“Can I say no to internal audit?” is a question managers ask more often than they admit, usually when a request arrives at a bad moment or touches something sensitive. The short answer is that you can often say “not like that” and sometimes “not now”, but almost never “no”. Internal audit’s authority is granted by the board, written into a charter, and backed by senior management, and it gives the function access to the records, systems, people and places it needs. The longer answer is more useful, because that authority has real limits, auditors are not allowed to do a number of things that managers sometimes assume they can, and a large set of decisions stays with management whatever the audit finds.
This guide explains where internal audit’s authority comes from, what “unrestricted access” covers, the legal and practical limits on it, what auditors may not do, what remains management’s decision, what happens when someone refuses, and how the picture differs across listed companies, banks, insurers, the public sector and private businesses. It was rewritten in September 2026 around the Global Internal Audit Standards, whose Domain III sets out the board’s role in authorizing and supporting the function, and it ends with a worked example of four access requests in one bank audit, each with a different answer. It is part of the site’s guide for people being audited.
In this guide
- Where internal audit’s authority comes from
- How to read your organization’s charter
- What unrestricted access covers
- The real limits on access
- What internal auditors are not allowed to do
- What stays management’s decision
- Authority in audits, advisory work and investigations
- What happens when someone says no
- How authority differs by sector
- Worked example: four access requests in one bank audit
- Questions people ask about internal audit’s authority
- Related guides
Where internal audit’s authority comes from
Internal audit has no authority of its own. Everything it can do is delegated from the board, which is responsible for overseeing the organization’s governance, risk management and control, and which needs an independent source of assurance to discharge that responsibility. The Global Internal Audit Standards describe this in their third domain, Governing the Internal Audit Function, as a set of essential conditions: things the board and senior management must do for internal audit to work. Standard 6.1 covers the mandate, the authority, role and responsibilities the function is given. Standard 6.2 requires the chief audit executive to document the mandate in an internal audit charter that the board approves. Standard 6.3 expects the board and senior management to support the function, including its unrestricted access to data, records, information, personnel and physical properties. And Standard 7.1 deals with organizational independence: the board is expected to establish a direct reporting relationship with the chief audit executive, and the chief audit executive must confirm the function’s independence to the board at least annually.
| Layer | What it provides | Where you will find it |
|---|---|---|
| Law and regulation, in some sectors | A requirement to have an internal audit function, sometimes with expectations about its independence and access | Listing rules, banking and insurance regulation, public sector legislation |
| The board | The mandate, approval of the charter, oversight of the function | Board and audit committee minutes; the audit committee’s terms of reference |
| The internal audit charter | The written statement of purpose, authority, access and reporting lines | Usually published internally; ask the audit function for a copy |
| The reporting line | Independence: the chief audit executive reports functionally to the board, administratively usually to the chief executive or another senior officer | The charter and the organization chart |
| Senior management support | Day-to-day backing for access, cooperation and resources | Policies, communications from the chief executive, the code of conduct |
| Policies and employment terms | An obligation on employees to cooperate with internal reviews | Code of conduct, employee handbook, sometimes employment contracts |
The practical consequence is that the charter is the document to read if you want to know what internal audit can do in your organization. Most charters follow the same pattern: a statement that the function has full, free and unrestricted access to all records, systems, property and personnel relevant to its work; an obligation on management and staff to cooperate; a commitment by the function to protect the information it obtains; and a statement of the chief audit executive’s direct access to the board and audit committee. The site’s guide to creating an internal audit charter explains each clause. If your organization’s charter is narrower, or silent on access, the function’s authority is narrower too, and that is a question for the board rather than for an individual manager.
How to read your organization’s charter
Few managers have read their internal audit charter, and most would find it shorter and plainer than they expect: typically three to six pages, approved by the audit committee and reviewed every year or two. Reading it takes ten minutes and answers most questions about what the function can ask of you. The clauses below are the ones that matter to someone being audited.
| Clause | What to look for | What it means for you |
|---|---|---|
| Purpose and mandate | Whether the function provides assurance only, or advisory services as well | Whether you can ask it for advice, and on what terms |
| Scope of work | Which entities, activities and locations are covered | Whether your subsidiary, joint venture or outsourced process falls inside it |
| Authority and access | The words “full”, “free” and “unrestricted”, and the list of what access covers | How much of an argument about access you could possibly have |
| Management’s responsibilities | Obligations to cooperate, respond to reports and implement actions within agreed dates | What you have committed to by being part of the organization |
| Confidentiality | How the function protects and uses information | The basis for any protocol you ask for |
| Reporting lines | Functional reporting to the audit committee; administrative reporting to an executive | Who the chief audit executive answers to, and why appeals to your own executive rarely change a report |
| Independence and objectivity | Restrictions on auditors’ roles and the handling of conflicts | What you can raise if you believe an auditor is conflicted |
| Follow-up | How actions are tracked, validated and escalated when overdue | What happens after the report |
If your organization does not publish its charter internally, ask the audit function for a copy. It is not a confidential document, and a function that is reluctant to share it has a problem of its own.
