Internal Audit constitutes the constitutional Line 3 assurance function — independent, objective assurance on governance effectiveness, risk management, and internal control. Reporting directly to the Assurance Committee, Internal Audit provides the institutional capacity to verify its own integrity across the seven generations.
Internal Audit is not operational management. It is the constitutional conscience — the independent capacity to examine, verify, and assure. Internal Audit operates separately from the operations it audits, separately from the risks it assesses, and separately from the controls it evaluates. This independence is not administrative — it is constitutional, ensuring assurance remains objective and authoritative across the seven generations.
The Internal Audit Architecture presents how independent assurance operates within the constitutional framework. Internal Audit reports directly to the Assurance Committee (not to management), coordinates with External Audit (for comprehensive coverage), and receives consultative perspective from the Advisory Council (outside the assurance chain). The architecture ensures independence, objectivity, and constitutional accountability.
Internal Audit operates through five constitutional audit types, each addressing a distinct aspect of institutional assurance. Operational audit examines process effectiveness. Financial audit verifies fiscal integrity. Compliance audit ensures regulatory conformity. IT audit assesses technology governance. Performance audit evaluates institutional effectiveness. Together, they constitute comprehensive Line 3 assurance.
Internal Audit's constitutional mandate establishes the scope of audit activities, the authority to access information, the responsibility to report findings, and the obligation to follow up on remediation. The mandate ensures Internal Audit can fulfill its Line 3 assurance function independently and effectively.
| Mandate Element | Constitutional Provision | Authority Level | Reporting Obligation |
|---|---|---|---|
| Audit Charter | The Internal Audit Charter establishes the constitutional basis for Internal Audit's existence, authority, and responsibility. The Charter is approved by the Assurance Committee and defines the scope of audit activities. | Assurance Committee | Annual Charter Review |
| Access Authority | Internal Audit has unrestricted access to all institutional records, personnel, and physical properties relevant to audit activities. Access authority is constitutionally mandated and cannot be restricted by management. | Unrestricted | Access Requests Documented |
| Independence Guarantee | Internal Audit operates independently from the operations it audits. The Chief Audit Executive reports functionally to the Assurance Committee and administratively to the Board, ensuring independence from management. | Constitutional | Independence Confirmed Annually |
| Reporting Responsibility | Internal Audit reports audit findings, recommendations, and management responses to the Assurance Committee. Reporting includes follow-up on remediation actions and periodic assurance opinions on institutional control effectiveness. | Assurance Committee | Quarterly Reporting |
| Audit Plan | Internal Audit develops a risk-based audit plan approved by the Assurance Committee. The plan addresses all significant institutional activities over a rolling multi-year cycle, ensuring comprehensive coverage. | Assurance Committee | Annual Plan Approval |
| Quality Assurance | Internal Audit maintains a quality assurance and improvement program including internal assessments and external reviews. Quality assurance ensures audit activities meet professional standards and institutional expectations. | Professional Standards | External Review Every 5 Years |
Internal Audit's independence is protected through three constitutional mechanisms — organizational independence (reporting to Assurance Committee, not management), operational independence (unrestricted access and authority), and professional independence (adherence to professional standards). These mechanisms ensure audit findings remain objective and authoritative.
Internal Audit is not operational management. It is the institutional conscience.Five Audit Types · Three Independence Mechanisms · Seven Generations
Five audit types, three independence mechanisms, one constitutional mandate. Internal Audit constitutes the Line 3 assurance function — independent, objective assurance on governance, risk management, and internal control. Internal Audit is not operational management. It is the institutional conscience, held across the seven generations.