Who ultimately approves the authority of the internal audit activity?

The authority of the internal audit activity is ultimately approved by the Board. This is because the Board holds the highest level of oversight within an organization, making it responsible for establishing the framework within which the internal audit operates. The Board’s approval affirms the independence and authority of the internal audit function, which is crucial for its effectiveness in evaluating and improving the governance, risk management, and internal control processes of the organization.

The distinction of the Board’s role is critical, as it is tasked with ensuring that the internal audit has the necessary resources, access to information, and the authority to operate independently from management. This distance from the management team allows internal auditors to conduct their assessments objectively, without undue influence, and thereby enhances the credibility and effectiveness of the audit process.

In contrast, while the Audit Committee plays a significant role in overseeing the internal audit function and can provide recommendations to the Board, it does not have the ultimate authority to approve the internal audit activity. Similarly, the Chief Executive Officer and the Management Team do not possess the authority to approve the internal audit’s charter or its operational independence, which is why their roles are not the final determinant in this context.