Which of the following statements is true regarding assurance services provided to clients outside of the organization?

The internal audit charter is the foundational document that defines the purpose, authority, responsibility, and scope of the internal audit activity. If the internal audit function is to provide assurance services to parties outside the organization, this represents a significant aspect of its scope. Therefore, the nature of these services must be explicitly defined within the charter. This ensures that the activity has the formal authorization from the board and senior management to perform such work, and it clarifies the terms of engagement and responsibilities to all stakeholders, including the external parties.

A. The internal audit charter must define the full scope of internal audit activities; therefore, any authorized services for outside clients must be included.
B. The charter grants overall authority. While specific, high-risk engagements might require board approval, the Standards do not mandate it on a case-by-case basis for all external work.
D. The nature of services differs significantly. Engagements with external parties involve different relationships, legal liabilities, reporting protocols, and objectives compared to internal engagements.

1. The Institute of Internal Auditors (IIA), International Professional Practices Framework (IPPF), Standard 1000: Purpose, Authority, and Responsibility. The interpretation of this standard emphasizes that the charter defines the scope of internal audit activities.

2. The Institute of Internal Auditors (IIA), Implementation Guide 1000: Purpose, Authority, and Responsibility. This guide explicitly states, "If the internal audit activity is expected to provide assurance or consulting services to parties outside the organization, the nature of these services should be defined in the charter." (Section: "Defining the Nature of Services and Scope of Activities").

3. The Institute of Internal Auditors (IIA), Practice Guide: Internal Audit Charter (July 2020). This guide elaborates on the content of the charter, reinforcing that "The charter should define the scope of internal audit activities... If the internal audit activity is expected to provide assurance or consulting services to parties outside the organization, the nature of these services should be defined in the charter." (Page 6, Section: "Scope of Internal Audit Activities").