Internal and Forensic Audit · Internal Audit Engagements and Planning

Internal Audit Charter and Audit Universe Explained

Updated 11 October 2026 · Fact-checked

An **internal audit charter** is a formal document approved by the board or audit committee that sets the internal audit function's purpose, authority, scope and reporting line. The **audit universe** is the complete list of auditable areas. To answer questions, define the charter's contents, then list, risk-rank and prioritise the universe.

Understand Internal Audit Charter and Audit Universe

Every internal audit function needs a mandate. The internal audit charter is that mandate in writing. It says why the function exists, what it can look at, whom it reports to, and what powers it has. Without it, management can restrict access or ignore findings, and the function loses credibility.

The charter is usually approved by the board or the audit committee, not by the management whose work is audited. This supports objectivity. SA 610 (Revised), para A7, treats objectivity as the ability to work without bias, conflict of interest or undue influence. It lists factors such as whether the function reports to those charged with governance (or, if it reports to management, has direct access to them), whether it is free of conflicting managerial duties, and whether management places restrictions on communicating findings. A good charter addresses each of these.

Typical contents of a charter are:
- Purpose and mission of the function.
- Scope: which activities, units and processes are covered, including assurance and consulting work.
- Authority: access to records, people, premises and systems.
- Independence and reporting line, usually functionally to the audit committee.
- Responsibilities and limits, such as no operational duties.
- Standards followed and the code of ethics.
- Reporting, follow-up and periodic review of the charter.

SA 610 (Revised), para A1, shows how wide the scope can be: governance, risk management (including help in detecting fraud), evaluation of internal control, examination of financial and operating information, review of operating activities, and review of compliance with laws, regulations and policies. Para 6 adds that objectives, scope, status and authority vary widely with the size and structure of the entity.

The audit universe is the full set of auditable entities: processes, functions, business units, locations, systems, projects and compliance areas. It comes from the charter's scope. You build it from the organisation chart, the chart of accounts, process maps, the risk register, regulatory requirements and discussions with management. Each item is then risk-assessed to produce the audit plan, because the universe is always larger than the available audit time.

Key rules to remember

Charter purpose: Charter = purpose + scope + authority + independence and reporting line + responsibilities + standards; Use this as a memory frame for contents. Adapt it to the entity; the exact list is not fixed by law.
Audit universe to plan: Audit universe → risk assessment → ranking → annual audit plan; The plan covers the high-risk part of the universe within available resources. Low-risk areas are covered on a rotation.
Objectivity test (SA 610 Revised, A7): Reporting line + freedom from conflicting duties + governance oversight of employment + no restrictions on communication + professional membership; These are factors an external auditor may evaluate. They are not a closed list.
Resources in planning (SA 300, A9): Which resources + how much + when deployed + how managed and supervised; A similar thinking applies when internal audit allocates effort across the universe.

How to solve Internal Audit Charter and Audit Universe questions

Use this method for any question on the charter or the audit universe, whether it asks for a definition, contents, a drafting task or a case.

1State what the document or concept is in one or two lines, and who approves it.
2Link it to the facts given: the entity's size, sector and structure.
3List the key contents or components, each with a one-line explanation.
4Show how independence is protected: reporting line, access, no operational duties, no restrictions.
5For the audit universe, describe how you identify auditable areas: sources, listing, grouping.
6Explain the next step: risk-rank the universe and prioritise it in the audit plan.
7Conclude with a practical recommendation, such as board approval and periodic review.

Quickest way: P-S-A-I-R memory frame

When to use it: Use it when you have few minutes and the question asks for contents of a charter or steps to prepare the universe.

P for purpose: why the function exists.
S for scope: what it covers.
A for authority: access to records, people and systems.
I for independence: reporting to the audit committee.
R for reporting and review: how findings go up and how the charter is reviewed.
For the universe, write: list, group, risk-rank, plan.

