Editor’s note: NeuGroup’s online communities provide members a forum to pose questions and give answers. Talking Shop shares valuable insights from these exchanges, anonymously. Send us your responses: [email protected].
Context: International standards followed by The Institute of Internal Auditors (IIA) require that companies review their internal audit (IA) charters annually. An IA charter provides organizations with a “blueprint for how IA will operate” and helps audit committees (ACs) “clearly signal the value” they place on IA’s independence, according to the IIA. The professional association says an IA charter should at a minimum define.
- IA’s purpose within the organization.
- IA’s authority.
- IA’s responsibility.
- IA’s position within the organization.
One thing the IIA does not specify, however: an ideal number of pages for an IA charter. So one member of NeuGroup for Internal Audit Executives reached out to his peers to benchmark:
Member question: “How many pages is your IA charter? Our old one was eight pages, and my team submitted a draft for 16 pages, pulling from the IIA standards. This seems like overkill and we reduced it to six pages—now under review—but I wanted to compare with others.”
NeuGroup Insights asked the member why the length of an IA matters. “Since the IA Charter is the basis for managing the relationship of IA with the Standards and with the audit committee, it needs to be crisp and to the point,” he wrote.
- “It is like a policy of sorts; the larger the policy the more one has to comply with. But largely, I would not want to give my AC chairman or CFO a 16-page document to read word for word, when the point can normally be made in four or so pages.”
Peer answers on IA charter length, ten respondents:
- Seven pages: 20%
- Four pages: 30%
- Three pages: 40%
- Two pages: 10%
Elaboration from members who answered seven pages:
- “We also have an appendix with the charter matrix that includes our charter deliverables and time frames for each deliverable.”
- “The last page is mostly the signatures. We modeled it after the IIA’s standard and had just completed the [external quality assessment or EQA], and got some advice and feedback from that review as well.”
EQA context: The IIA says an IA charter should require the chief audit executive to periodically report the results of its quality assurance and improvement program to senior management and the AC, and to obtain an external quality assessment (EQA) of the activity at least once every five years.
- The member who asked the charter questioned explained: “The primary reason to have this EQA is so that, in the AC charter and the audit reports, you can reference that you are in compliance with the IIA standards and conduct audits accordingly, professionally. It adds credibility to the quality of the work.”
