Internal Audit Guide: Charter, Annual Plan, Engagement Program and Report

Internal audit is an independent function inside (or contracted by) an organization that evaluates governance, risk management and control, and reports to the board. External auditors report on the financial statements; internal auditors report on whatever the board and management most need assurance about, from cash controls to grant compliance to IT access.

CPA firms meet internal audit from both sides: as the external auditor deciding whether to use internal audit's work, and as the provider of outsourced or co-sourced internal audit services to nonprofits, local governments and private companies without their own department. This guide covers the framework, the four core documents (charter, plan, program, report), the follow-up cycle and how internal audit relates to the external audit.

The standards: Global Internal Audit Standards

The Institute of Internal Auditors (IIA) issued the Global Internal Audit Standards in January 2024, effective January 9, 2025. They replaced the 2017 International Standards for the Professional Practice of Internal Auditing within the IIA's framework. The Standards are organized into five domains and 15 principles:

An internal audit function that claims conformance must follow them. A function that does not, such as a part-time reviewer at an owner-managed company, still benefits from the structure.

The internal audit charter

Standard 6.2 requires a charter. The charter is a formal document that defines the function's mandate, organizational position, reporting lines, scope of work, types of services and authority, and it recognizes the purpose of internal auditing and the commitment to follow the Standards. The board approves the charter, and it is reviewed periodically.

A usable charter for a small organization covers:

1. Purpose and mandate: assurance and advisory services over governance, risk and control.
2. Independence: the chief audit executive reports functionally to the board or audit committee and administratively to a senior executive.
3. Authority: unrestricted access to records, people and property relevant to the work.
4. Scope: all operations and entities, including outsourced functions.
5. Commitment to the Standards.
6. Reporting responsibilities to the board.
7. Limits: internal audit does not assume management responsibilities.

The risk-based annual plan

Standard 9.4 covers the internal audit plan. The chief audit executive builds a plan that considers the mandate and the full range of agreed services, discusses it with the board and senior management, and obtains board approval for the plan and significant changes during the year.

Building the plan

1. Define the audit universe: processes, entities, systems and compliance areas.
2. Assess risk for each unit: financial exposure, change since last review, complexity, fraud risk, regulatory pressure, prior findings and time since last audit. The risk register template works as the working record.
3. Check coverage against the organization's key risks and the board's concerns, not just last year's plan.
4. Size the work against available hours.
5. Reserve capacity for special requests, follow-up and investigations.

Illustrative plan

A nonprofit with a $9 million budget has one internal auditor and a co-sourced CPA firm, for 1,200 hours a year. Planning, administration and training take 20 percent, or 240 hours, leaving 960 hours for engagements:

The sum is 240 + 200 + 180 + 160 + 180 = 960. If the board asks for a fraud investigation mid-year, the plan changes, and the board approves the change.

The engagement work program

Each engagement is planned before fieldwork. Planning under Principle 13 covers communicating with those responsible for the area, assessing the risks in the area under review, setting objectives and scope, identifying evaluation criteria and resources, and developing a work program. Standard 13.6 addresses the work program. A work program lists the procedures that will meet the engagement objectives, with sample sizes, sources and workpaper references.

A procurement program might include:

• Obtain the procurement policy and thresholds and compare them to law and grant terms.
• Select a sample of purchases above the competitive threshold and test for quotes, approvals and conflict-of-interest declarations.
• Test vendor master changes for authorization and independent review.
• Compare vendor addresses and bank accounts to employee records.
• Reperform three-way matching for a sample.

Procedures are chosen to address specific risks. For techniques, see audit sampling and audit evidence.

Findings and the internal audit report

Each finding is built from the same elements: the criteria (what should be happening), the condition (what is happening), the cause, the effect or risk, and a recommendation. The audit finding sheet template uses that layout.

A report to management and the board usually has:

1. Engagement objective and scope.
2. Overall conclusion or rating.
3. Findings, ranked by significance, each with criteria, condition, cause, effect and recommendation.
4. Management's response, owner and target date.
5. Positive observations where they matter to the board.

Standard 15.1 covers the final engagement communication. Keep it short enough that a board member reads the conclusion and top findings in two minutes, with detail behind it.

Follow-up

Standard 15.2 covers confirming the implementation of recommendations or action plans. Track every finding to closure: owner, date, evidence of completion, and the auditor's re-test where the risk is high. Overdue high-risk actions go to the board. A tracker that shows aging by rating is the board's best view of whether internal audit leads to change.

Internal audit vs external audit

For a fuller comparison, see internal audit vs external audit. The short version:

The external auditor may use internal audit's work, and in some cases use internal auditors to provide direct assistance, under AU-C 610. The external auditor remains solely responsible for the opinion. See relying on internal audit under AU-C 610 and direct assistance.

When a CPA firm provides internal audit

A firm that provides internal audit services to an attest client performs a nonattest service. It must not assume management responsibilities, and the client must designate someone with suitable skill, knowledge or experience to oversee the service. The independence and nonattest services guide covers the requirements. Document the arrangement in an engagement letter that makes clear management owns the remediation.

Common mistakes

• A plan that repeats last year's list without a fresh risk assessment.
• No board approval of the plan or charter.
• Findings without a cause, so recommendations treat symptoms.
• Reports with ratings but no definitions of the rating scale.
• No follow-up on prior findings.
• Internal audit approving or operating the controls it later reviews.

FAQ

What is an internal audit?

An independent, objective evaluation of an organization's governance, risk management and controls, reported to the board and management.

Who sets internal audit standards?

The Institute of Internal Auditors, through the Global Internal Audit Standards, effective January 9, 2025.

How is an internal audit plan different from an external audit plan?

The internal audit plan is a risk-based plan across the organization's operations and controls, approved by the board. The external audit plan is built to support an opinion on the financial statements.

Does a small organization need internal audit?

No law requires it for most private organizations. Some lenders, grantors and boards ask for one, and outsourced or co-sourced models make it practical for small entities.

Can the external auditor also do internal audit for the same client?

For an attest client, it is a nonattest service that can be provided only if the requirements are met and management responsibilities stay with the client.

Sources

• The Institute of Internal Auditors, Global Internal Audit Standards: five domains, 15 principles; Standards 6.2 (charter), 9.4 (plan), 13.6 (work program), 15.1 (final engagement communication) and 15.2 (confirming implementation)
• The Institute of Internal Auditors, Global Internal Audit Standards, issued January 9, 2024, effective January 9, 2025 (Baker Tilly and KPMG summaries)
• AICPA, AU-C section 610, Using the Work of Internal Auditors
• AICPA, Code of Professional Conduct, ET 1.295 (Nonattest Services)

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error