Ref # Documents P/O D-1 Governance D-2 Staff D-3 Management D-4 Process Comment 01 Audit committee charter P 1000 1100 1200 2000 02 Audit committee agendas and minutes (provide for past calendar year to approval of the internal audit charter and the risk-based plan) O 1100 1200 2000 2600 03 Entity’s organization chart (show unit heads and internal audit P 1000 1100 2000 04 Entity’s governance structure and (e.g., strategy selection, ethics, and IT governance) O 2100 05 Entity’s risk management framework and policies (e.g., ERM process and O 2100 06 Entity’s control framework and policy (e.g., COSO, delegation of authority, and accountability) O 2100
07 Internal audit charter P 1000 1100 1200 2000 2600 08 Internal audit activity strategic plan and vision (strategic plan specific to the audit activity) P 1000 1200 2000 2200 2300 2400 2500 09 Internal audit activity organization chart P 1100 1200 10 Internal audit activity values and any customer service standards P 1000 1300 11 Internal audit policy/procedure: code of ethics (if not included in internal audit manual) P Code of 12 Internal audit policy/procedure: and objectivity (if not in internal audit manual) P 1100 13 Internal audit policy/procedure: staff development (if not included in internal audit manual) P 1200 14 Internal audit job descriptions O 1200
15 Internal audit competency framework or model P 1200 16 Internal audit staff profile (name, years of experience, certifications, etc.) P 1200 17 Internal audit staff training records (sessions and activities for the current and prior year) P 1200 18 Internal audit staff performance templates (include example of professional development plan, if P 1200 19 Internal audit policy/procedure: (QAIP) (provide documentation that describes how QAIP is designed if not included in internal audit manual) P 1300 2000 2200 2300 2400 2500 20 QAIP – ongoing monitoring of (e.g., performance metrics and related reports, results of customer and engagement quality results) P/O 1300 21 QAIP – periodic internal assessment P/O 1300
staffing analysis, budgets, allocation, assurance map, etc.) 28 Audit plan – current plan vs. actual P 2000 29 Audit plan – prior plan vs. actual P 2000 30 Service provider engagement letters or contracts (for co-sourced or outsourced internal audit services) O 1200 2000 31 Periodic reports to the audit management on internal results (provide for the most recent 12 months) O 2000 32 Internal audit policy/procedure manual (provide entire manual) P 2000 33 Internal audit policy/procedure: planning/risk assessment (if not included in internal audit manual) P 2200 2300 34 Internal audit policy/procedure: assurance and consulting (if not included in internal P 2300
audit manual) 35 Internal audit policy/procedure: results (if not included in internal audit manual) P 2000 2400 36 Internal audit policy/procedure: progress (if not included in audit manual) P 2600 2500 37 Recent status reports used to monitor the disposition of internal audit and/or agreed-upon actions O 2600 2500 38 A list of all audit engagements in the current and prior year (to be used in selecting a sample of for quality assessment) P 1100 1300 1200 2200 2300 2400 2500 39 Supporting records for audit (for the sample of projects for the quality assessment) O 1100 1300 1200 2200 2300 2400 2500 40 A list of software or computer-assisted auditing techniques (CAATs) used by P 1200 2300