# Internal Audit Charter and Annual Plan: [Organisation name], [Plan year]

> Two linked documents for an internal audit function: the charter
> (mandate, independence, authority, scope and responsibilities, approved
> by the board or audit committee) and the annual risk-based internal
> audit plan, with a section on the quality assurance and improvement
> program (QAIP). The structure is aligned with the Institute of Internal
> Auditors (IIA) Global Internal Audit Standards (GIAS), published
> 2024-01-09 and effective from 2025-01-09, referenced by domain,
> principle and standard number only. Individual engagements are
> documented in the Internal Audit Engagement template
> (`compliance/iia-internal-audit-engagement`). ISO management-system
> audits under ISO 19011 are planned in the Internal Audit Program
> (`compliance/internal-audit-program`). The example organisation, Corvid
> Commerce Group, is fictional. Replace every `[bracketed]` value and
> every row marked *Example*. Obtain the standards and any applicable law
> for the normative text. This is a document format, not legal, audit or
> accounting advice.

<!--
Guidance: How to use this template
- Part A (charter) is approved by the board or audit committee and
  reviewed at least annually. Part B (annual plan) is approved each
  year and whenever it changes significantly. Part C (QAIP) describes
  how the function checks its own quality.
- Under GIAS the board provides the mandate (Domain III), and the Chief
  Audit Executive (CAE) documents it in the charter. Agree the mandate
  with the audit committee chair before drafting the details.
- Check whether law adds requirements. Examples as of 2026-10: banks and
  insurers under EU prudential rules and supervisory guidelines, US
  listed companies under stock exchange listing rules, and listed
  companies and state-owned enterprises in Vietnam under Decree
  05/2019/ND-CP. Check local law for each subsidiary.
- GIAS is copyrighted by the IIA. Cite standard numbers in your
  methodology; do not copy requirement text into this file.
- Common pitfall: a plan that lists audits by rotation without showing
  how each one links to the organisation's strategy and risks, and
  without showing which significant risks are not covered.
-->

## Document control

<!-- Guidance: The charter and plan are board documents. Record board or audit committee approval dates in the approvals table because external quality assessors and regulators ask for them first. -->

| Field | Value |
|---|---|
| Document ID | [IA-CHARTER-PLAN-2027] *(Example)* |
| Organisation | [Corvid Commerce Group plc] *(Example, fictional: listed in London, American Depositary Shares in New York, Form 20-F filer)* |
| Plan year | [2027] *(Example)* |
| Charter version | [3.0] *(Example)* |
| Version | [1.0] |
| Status | [Draft / Approved by audit committee / Superseded] |
| Owner | [@chief-audit-executive] |
| Approvers/reviewers | [Audit committee], [@chief-executive-officer], [@group-cfo] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] (charter may be published internally) |
| Next charter review | YYYY-MM-DD |
| Standards followed | IIA Global Internal Audit Standards (2024); IIA Topical Requirements as applicable |

### Approvals

| Item | Approved by | Meeting reference | Date |
|---|---|---|---|
| Internal audit charter | Audit committee | [AC-2026-04, item 6] *(Example)* | YYYY-MM-DD |
| Annual risk-based plan 2027 | Audit committee | [AC-2026-04, item 7] *(Example)* | YYYY-MM-DD |
| Budget and resource plan | Audit committee | [AC-2026-04, item 7] *(Example)* | YYYY-MM-DD |
| Plan changes during the year | Audit committee chair, ratified at next meeting | [Reference] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@author] | Draft charter update and risk assessment |
| 0.2 | YYYY-MM-DD | [@author] | Stakeholder consultation incorporated |
| 1.0 | YYYY-MM-DD | [@author] | Approved by audit committee |
| 1.1 | 2026-10-25 | [@author] | *Example:* Listed-company requirements added to the mandate; AU-FIN-04 added to the universe; payroll cycle gap recorded; KPI-01 aligned with the 2026 plan of 12 engagements |

