Internal Audit Charter

The charter is the function's founding paper. It says why internal audit exists, what it may examine, whom it reports to and what access it has to records, people and premises. It also records the standards the team follows, the safeguards for its independence, and how the chief audit executive deals with the audit committee and senior management. Most charters set out the limits too, such as the rule that auditors do not take over management responsibilities and must declare conflicts when asked to review an area they worked in. The chief audit executive proposes it, senior management reviews it and the board or its audit committee approves it. It is reviewed regularly and whenever the mandate changes. Regulators and quality reviewers read the charter first. Without a board-approved charter, auditors have no clear authority to press senior managers for records or answers.

Once the group buys a fintech, the bank's board updates the charter. The new text extends the function's authority to the subsidiary, confirms direct access to the audit committee chair and bars the chief audit executive from holding any operational role. The committee approves it at its next meeting, and it is circulated to all business heads.