committee and board at any time, without CFO involvement or approval. This is not a courtesy. It is an independence safeguard, and it must be documented.

Element 3

Scope of Services

The charter should define both assurance and advisory services within scope, with explicit language that advisory engagements do not impair independence when appropriate safeguards are in place. Scope should name the categories of risk and process the function is authorized to cover -- financial, operational, compliance, technology, and strategic. In an employee-owned company, ESOP plan administration and fiduciary process oversight should be named explicitly as within scope.

Element 4

Technology and Data Access

A modern charter explicitly addresses technology scope. The function is authorized to audit automated controls, IT general controls, ERP system configurations, data governance practices, and AI-driven or algorithmic decision processes. Access to enterprise systems, data warehouses, and operational data is unrestricted and does not require individual approval from IT or management for each engagement. This language is increasingly important as organizations deploy more automated and AI-driven processes -- and as the audit function's value depends on its ability to provide assurance over those systems. In an organization running AI-driven tools on top of its ERP data layer, the charter should explicitly extend audit's technology scope to include data completeness assurance -- independent validation of migration integrity, master data governance, and the data inputs feeding automated and AI-driven decision systems. This scope is not implicit. It should be named.

Element 5

ESOP and Fiduciary Scope

In an employee-owned company, the charter should explicitly include ESOP plan administration, trustee process oversight, valuation input controls, and related fiduciary processes within audit scope. The rationale is simple: the employees are the shareholders, and the processes that determine the value and integrity of their ownership stake deserve the same rigorous coverage as any other high-risk area. This is not standard language in most boilerplate charters -- which is exactly why it needs to be added deliberately.

Element 6

Quality Assurance and Improvement Program

IIA 2024 Standards require a quality assurance and improvement program (QAIP) that covers ongoing monitoring, periodic internal assessments, and external quality assessments on a defined cycle. The charter should authorize the QAIP and establish the CAE's responsibility to report its results to the audit committee. External quality assessments -- conducted by a qualified independent reviewer at least once every five years per IIA Standards -- should be named explicitly.

Element 7

Independence Impairment Disclosure

When the CAE's independence or objectivity is impaired -- by scope limitations, resource constraints, management interference, or conflicts of interest -- the charter should require disclosure to the audit committee. This is a Standards requirement and a governance safeguard. The disclosure mechanism should be named in the charter, not left to informal judgment.

The Annotated Charter Framework

The framework below shows each major section of a modern internal audit charter, the language that belongs in it, and the governance reasoning behind it. It is designed for CAEs who need to draft, update, or present a charter aligned to IIA 2024 Standards in an employee-owned company context. Adapt the specifics to your organization -- the structure and the reasoning should hold across most small-to-mid-size functions.

Section 1: Purpose and Mission

Charter language: "The Internal Audit function exists to provide independent, objective assurance and advisory services designed to add value and improve [Organization]'s operations. The function assists the organization in accomplishing its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of governance, risk management, and internal controls."

Why this language matters: This is a direct adaptation of the IIA definition of internal auditing. It establishes both assurance and advisory as within scope from the outset -- which matters later when the function is asked to provide consulting services on a process redesign or a new system implementation. If the charter only authorizes assurance work, advisory services create an ambiguity that management can use to limit the function's involvement.

Section 2: Authority and Access

Charter language: "The Chief Audit Executive and members of the internal audit function are authorized unrestricted access to all functions, records, systems, property, and personnel of [Organization] necessary to accomplish audit objectives. This access includes but is not limited to financial systems, operational systems, enterprise resource planning platforms, data warehouses, human capital management systems, and any AI-driven or automated decision systems. Access is not subject to management approval on an engagement-by-engagement basis."

Why this language matters: "Access as needed" or "access subject to management approval" creates a process through which access can be delayed, narrowed, or denied without formal objection. Unrestricted access language, by contrast, makes any access limitation a charter deviation that must be disclosed to the audit committee. This distinction matters most during ERP transitions, when data structures change and IT teams may informally restrict access during stabilization periods.

In a modernizing organization, this access authority should be understood to extend explicitly to data completeness validation -- including access to migration logs, master data change histories, data quality reporting, and the input data layers feeding AI-driven systems. An access authority that does not cover these domains is materially incomplete for a function operating in a digital transformation environment.

Section 3: Independence and Organizational Positioning

Charter language: "The Chief Audit Executive reports administratively to the Chief Financial Officer. The Chief Audit Executive reports functionally to the Audit Committee of the Board of Directors. The Audit Committee holds authority over the appointment, compensation, performance evaluation, and removal of the Chief Audit Executive. The Chief Audit Executive has direct, unrestricted access to the Audit Committee and the full Board of Directors at any time and without CFO involvement or approval. Any scope limitations, resource constraints, or organizational impediments to audit independence shall be disclosed to the Audit Committee directly by the Chief Audit Executive."

Why this language matters: In an employee-owned company, the independence safeguards that public companies receive from external regulatory requirements must be built explicitly into the charter. Each sentence above addresses a specific failure mode: CFO control over the CAE appointment process, CFO as a gatekeeper to the audit committee, and undisclosed scope limitations. None of these protections can be implied -- they must be stated.