## Contents

- [Part A. Internal audit charter](#part-a-internal-audit-charter)
- [1. Purpose and mandate](#1-purpose-and-mandate)
- [2. Standards and commitment to conformance](#2-standards-and-commitment-to-conformance)
- [3. Independence, reporting lines and objectivity](#3-independence-reporting-lines-and-objectivity)
- [4. Authority and access](#4-authority-and-access)
- [5. Scope of services](#5-scope-of-services)
- [6. Roles and responsibilities](#6-roles-and-responsibilities)
- [Part B. Annual risk-based internal audit plan](#part-b-annual-risk-based-internal-audit-plan)
- [7. Strategy and planning approach](#7-strategy-and-planning-approach)
- [8. Audit universe and risk assessment](#8-audit-universe-and-risk-assessment)
- [9. Plan of engagements](#9-plan-of-engagements)
- [10. Resources and budget](#10-resources-and-budget)
- [11. Coordination and reliance on other assurance](#11-coordination-and-reliance-on-other-assurance)
- [12. Topical Requirements applicability](#12-topical-requirements-applicability)
- [Part C. Quality and reporting](#part-c-quality-and-reporting)
- [13. Quality assurance and improvement program](#13-quality-assurance-and-improvement-program)
- [14. Reporting to the board and senior management](#14-reporting-to-the-board-and-senior-management)
- [15. Approval, review and changes](#15-approval-review-and-changes)
- [Glossary and references](#glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## Part A. Internal audit charter

<!-- Guidance: The charter is the formal agreement between the board and the internal audit function. Write it so that a new board member or a new CAE can understand the function's mandate without other documents. -->

The charter below is written in the voice of the organisation. Adapt
the governance terms: "board" means the board of directors or the audit
committee to which the board has delegated oversight of internal audit,
and "senior management" means the executive team led by the Chief
Executive Officer.

## 1. Purpose and mandate

<!-- Guidance: Purpose: state why the function exists and what the board expects (GIAS Domain I and Principle 6). Questions: what assurance does the board want, on which risks, and what advisory role is acceptable? Pitfall: a generic purpose statement that does not mention the organisation's strategy or risks. -->

The purpose of internal audit at [Corvid Commerce Group plc] is to
strengthen the organisation's ability to create, protect and sustain
value by giving the board and senior management independent,
risk-based and objective assurance, advice and insight on governance,
risk management and control.

The board grants internal audit its mandate through this charter. The
mandate covers all entities, functions, processes, systems and
third-party arrangements of the group, including the subsidiaries in
Germany, the United Kingdom, the United States and Vietnam *(Example)*.
Where law or a regulator requires internal audit for a specific entity,
the function also meets that requirement and records it in section 2.

| Mandate element | Content *(Example)* |
|---|---|
| Board expectation | Independent assurance that the principal risks in the risk register are managed within appetite, with priority on revenue integrity, cybersecurity, data protection and third-party risk |
| Advisory role | Advice on control design for major change programmes (ERP, AI features) when it does not impair independence |
| Legal or regulatory requirements | No law requires the group to have an internal audit function as of 2026-10, but its oversight is part of the listed-company framework: UK Corporate Governance Code Provisions 25 (audit committee monitors and reviews the internal audit function) and 29 (board declaration on material controls), comply or explain; SOX 404 and Exchange Act Rule 10A-3 as a Form 20-F filer; the NYSE internal audit function requirement in Listed Company Manual 303A.07(c) generally does not apply to foreign private issuers (check); Vietnam Decree 05/2019/ND-CP not applicable. Check local law for each subsidiary |
| Exclusions | None; any future exclusion requires audit committee approval and disclosure |

## 2. Standards and commitment to conformance

<!-- Guidance: Purpose: commit the function to the standards and say what happens when it cannot conform (GIAS Standards 4.1 and 6.2). Questions: which standards, which laws and which internal policies apply? Pitfall: claiming conformance in reports without the QAIP evidence to support it. -->

Internal audit conforms with the IIA Global Internal Audit Standards
and any IIA Topical Requirements that apply to engagements in scope.
Internal auditors also follow the ethics and professionalism
principles of GIAS Domain II and the group Code of Conduct.

