Internal Audit Charter and Annual Plan Template (IIA GIAS, QAIP)

Internal Audit Charter and Annual Plan: [Organisation name], [Plan year]

Two linked documents for an internal audit function: the charter (mandate, independence, authority, scope and responsibilities, approved by the board or audit committee) and the annual risk-based internal audit plan, with a section on the quality assurance and improvement program (QAIP). The structure is aligned with the Institute of Internal Auditors (IIA) Global Internal Audit Standards (GIAS), published 2024-01-09 and effective from 2025-01-09, referenced by domain, principle and standard number only. Individual engagements are documented in the Internal Audit Engagement template (compliance/iia-internal-audit-engagement). ISO management-system audits under ISO 19011 are planned in the Internal Audit Program (compliance/internal-audit-program). The example organisation, Corvid Commerce Group, is fictional. Replace every [bracketed] value and every row marked Example. Obtain the standards and any applicable law for the normative text. This is a document format, not legal, audit or accounting advice.

Document control

Approvals

Revision history

Contents

• Part A. Internal audit charter
• 1. Purpose and mandate
• 2. Standards and commitment to conformance
• 3. Independence, reporting lines and objectivity
• 4. Authority and access
• 5. Scope of services
• 6. Roles and responsibilities
• Part B. Annual risk-based internal audit plan
• 7. Strategy and planning approach
• 8. Audit universe and risk assessment
• 9. Plan of engagements
• 10. Resources and budget
• 11. Coordination and reliance on other assurance
• 12. Topical Requirements applicability
• Part C. Quality and reporting
• 13. Quality assurance and improvement program
• 14. Reporting to the board and senior management
• 15. Approval, review and changes
• Glossary and references
• Standard and licence note

Part A. Internal audit charter

The charter below is written in the voice of the organisation. Adapt the governance terms: "board" means the board of directors or the audit committee to which the board has delegated oversight of internal audit, and "senior management" means the executive team led by the Chief Executive Officer.

1. Purpose and mandate

The purpose of internal audit at [Corvid Commerce Group plc] is to strengthen the organisation's ability to create, protect and sustain value by giving the board and senior management independent, risk-based and objective assurance, advice and insight on governance, risk management and control.

The board grants internal audit its mandate through this charter. The mandate covers all entities, functions, processes, systems and third-party arrangements of the group, including the subsidiaries in Germany, the United Kingdom, the United States and Vietnam (Example). Where law or a regulator requires internal audit for a specific entity, the function also meets that requirement and records it in section 2.

2. Standards and commitment to conformance

Internal audit conforms with the IIA Global Internal Audit Standards and any IIA Topical Requirements that apply to engagements in scope. Internal auditors also follow the ethics and professionalism principles of GIAS Domain II and the group Code of Conduct.

If laws or regulations prevent internal audit from conforming with any part of the standards, the CAE discloses the difference to the board, describes the alternative approach and its effect, and records it here. If the function does not conform for another reason, for example lack of resources, the CAE reports the nonconformance, its effect and the proposed correction to the board.

3. Independence, reporting lines and objectivity

The CAE reports functionally to the audit committee and administratively to the Chief Executive Officer (Example). The functional reporting line means that the audit committee:

• approves the charter, the risk-based plan and the internal audit budget and resource plan
• receives communications from the CAE on performance against the plan and on significant risks and control issues
• approves decisions on the appointment, removal and remuneration of the CAE
• meets the CAE in private session at least [four] times a year (Example)
• asks senior management and the CAE whether any scope or resource limitation exists

Internal audit has no operational responsibility for the activities it audits. Internal auditors do not design or operate controls, approve transactions, or implement recommendations. Where the CAE is asked to take on roles beyond internal audit (for example responsibility for compliance or enterprise risk management), the board approves the role and the safeguards, and an independent party audits those areas.

Internal auditors declare conflicts of interest annually and before each engagement. An auditor does not assess an activity for which they were responsible in the previous [12] months (Example). The CAE discloses any impairment of independence or objectivity, in fact or appearance, to the parties concerned and to the audit committee.

