The internal audit function should report to the organization’s audit committee or a board of directors member who has oversight authority.