If laws or regulations prevent internal audit from conforming with any
part of the standards, the CAE discloses the difference to the board,
describes the alternative approach and its effect, and records it here.
If the function does not conform for another reason, for example lack
of resources, the CAE reports the nonconformance, its effect and the
proposed correction to the board.

| Requirement | Source | Applies to | Status *(Example)* |
|---|---|---|---|
| IIA Global Internal Audit Standards | IIA, effective 2025-01-09 | Whole function | Conformance claimed, supported by QAIP |
| IIA Topical Requirement: Cybersecurity | IIA, effective 2026-02-05 | Engagements covering cybersecurity | Applied, see section 12 |
| IIA Topical Requirement: Third-Party | IIA, effective September 2026 as reported in 2026-10 | Engagements covering third parties | Applied from 2027 plan |
| Internal audit requirement for listed companies and SOEs | Vietnam Decree 05/2019/ND-CP | Not applicable to Corvid Commerce Vietnam LLC (not listed, not state-owned); check local law | Not applicable |

## 3. Independence, reporting lines and objectivity

<!-- Guidance: Purpose: position the function so that it can work free from interference (GIAS Principle 7, Standard 7.1, and Principle 8). Questions: to whom does the CAE report functionally and administratively, who appoints and removes the CAE, who sets the budget? Pitfall: a functional line to the audit committee on paper while the CFO decides the CAE's pay and budget in practice. -->

The CAE reports functionally to the audit committee and
administratively to the Chief Executive Officer *(Example)*. The
functional reporting line means that the audit committee:

- approves the charter, the risk-based plan and the internal audit
  budget and resource plan
- receives communications from the CAE on performance against the plan
  and on significant risks and control issues
- approves decisions on the appointment, removal and remuneration of the
  CAE
- meets the CAE in private session at least [four] times a year
  *(Example)*
- asks senior management and the CAE whether any scope or resource
  limitation exists

Internal audit has no operational responsibility for the activities it
audits. Internal auditors do not design or operate controls, approve
transactions, or implement recommendations. Where the CAE is asked to
take on roles beyond internal audit (for example responsibility for
compliance or enterprise risk management), the board approves the role
and the safeguards, and an independent party audits those areas.

Internal auditors declare conflicts of interest annually and before
each engagement. An auditor does not assess an activity for which they
were responsible in the previous [12] months *(Example)*. The CAE
discloses any impairment of independence or objectivity, in fact or
appearance, to the parties concerned and to the audit committee.

```mermaid
flowchart TB
  B[Board of directors] --> AC[Audit committee]
  AC -- functional reporting --> CAE[Chief Audit Executive]
  CEO[Chief Executive Officer] -- administrative reporting --> CAE
  CAE --> T[Internal audit team and co-source providers]
  CAE -. private sessions .-> AC
  T -. coordination .-> EA[External auditor]
  T -. coordination .-> L2[Risk, compliance and security functions]
```

## 4. Authority and access

<!-- Guidance: Purpose: give internal audit the access it needs without asking permission each time (GIAS Standard 6.2 and Principle 6). Questions: does the authority extend to subsidiaries, third parties and cloud providers through contract rights? Pitfall: no audit clause in key outsourcing contracts, so access depends on goodwill. -->

The audit committee authorises internal audit to have full, free and
unrestricted access to all functions, records, data, systems, physical
properties and personnel relevant to any engagement, subject to
applicable law. Internal audit treats all information obtained with the
same confidentiality as the owner of the information.

| Authority | Detail *(Example)* |
|---|---|
| Records and systems | Read access to ERP, billing, CRM, HR and security tooling on request; data extracts within five working days |
| People | Any employee or contractor may be interviewed; managers ensure availability |
| Subsidiaries | Charter adopted by each subsidiary board or management body where local law requires |
| Third parties | Right-to-audit clauses in contracts with key suppliers and cloud providers, coordinated with procurement |
| Direct access | The CAE has direct and unrestricted access to the audit committee chair, the CEO and the board chair |
| Escalation | Any restriction of access is reported by the CAE to the audit committee chair without delay |

Personal data is processed for audit purposes in line with the group
data protection policy and the records of processing (see GDPR Records
of Processing, `compliance/gdpr-ropa`).