4. Authority and access

The audit committee authorises internal audit to have full, free and unrestricted access to all functions, records, data, systems, physical properties and personnel relevant to any engagement, subject to applicable law. Internal audit treats all information obtained with the same confidentiality as the owner of the information.

Personal data is processed for audit purposes in line with the group data protection policy and the records of processing (see GDPR Records of Processing, compliance/gdpr-ropa).

5. Scope of services

Internal audit provides:

• Assurance services: objective examinations of evidence leading to an independent conclusion on governance, risk management and control, including financial, operational, compliance, information technology, cybersecurity, data, third-party and sustainability reporting topics.
• Advisory services: work agreed with management to improve governance, risk management and control, such as reviewing control design for a new system. Advisory work does not include taking management responsibility.
• Investigations support: forensic analysis or fact-finding at the request of the audit committee, under the group investigation protocol and in line with the Whistleblowing Policy (compliance/whistleblowing-policy).

Assurance on financial reporting controls is coordinated with management's internal control over financial reporting assessment (see ICFR Management Assessment, compliance/icfr-management-assessment). Significant advisory work not in the approved plan requires CAE approval and is reported to the audit committee at its next meeting.

6. Roles and responsibilities

Part B. Annual risk-based internal audit plan

The 2027 plan (Example) was prepared in Q3 2026 from the audit universe, the group risk register, interviews with the executive team and the audit committee chair, and the results of 2026 engagements.

7. Strategy and planning approach

Summarise the internal audit strategy (three to five years) in a few sentences: the vision for the function, the capabilities it is building (for example data analytics or cybersecurity skills) and how coverage of the audit universe will evolve.

The planning steps are:

1. Update understanding of strategy, business model and change programmes.
2. Refresh the audit universe and map each auditable entity to the principal risks in the Risk Register (compliance/risk-register).
3. Score each entity with the method in section 8.
4. Consider mandatory and requested work, assurance from other providers and coverage of each principal risk.
5. Allocate hours within capacity, keep a contingency reserve and list what is deferred.
6. Discuss the draft with senior management and the audit committee, then obtain approval.

The plan is dynamic. The CAE reviews it every quarter and proposes changes when risks, the business or resources change.

8. Audit universe and risk assessment

Each auditable entity is scored from 1 (low) to 5 (high) on four factors. The weighted score is the sum of factor scores multiplied by their weights. Entities scoring 3.30 or more are audited in the plan year; lower scores are audited on a cycle of no more than [three] years or covered by other assurance (Example method, set your own).

The weights sum to 30 + 25 + 25 + 20 = 100%.

Worked check for AU-FIN-01: 5 x 0.30 + 3 x 0.25 + 4 x 0.25 + 4 x 0.20 = 1.50 + 0.75 + 1.00 + 0.80 = 4.05. Recompute every row when a score changes. AU-FIN-04 scored 4.20 when it entered the 2026 plan (change 5 after the ERP migration, time since last assurance 5); after the 2026 engagement it scores 4 x 0.30 + 3 x 0.25 + 3 x 0.25 + 1 x 0.20 = 2.90.

The cycle rule overrides the score. An entity with a time factor of 5 has gone three years or more without assurance and must be audited in the plan year, covered by other assurance that internal audit has evaluated, or reported to the audit committee as a coverage gap for explicit acceptance.

9. Plan of engagements

Check the total: 900 + 800 + 700 + 700 + 650 + 600 + 600 + 550 + 500 + 400 = 6,400 hours.

Principal risks not covered by internal audit in 2027 (Example):

• Payroll in the US and Vietnam (scored 3.15, time factor 5): exceeds the three-year cycle. The gap was accepted by the audit committee on YYYY-MM-DD (Example) on the basis of reliance on the payroll provider's SOC 1 type 2 report and the user-entity controls tested under ICFR; audit planned for Q1 2028.
• Customer refunds and chargebacks: covered by second-line monitoring; internal audit reviews the monitoring results in IA-2027-01.