Section 4: Scope of Services

Charter language: "The internal audit function is authorized to perform assurance and advisory services across all organizational processes, functions, and entities, including but not limited to: financial reporting and controls, operational processes, compliance with laws and regulations, information technology and cybersecurity, enterprise systems and automated controls, AI-driven and algorithmic decision processes, ESOP plan administration and fiduciary processes, and strategic and emerging risk areas. Advisory services may be performed where they do not impair the function's independence or objectivity."

Why this language matters: Naming ESOP plan administration and AI-driven processes explicitly closes two gaps that most inherited charters have. ESOP scope language ensures the function has clear authority to review valuation inputs, trustee process integrity, and plan administration controls -- processes directly tied to employee retirement security. AI and automated process language ensures the function is not limited to auditing manual controls in a world where most consequential decisions are increasingly automated.

Section 5: Reporting and Communication

Charter language: "The Chief Audit Executive shall report audit results, findings, and recommendations to the Audit Committee at each regularly scheduled committee meeting. The Chief Audit Executive shall report to executive management on operational matters as appropriate. The Chief Audit Executive shall immediately report to the Audit Committee any significant risk exposures, control failures, governance concerns, fraud indicators, or instances where management has not accepted audit findings in a manner the CAE believes is prudent."

Why this language matters: The immediate escalation clause is the most important sentence in this section. Without it, the CAE has no chartered obligation to surface unresolved governance concerns until the next scheduled committee meeting -- which may be months away. The clause establishes a direct escalation path that exists independent of the administrative reporting relationship.

Section 6: Quality Assurance and Improvement Program

Charter language: "The Chief Audit Executive shall establish and maintain a quality assurance and improvement program that covers all aspects of internal audit activity. The program shall include ongoing performance monitoring, periodic internal assessments, and external quality assessments conducted by a qualified independent reviewer at least once every five years. Results of quality assessments shall be reported to the Audit Committee."

Why this language matters: The QAIP requirement is explicit in IIA 2024 Standards. Including it in the charter elevates it from a best practice to a chartered obligation -- and creates accountability to the audit committee for maintaining it. External quality assessments are particularly important in employee-owned companies where there is no public market scrutiny or external regulatory review of the audit function's effectiveness.

Section 7: Charter Review and Amendment

Charter language: "This charter shall be reviewed by the Chief Audit Executive and approved by the Audit Committee at least annually. Amendments require Audit Committee approval. The Chief Audit Executive shall present the charter to the Audit Committee at the first meeting of each fiscal year, noting any proposed changes and the basis for them."

Why this language matters: Annual review language transforms the charter from a static document into a living governance tool. It also creates a natural cadence for the CAE to demonstrate current knowledge of IIA Standards, emerging risk areas, and the organization's evolving needs -- which is itself a governance signal about the quality of audit leadership.

Keeping the Charter Current

A charter that accurately reflected best practice five years ago may be meaningfully out of alignment today. The 2024 IIA Global Internal Audit Standards introduced new requirements, new language, and new expectations around technology, AI governance, and quality assurance that most charters written before 2024 do not address.

In an employee-owned company, the charter's annual review is also an expression of the organization's long-term orientation. A charter that reflects current standards, current technology scope, and current organizational structure is the governance document of a function designed to protect the business for the next decade -- not just satisfy this year's external review.

The annual review process is not a compliance exercise. It is the mechanism by which the CAE demonstrates to the audit committee that the function's governing document is current, that its authorities are adequate for the work the function is being asked to do, and that the CAE understands the standards well enough to apply them.

A practical annual review checklist:

Check 1

Does the charter reference the 2024 IIA Global Internal Audit Standards by name and effective date?

Check 2

Does the access authority language cover AI-driven systems and automated decision processes, not just traditional financial and operational systems?

Check 3

Does the scope section explicitly include ESOP plan administration and fiduciary process oversight?

Check 4

Does the independence section name both reporting lines explicitly and establish the audit committee's authority over CAE appointment and removal?

Check 5

Does the charter include the quality assurance and improvement program requirement with external quality assessment language?

Check 6

Has the charter been presented to the audit committee for formal approval in the current fiscal year?

First charter or full rewrite?

If the function does not have a current charter -- or if the existing charter is more than three years old and has not been updated -- a full rewrite aligned to IIA 2024 Standards is more efficient than attempting to patch outdated language. The annotated framework above is designed to support that process.

If the answer to any of the checklist items is no

The charter needs to be updated before the next committee meeting -- not at the next annual review cycle.

The charter is the governance foundation.

Everything the modern audit function is asked to do -- assurance over AI systems, advisory during ERP transition, ESOP fiduciary oversight -- requires the authority to do it. The charter is where that authority lives.

Build the function around the right structure

Build the function around the right structure -- roles, reporting lines, and the governance case for a CAE.

Go to Team Structure →

Read the methodology playbook

The four-pillar leadership playbook for redesigning assurance during enterprise transition -- from stabilization through execution discipline.

Go to Methodology →