## 5. Scope of services

<!-- Guidance: Purpose: describe the types of work internal audit performs and the limits on advisory work. Questions: which assurance and advisory services are offered, and who approves advisory work that was not in the plan? Pitfall: advisory requests that consume the assurance budget without board visibility. -->

Internal audit provides:

- **Assurance services**: objective examinations of evidence leading to
  an independent conclusion on governance, risk management and control,
  including financial, operational, compliance, information technology,
  cybersecurity, data, third-party and sustainability reporting topics.
- **Advisory services**: work agreed with management to improve
  governance, risk management and control, such as reviewing control
  design for a new system. Advisory work does not include taking
  management responsibility.
- **Investigations support**: forensic analysis or fact-finding at the
  request of the audit committee, under the group investigation
  protocol and in line with the Whistleblowing Policy
  (`compliance/whistleblowing-policy`).

Assurance on financial reporting controls is coordinated with
management's internal control over financial reporting assessment (see
ICFR Management Assessment, `compliance/icfr-management-assessment`).
Significant advisory work not in the approved plan requires CAE
approval and is reported to the audit committee at its next meeting.

## 6. Roles and responsibilities

<!-- Guidance: Purpose: make responsibilities of the board, senior management and the CAE explicit (GIAS Domain III and Domain IV). Questions: who provides internal audit with information about strategy and risk, and who ensures action plans are implemented? Pitfall: responsibilities listed only for internal audit, leaving management's duties implicit. -->

| Party | Responsibilities *(Example)* |
|---|---|
| Board / audit committee | Approve charter, plan, budget; appoint and evaluate CAE; review results and overdue actions; receive QAIP and external assessment results |
| Senior management | Share strategy, risk and change information; support access; respond to findings and implement action plans; accept risk formally when choosing not to act |
| Chief Audit Executive | Maintain the charter and methodology; prepare the risk-based plan; manage resources; report results, significant risks and conformance; operate the QAIP |
| Internal auditors | Perform engagements in conformance with the standards and the methodology; maintain competence; declare conflicts |
| Co-source providers | Perform assigned work under internal audit supervision and methodology; confirm independence |

## Part B. Annual risk-based internal audit plan

<!-- Guidance: The plan shows the board how internal audit will spend its resources in the year and why. Present it with a summary of coverage of the principal risks and a list of what will not be audited. -->

The 2027 plan *(Example)* was prepared in Q3 2026 from the audit
universe, the group risk register, interviews with the executive team
and the audit committee chair, and the results of 2026 engagements.

## 7. Strategy and planning approach

<!-- Guidance: Purpose: link the plan to the internal audit strategy and to the organisation's objectives (GIAS Principle 9, Standards 9.1 to 9.4). Questions: what are the organisation's strategic priorities and principal risks, and how does internal audit's multi-year strategy respond? Pitfall: a plan built only from prior-year audits. -->

Summarise the internal audit strategy (three to five years) in a few
sentences: the vision for the function, the capabilities it is
building (for example data analytics or cybersecurity skills) and how
coverage of the audit universe will evolve.

The planning steps are:

1. Update understanding of strategy, business model and change
   programmes.
2. Refresh the audit universe and map each auditable entity to the
   principal risks in the Risk Register (`compliance/risk-register`).
3. Score each entity with the method in section 8.
4. Consider mandatory and requested work, assurance from other
   providers and coverage of each principal risk.
5. Allocate hours within capacity, keep a contingency reserve and list
   what is deferred.
6. Discuss the draft with senior management and the audit committee,
   then obtain approval.

The plan is dynamic. The CAE reviews it every quarter and proposes
changes when risks, the business or resources change.

## 8. Audit universe and risk assessment

<!-- Guidance: Purpose: show a consistent, explainable basis for choosing audits. Questions: are the factors and weights documented and approved? Are scores reviewed with management? Pitfall: scores adjusted to justify a pre-chosen plan. -->

Each auditable entity is scored from 1 (low) to 5 (high) on four
factors. The weighted score is the sum of factor scores multiplied by
their weights. Entities scoring 3.30 or more are audited in the plan
year; lower scores are audited on a cycle of no more than [three] years
or covered by other assurance *(Example method, set your own)*.

| Factor | Weight *(Example)* | What a 5 means |
|---|---|---|
| Financial impact | 30% | Material to group revenue, profit or cash |
| Regulatory and legal exposure | 25% | Significant fines, licence or criminal exposure |
| Change and complexity | 25% | New systems, processes, entities or regulation |
| Time since last assurance | 20% | Not audited for three years or more |