Present the plan to the audit committee with a one-page heat map or table that maps each principal risk to the engagements and other assurance providers that cover it. State clearly which risks receive no assurance in the year, so that the committee can accept the gap or ask for more resources.

10. Resources and budget

Check: 10,320 - 2,064 = 8,256, and 6,400 + 400 + 300 + 356 + 800 = 8,256.

Skills gaps for 2027 (Example): cybersecurity testing and tax specialists are co-sourced for IA-2027-02 and IA-2027-05 within a budget of EUR [amount]. The CAE reports to the audit committee if resources become insufficient to deliver the plan or to meet the standards, and states the effect on assurance coverage.

11. Coordination and reliance on other assurance

Where internal audit relies on others, the CAE evaluates their competence, objectivity and due care and documents the basis. The CAE remains responsible for the conclusions internal audit gives.

12. Topical Requirements applicability

IIA Topical Requirements set minimum considerations for specific risk areas when they are in an engagement's scope or identified as significant in the risk assessment. As of 2026-10, the Cybersecurity Topical Requirement is effective (from 2026-02-05) and the Third-Party Topical Requirement was reported as effective from September 2026. Check the IIA for current requirements and effective dates.

Part C. Quality and reporting

The QAIP covers all aspects of the internal audit function, including conformance with the standards, achievement of the mandate and continuous improvement.

13. Quality assurance and improvement program

13.1 Internal assessments

• Ongoing monitoring: supervision and review of each engagement, standard workpaper checklists, and auditee feedback surveys.
• Periodic self-assessment: an annual review by a team member not involved in the sampled engagements, testing a sample of engagement files against the methodology and the standards.

13.2 External assessment

An external quality assessment is performed at least once every five years by a qualified, independent assessor or assessment team (meeting the qualification requirements of GIAS Standard 8.4, including at least one assessor who holds the Certified Internal Auditor designation), in the form agreed with the audit committee (full external assessment, or self-assessment with independent validation). The audit committee approves the scope and the assessor and receives the results directly.

13.3 Performance measures

13.4 Improvement actions

14. Reporting to the board and senior management

The audit committee report prepared by the board (see Audit Committee Report, finance/audit-committee-report) draws on these reports.

15. Approval, review and changes

The CAE reviews the charter at least annually and proposes changes to the audit committee. The plan is reviewed quarterly. Changes that add, remove or defer an engagement, or shift more than [10]% of planned hours (Example), are approved by the audit committee chair and ratified at the next meeting.

Glossary and references

References (check the current official versions):

• The Institute of Internal Auditors, Global Internal Audit Standards (2024), effective 2025-01-09: Domain II (ethics and professionalism), Domain III (Principles 6, 7 and 8), Domain IV (Principles 9, 10, 11 and 12). Cited by number only.
• IIA Topical Requirements: Cybersecurity (effective 2026-02-05) and Third-Party (reported effective September 2026).
• Vietnam, Decree 05/2019/ND-CP on internal audit (effective 2019-04-01); check the current text and local law.
• FRC, UK Corporate Governance Code (Provisions 25 and 29); US Exchange Act Rule 10A-3; NYSE Listed Company Manual 303A.07(c). Check the current versions.
• Related templates: Internal Audit Engagement (compliance/iia-internal-audit-engagement), Internal Audit Program, ISO 19011 (compliance/internal-audit-program), Risk Register (compliance/risk-register), Risk Methodology (compliance/risk-methodology), ICFR Management Assessment (compliance/icfr-management-assessment), Whistleblowing Policy (compliance/whistleblowing-policy), Audit Committee Report (finance/audit-committee-report).

Standard and licence note

Structure aligned with the IIA Global Internal Audit Standards (2024, effective 2025-01-09) and the IIA Topical Requirements, which are protected by copyright and are cited here by domain, principle and standard number only; no text from them is reproduced or paraphrased. The Vietnam decree is cited by number as public law. The charter wording, scoring method, capacity model and the Corvid Commerce Group plc example are original and fictional. Check the current official versions of the standards, any applicable law and supervisory guidance before use. This is a document format, not legal, audit or accounting advice. Template licence: MIT.