Common mistakes in Internal Audit Charter and Audit Universe

Saying the charter is approved by management or the head of finance.
Students think any internal policy is management's document.
Fix: Say it is approved by the board or audit committee, so that the function stays objective.
Confusing the charter with the audit plan or audit programme.
All three are planning-type documents.
Fix: The charter is the standing mandate. The plan is periodic. The programme is the step list for one engagement.
Treating the audit universe as only financial processes.
Students link audit to accounts.
Fix: Include operations, compliance, IT, governance and risk management, as the scope in SA 610 (Revised), para A1, shows.
Assuming the whole universe is audited every year.
The word 'universe' suggests full coverage.
Fix: State that the plan is risk-based. High-risk areas are audited more often and low-risk areas on a rotation.
Giving a fixed legal list of charter contents.
Students memorise a list as if prescribed.
Fix: Present the contents as good practice and adapt them to the entity's size and structure.
Ignoring independence in the answer.
Students focus on scope and powers only.
Fix: Always add the reporting line, no conflicting duties and no restrictions on communicating findings.

Worked examples

Example 1

Explain the meaning of an internal audit charter and state its main contents. (Answer for a listed manufacturing company, Bharat Components Ltd.)

Show the solution

Define: the charter is a formal document that sets the purpose, authority and scope of the internal audit function.
Approval: for Bharat Components Ltd., the board or audit committee should approve it.
Contents: purpose and mission; scope across plants, finance, procurement, compliance and IT; authority of access to records, people and systems; reporting line to the audit committee; responsibilities and limits; standards and ethics followed; follow-up and review of the charter.
Independence: the head of internal audit has direct access to the audit committee and holds no operational duties, which supports objectivity as in SA 610 (Revised), para A7.
Conclude: review the charter periodically as the business changes.

Answer: The charter is the board-approved mandate of internal audit. It covers purpose, scope, authority, independence and reporting line, responsibilities, standards and review, and it protects objectivity.

Example 2

How would the internal audit head of Sagar Retail Ltd., which has 40 stores, a central warehouse and an ERP system, define the audit universe and use it for planning?

Show the solution

Identify sources: organisation chart, process maps, chart of accounts, risk register, regulatory requirements and discussions with management.
List auditable areas: store operations, cash handling, procurement, warehouse and inventory, sales and discounts, payroll, fixed assets, treasury, IT general controls, statutory compliance.
Group the 40 stores by region or size so similar units can be tested by rotation.
Rate each area on risk factors such as value, complexity, past findings and changes in systems or management.
Rank the areas and put the high-risk ones in the annual plan, such as inventory, cash and IT controls.
Schedule lower-risk areas on a rotation and update the universe when new stores or processes are added.
Report the plan to the audit committee for approval.

Answer: The universe is the complete list of stores, processes, systems and compliance areas. It is risk-ranked, and the annual plan covers the highest-risk areas first, with the others covered on a rotation.

Exam tips

Write the approving authority and the independence point in every charter answer. They are easy marks.
For a case question, tie the charter scope or universe items to the entity's sector in the facts.
Use short bullet lists for contents, then a sentence on why each matters.
Where the question mentions the external auditor, cite SA 610 (Revised) on objectivity and on how the external auditor evaluates the function.
End a universe answer with risk ranking and the audit plan so the answer feels complete.

Practice questions from Internal Audit Engagements and Planning

Internal Audit Charter and Audit Universe in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Charter and Audit Universe: frequently asked questions

What is an internal audit charter?

It is a formal document that sets the purpose, authority, scope and reporting line of the internal audit function. It is normally approved by the board or audit committee. It gives the function its mandate and protects its independence.

What is the audit universe in internal audit?

It is the complete list of auditable areas in an organisation, such as processes, units, locations, systems and compliance areas. Because audit time is limited, the universe is risk-ranked and the plan covers the highest-risk areas first.

How is the audit universe different from the audit plan?

The universe is the full population of auditable areas. The audit plan is the selected subset to be audited in a period, based on risk and available resources.

Does the external auditor look at the internal audit charter?

The external auditor evaluates the function's objectivity and competence before using its work. Under SA 610 (Revised), para A7, factors include reporting line, conflicting duties and restrictions on communication. The charter is a natural source of evidence for these.