The weights sum to 30 + 25 + 25 + 20 = 100%.

| Entity ID | Auditable entity | Fin. | Reg. | Change | Time | Weighted score | In 2027 plan |
|---|---|---|---|---|---|---|---|
| AU-FIN-01 *(Example)* | Revenue recognition and subscription billing | 5 | 3 | 4 | 4 | 4.05 | Yes |
| AU-IT-02 *(Example)* | Cybersecurity and identity management | 4 | 5 | 4 | 3 | 4.05 | Yes |
| AU-IT-08 *(Example)* | Governance of AI features in the product | 2 | 4 | 5 | 5 | 3.85 | Yes (advisory) |
| AU-OPS-05 *(Example)* | Third-party and cloud provider management | 3 | 4 | 4 | 4 | 3.70 | Yes |
| AU-TAX-07 *(Example)* | Transfer pricing and indirect tax | 4 | 4 | 3 | 3 | 3.55 | Yes |
| AU-IT-10 *(Example)* | ERP change management | 4 | 3 | 4 | 3 | 3.55 | Yes |
| AU-COM-04 *(Example)* | Data protection compliance | 3 | 5 | 3 | 3 | 3.50 | Yes |
| AU-FIN-03 *(Example)* | Treasury and cash management | 4 | 2 | 3 | 5 | 3.45 | Yes |
| AU-FIN-09 *(Example)* | Period-end close and consolidation | 5 | 3 | 3 | 2 | 3.40 | Yes |
| AU-COM-13 *(Example)* | Whistleblowing and ethics programme | 2 | 4 | 3 | 5 | 3.35 | Yes |
| AU-FIN-06 *(Example)* | Payroll, US and Vietnam | 3 | 3 | 2 | 5 | 3.15 | No, 2028 |
| AU-OPS-11 *(Example)* | Customer refunds and chargebacks | 3 | 2 | 3 | 4 | 2.95 | No, second-line monitoring |
| AU-FIN-04 *(Example)* | Procure-to-pay and supplier master data | 4 | 3 | 3 | 1 | 2.90 | No, audited in 2026 (IA-2026-09); follow-up of action plans only |
| AU-HR-12 *(Example)* | Employee expenses | 2 | 2 | 2 | 3 | 2.20 | No, analytics only |

Worked check for AU-FIN-01: 5 x 0.30 + 3 x 0.25 + 4 x 0.25 + 4 x 0.20 =
1.50 + 0.75 + 1.00 + 0.80 = 4.05. Recompute every row when a score
changes. AU-FIN-04 scored 4.20 when it entered the 2026 plan (change 5
after the ERP migration, time since last assurance 5); after the 2026
engagement it scores 4 x 0.30 + 3 x 0.25 + 3 x 0.25 + 1 x 0.20 = 2.90.

The cycle rule overrides the score. An entity with a time factor of 5
has gone three years or more without assurance and must be audited in
the plan year, covered by other assurance that internal audit has
evaluated, or reported to the audit committee as a coverage gap for
explicit acceptance.

## 9. Plan of engagements

<!-- Guidance: Purpose: list the engagements, their objectives, timing and hours, and show coverage of principal risks (GIAS Standard 9.4). Questions: does every principal risk have assurance from internal audit or another provider? Pitfall: no visible list of risks left uncovered, so the board assumes everything is covered. -->

