If an engagement client disputes that a specific action or process is within the scope of the internal audit activity, what would be the most appropriate way for the internal audit activity (IAA) to respond?

The internal audit charter is the formal document that defines the internal audit activity's (IAA) purpose, authority, and responsibility. It is approved by senior management and the board. The annual audit plan, which is derived from a risk assessment, is also approved by senior management and the board and specifies the engagements to be performed. When an engagement client disputes the scope, the most appropriate initial response is to refer them to these governing documents. This action clarifies that the scope is not arbitrary but is based on the IAA's formal mandate and an approved, risk-based plan, thereby reinforcing the IAA's authority and objectivity.

A. Terminating the engagement is an extreme reaction that abdicates the IAA's responsibility and fails to address the underlying dispute about its authority.
B. Allowing the client to dictate or negotiate the scope compromises the IAA's independence and the integrity of the risk-based audit plan.
D. Escalating to senior management or the board is a secondary step, to be taken only if the dispute cannot be resolved by referencing the charter and audit plan.

1. The Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), 2017.

Standard 1000: Purpose, Authority, and Responsibility: "The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter... The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval." This standard establishes the charter as the foundational document defining the IAA's scope and authority.

Standard 2010: Planning: "The chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals." The interpretation adds that this plan is submitted "to senior management and the board for review and approval." This confirms the audit plan is an approved document outlining specific engagement areas.

2. The Institute of Internal Auditors (IIA), Implementation Guide 1000: Purpose, Authority, and Responsibility, 2017.

Section: "Communicating the Charter": The guide states, "The charter also serves as a formal agreement or 'contract' with management and the board... The CAE should discuss the internal audit charter and the responsibilities of the internal audit activity with senior management and the board." This supports using the charter as the basis for discussion and clarification with stakeholders, including engagement clients.