The chief audit executive reports functionally to the board and administratively to the CEO and...

The authority element of the internal audit charter establishes internal audit’s right to obtain unrestricted access to records, systems, personnel, physical property, and other information necessary to perform engagements. Here, management’s repeated reluctance to provide requested documents is restricting the scope of audit work. The problem therefore concerns whether the authority granted to internal audit is being respected and enforced. The reporting relationship is already appropriate because the CAE reports functionally to the board. Independence and objectivity are important, but the immediate issue is denial or restriction of access rather than inappropriate influence over audit judgment. Responsibilities describe what internal audit is expected to perform, whereas authority gives it the access required to perform those responsibilities. Consequently, enforcement of the charter’s authority provisions is required.