| Engagement ID | Entity | Type | Indicative objective | Quarter | Hours |
|---|---|---|---|---|---|
| IA-2027-01 *(Example)* | AU-FIN-01 | Assurance | Completeness and accuracy of subscription billing and revenue cut-off | Q1 | 900 |
| IA-2027-02 *(Example)* | AU-IT-02 | Assurance | Identity and privileged access controls, incident detection (Cybersecurity Topical Requirement applies) | Q2 | 800 |
| IA-2027-03 *(Example)* | AU-IT-08 | Advisory | Control design for AI features, including EU AI Act readiness | Q2 | 700 |
| IA-2027-04 *(Example)* | AU-OPS-05 | Assurance | Third-party risk lifecycle for critical cloud providers (Third-Party Topical Requirement applies) | Q3 | 700 |
| IA-2027-05 *(Example)* | AU-TAX-07 | Assurance | Intercompany pricing process and documentation, including Vietnam | Q3 | 650 |
| IA-2027-06 *(Example)* | AU-IT-10 | Assurance | ERP change and release controls | Q1 | 600 |
| IA-2027-07 *(Example)* | AU-COM-04 | Assurance | Data subject rights and retention | Q4 | 600 |
| IA-2027-08 *(Example)* | AU-FIN-03 | Assurance | Bank mandates, payment release and cash forecasting | Q4 | 550 |
| IA-2027-09 *(Example)* | AU-FIN-09 | Assurance | Consolidation journals and intercompany eliminations | Q1 | 500 |
| IA-2027-10 *(Example)* | AU-COM-13 | Assurance | Effectiveness of the speak-up channel and case handling | Q3 | 400 |
| Total | | | | | 6,400 |

Check the total: 900 + 800 + 700 + 700 + 650 + 600 + 600 + 550 + 500 +
400 = 6,400 hours.

Principal risks not covered by internal audit in 2027 *(Example)*:

- Payroll in the US and Vietnam (scored 3.15, time factor 5): exceeds
  the three-year cycle. The gap was accepted by the audit committee on
  YYYY-MM-DD *(Example)* on the basis of reliance on the payroll
  provider's SOC 1 type 2 report and the user-entity controls tested
  under ICFR; audit planned for Q1 2028.
- Customer refunds and chargebacks: covered by second-line monitoring;
  internal audit reviews the monitoring results in IA-2027-01.

Present the plan to the audit committee with a one-page heat map or
table that maps each principal risk to the engagements and other
assurance providers that cover it. State clearly which risks receive no
assurance in the year, so that the committee can accept the gap or ask
for more resources.

## 10. Resources and budget

<!-- Guidance: Purpose: show that resources are sufficient for the plan and say what happens if they are not (GIAS Principle 10, Standard 8.2). Questions: how many productive hours are available, which skills are missing, and what is the co-source budget? Pitfall: a plan that needs more hours than the team has. -->

| Capacity item | Hours *(Example)* |
|---|---|
| Gross hours: 6 FTE x 1,720 hours | 10,320 |
| Less training, leave buffer and administration (20%) | -2,064 |
| Productive hours | 8,256 |
| Planned engagements (section 9) | 6,400 |
| Follow-up of action plans | 400 |
| QAIP activities | 300 |
| Planning, audit committee reporting and stakeholder meetings | 356 |
| Contingency reserve (ad hoc requests, investigations) | 800 |
| Total allocated | 8,256 |

Check: 10,320 - 2,064 = 8,256, and 6,400 + 400 + 300 + 356 + 800 =
8,256.

Skills gaps for 2027 *(Example)*: cybersecurity testing and tax
specialists are co-sourced for IA-2027-02 and IA-2027-05 within a budget
of EUR [amount]. The CAE reports to the audit committee if resources
become insufficient to deliver the plan or to meet the standards, and
states the effect on assurance coverage.

## 11. Coordination and reliance on other assurance

<!-- Guidance: Purpose: avoid gaps and duplication between assurance providers (GIAS Standard 9.5). Questions: who else provides assurance on each principal risk, and on what basis can internal audit rely on their work? Pitfall: relying on another provider's work without evaluating its competence and objectivity. -->

| Assurance provider | Area | Coordination | Reliance basis *(Example)* |
|---|---|---|---|
| External auditor | Financial statements, ICFR walkthroughs | Shared calendar, exchange of reports | No reliance; information only |
| Group risk and compliance | Compliance monitoring, AML where relevant, sanctions screening | Quarterly meeting, shared issue log | Partial reliance after review of methodology |
| Information security (second line) | Vulnerability management, security metrics | Joint planning for IA-2027-02 | Reliance on metrics after data validation |
| Payroll provider service auditor | Payroll processing | Annual review of the assurance report | Reliance subject to user-entity controls test |
| ISO management-system internal audits | ISO/IEC 27001 controls | Program planned in `compliance/internal-audit-program` | Coordinated scope, no duplication |

Where internal audit relies on others, the CAE evaluates their
competence, objectivity and due care and documents the basis. The CAE
remains responsible for the conclusions internal audit gives.

## 12. Topical Requirements applicability

<!-- Guidance: Purpose: record whether IIA Topical Requirements apply to planned engagements. Questions: which engagements cover cybersecurity or third parties, and has the risk assessment of other engagements identified these topics? Pitfall: applying a Topical Requirement only to the engagement with the matching title. -->

IIA Topical Requirements set minimum considerations for specific risk
areas when they are in an engagement's scope or identified as
significant in the risk assessment. As of 2026-10, the Cybersecurity
Topical Requirement is effective (from 2026-02-05) and the Third-Party
Topical Requirement was reported as effective from September 2026.
Check the IIA for current requirements and effective dates.

| Topical Requirement | Engagements where it applies *(Example)* | Applicability decision |
|---|---|---|
| Cybersecurity | IA-2027-02; components of IA-2027-06 and IA-2027-07 | Apply; document assessment in each engagement file |
| Third-Party | IA-2027-04; components of IA-2027-03 and IA-2027-08 | Apply from 2027 plan |
| [Future Topical Requirement] | [Engagements] | [Assess when issued] |

## Part C. Quality and reporting

<!-- Guidance: Part C shows how the function demonstrates its own quality and keeps the board informed. Regulators and external assessors usually start their review here. -->

The QAIP covers all aspects of the internal audit function, including
conformance with the standards, achievement of the mandate and
continuous improvement.

## 13. Quality assurance and improvement program

<!-- Guidance: Purpose: describe how quality is monitored and assessed (GIAS Principle 12, Standards 12.1 to 12.3, and Standard 8.4 for external assessment). Questions: who performs ongoing monitoring, how often are periodic self-assessments done, when is the next external assessment? Pitfall: an external assessment overdue because nobody tracked the five-year cycle. -->

### 13.1 Internal assessments

- **Ongoing monitoring**: supervision and review of each engagement,
  standard workpaper checklists, and auditee feedback surveys.
- **Periodic self-assessment**: an annual review by a team member not
  involved in the sampled engagements, testing a sample of engagement
  files against the methodology and the standards.

### 13.2 External assessment

An external quality assessment is performed at least once every five
years by a qualified, independent assessor or assessment team (meeting
the qualification requirements of GIAS Standard 8.4, including at least
one assessor who holds the Certified Internal Auditor designation), in
the form agreed with the audit committee (full external assessment, or
self-assessment with independent validation). The audit committee
approves the scope and the assessor and receives the results directly.

| Assessment | Date | Assessor | Result *(Example)* | Next due |
|---|---|---|---|---|
| External quality assessment | 2024-06 *(Example)* | [Independent assessor] | Generally conforms (prior standards) | 2029-06 *(Example)* |
| Periodic self-assessment against GIAS | 2026-09 *(Example)* | [Internal team member] | Two partial-conformance areas, actions agreed | 2027-09 |

### 13.3 Performance measures

| KPI ID | Measure | Target *(Example)* | 2026 actual *(Example)* |
|---|---|---|---|
| KPI-01 | Plan completion (final reports issued by year end) | 90% | 11 of 12 engagements (91.7%); 8 of 12 at the October audit committee |
| KPI-02 | Days from fieldwork end to draft report | 10 | 11 |
| KPI-03 | Action plans implemented by due date | 80% | 31 of 40 (77.5%) |
| KPI-04 | Auditee satisfaction score (1 to 5) | 4.0 | 4.2 |
| KPI-05 | Continuing professional education hours per auditor | 40 | 46 |

### 13.4 Improvement actions

| Action ID | Source | Improvement | Owner | Due |
|---|---|---|---|---|
| QA-01 *(Example)* | 2026 self-assessment | Document engagement risk assessment for every engagement, including fraud and IT risk | [@cae] | 2027-03-31 |
| QA-02 *(Example)* | 2026 self-assessment | Add Topical Requirement checklist to engagement template | [@methodology-lead] | 2027-01-31 |

## 14. Reporting to the board and senior management

<!-- Guidance: Purpose: set the content and frequency of internal audit reporting (GIAS Principles 8 and 11). Questions: what does the audit committee receive each meeting and each year, and how are significant risk exposures and accepted risks escalated? Pitfall: reports that list engagement status but give no view on the overall control environment. -->

| Report | Frequency | Content *(Example)* |
|---|---|---|
| Quarterly internal audit report | Each audit committee meeting | Plan progress, engagement ratings, high findings, overdue actions, plan changes, resource issues |
| Annual internal audit report | Annually, Q1 | Overall view on governance, risk management and control based on the year's work; themes; QAIP results; conformance statement |
| Risk acceptance escalation | As needed | Risks accepted by management that the CAE considers beyond appetite |
| Independence confirmation | Annually | CAE confirmation of organisational independence and any impairment |
| External assessment report | Every five years | Results and action plan |

The audit committee report prepared by the board (see Audit Committee
Report, `finance/audit-committee-report`) draws on these reports.

## 15. Approval, review and changes

<!-- Guidance: Purpose: show when and how the charter and plan are reviewed and changed. Questions: who can change the plan during the year, and when is the board told? Pitfall: plan changes made informally and reported only at year end. -->

The CAE reviews the charter at least annually and proposes changes to
the audit committee. The plan is reviewed quarterly. Changes that add,
remove or defer an engagement, or shift more than [10]% of planned hours
*(Example)*, are approved by the audit committee chair and ratified at
the next meeting.

| Change ID | Date | Change | Reason | Approved by |
|---|---|---|---|---|
| PC-01 *(Example)* | YYYY-MM-DD | IA-2027-08 deferred to Q1 2028 | Treasury system replacement delayed | [Audit committee chair] |
| PC-02 *(Example)* | YYYY-MM-DD | Investigation support, 150 hours from contingency | Audit committee request | [Audit committee] |

## Glossary and references

<!-- Guidance: Define governance terms for readers outside internal audit and list the sources by name and number. -->

| Term | Meaning in this template |
|---|---|
| Audit universe | The list of auditable entities (processes, units, systems, programmes) that could be audited |
| Auditable entity | A unit of the audit universe that can be scoped as one engagement |
| CAE | Chief Audit Executive |
| Charter | Formal document approved by the board that sets internal audit's mandate, position, authority and scope |
| Co-source | External specialists working under internal audit's direction |
| Functional reporting | The line through which the board oversees internal audit's work and independence |
| QAIP | Quality assurance and improvement program |
| Topical Requirement | IIA requirement setting minimum considerations for a specific risk area |

References (check the current official versions):

- The Institute of Internal Auditors, Global Internal Audit Standards
  (2024), effective 2025-01-09: Domain II (ethics and professionalism),
  Domain III (Principles 6, 7 and 8), Domain IV (Principles 9, 10, 11
  and 12). Cited by number only.
- IIA Topical Requirements: Cybersecurity (effective 2026-02-05) and
  Third-Party (reported effective September 2026).
- Vietnam, Decree 05/2019/ND-CP on internal audit (effective
  2019-04-01); check the current text and local law.
- FRC, UK Corporate Governance Code (Provisions 25 and 29); US
  Exchange Act Rule 10A-3; NYSE Listed Company Manual 303A.07(c).
  Check the current versions.
- Related templates: Internal Audit Engagement
  (`compliance/iia-internal-audit-engagement`), Internal Audit Program,
  ISO 19011 (`compliance/internal-audit-program`), Risk Register
  (`compliance/risk-register`), Risk Methodology
  (`compliance/risk-methodology`), ICFR Management Assessment
  (`compliance/icfr-management-assessment`), Whistleblowing Policy
  (`compliance/whistleblowing-policy`), Audit Committee Report
  (`finance/audit-committee-report`).

## Standard and licence note

Structure aligned with the IIA Global Internal Audit Standards (2024,
effective 2025-01-09) and the IIA Topical Requirements, which are
protected by copyright and are cited here by domain, principle and
standard number only; no text from them is reproduced or paraphrased.
The Vietnam decree is cited by number as public law. The charter
wording, scoring method, capacity model and the Corvid Commerce Group plc
example are original and fictional. Check the current official versions
of the standards, any applicable law and supervisory guidance before
use. This is a document format, not legal, audit or accounting advice.
Template licence: MIT.