What unrestricted access covers
“Unrestricted” is a strong word, and it is meant to be. It means that no manager, however senior, decides which of the organization’s records internal audit may see, which systems it may examine, or which employees it may talk to. It exists because the areas where access is most likely to be resisted are the areas where assurance is most needed. It does not mean auditors can take anything, anywhere, in any form. Access is to what the audit needs, handled under the function’s confidentiality obligations, and given in ways that respect legal restrictions. The table sets out what access typically includes.
| Category | Covered? | Typical conditions |
|---|---|---|
| Business records: contracts, invoices, reconciliations, approvals, reports | Yes | None beyond relevance to the audit |
| System data and audit trails | Yes | Usually read-only access or extracts; auditors should not change data |
| Committee and management meeting minutes, including executive committees | Yes | Some organizations route board papers through the chief audit executive |
| Employees at every level | Yes | Reasonable scheduling; interviews may be held without managers present |
| Premises, warehouses, cash and physical assets | Yes | Safety rules apply; visits and counts may be unannounced |
| Company email and messaging systems | Yes, under policy | Normally only for specific purposes, with legal or HR involvement and under the organization’s monitoring policy |
| Personnel files and pay data | Yes, for audit purposes | Minimized, restricted to named auditors, protected under data protection rules |
| Health, medical and other special-category data | Only where essential | Strict legal conditions; often anonymized or reviewed by a specialist |
| Legally privileged material | Limited | Handled with counsel so that privilege is not waived |
| Third parties’ records | Only through contracts | Depends on right-to-audit clauses in the contract, not on the charter |
| Employees’ personal devices and accounts | No, as a rule | Only under an explicit policy and with legal advice |
The real limits on access
The limits on internal audit’s access come from law and from other people’s rights, not from managers’ preferences. They are real, and a good audit function respects them, because an audit that breaches privacy law or waives legal privilege creates a bigger problem than the one it was looking for. The common ones are these.
- Legal privilege. Advice from lawyers, and material prepared for litigation, is protected in many jurisdictions, and showing it to people outside the privileged circle can waive the protection. The usual answer is that counsel reviews the material and provides what the audit needs, such as a summary, a log of privileged documents, or the non-privileged parts.
- Privacy and data protection. Laws such as the GDPR require personal data to be processed for a legitimate purpose and limited to what is necessary. Audit is usually a legitimate purpose, but the data must be minimized, protected and retained no longer than needed. The usual answer is pseudonymized data, named access and secure storage.
- Special categories of data. Health, medical and similar data carries stricter rules. Auditors rarely need it in identifiable form, and where they do, specialist handling applies.
- Regulatory secrecy. Some regulated information, such as suspicious activity reporting in banking, carries rules about who may see it and how it may be shared, even inside the organization. The answer is handling in line with those rules, not exclusion from the audit.
- Inside information. Auditors who see price-sensitive information, for example about an acquisition, may need to be added to an insider list and to follow dealing restrictions.
- Other legal entities. Access to joint ventures, associates and some subsidiaries depends on ownership and agreements; a minority stake does not bring the parent’s charter with it.
- Third parties. Suppliers, outsourcers and customers are not bound by your charter. Access to their records comes from contractual audit rights, and where there are none, auditors test the organization’s own oversight of the third party instead.
- Personal property. Employees’ personal phones, accounts and belongings are outside the charter unless a specific, lawful policy brings them in.
Notice what these limits have in common. Almost all of them change how access happens rather than whether the audit can get the assurance it needs. Privilege is managed with counsel. Personal data is minimized. Third parties are covered through the organization’s own oversight. The only thing none of them does is give an individual manager discretion to decide what internal audit sees, and a manager who invokes privacy or confidentiality to avoid scrutiny, rather than to protect someone, will usually find the chief audit executive and the head of legal agreeing a protocol within a day or two.
What internal auditors are not allowed to do
The other half of the question is less often asked. Internal audit’s independence depends on its not doing management’s job, and the Standards, the Three Lines Model and the IIA’s guidance on risk management all draw the same boundary: internal audit gives independent assurance and advice, and management runs the business, owns its risks and designs and operates its controls. An auditor who crosses that line compromises the function’s objectivity, because they end up auditing their own decisions. The IIA’s position paper on internal audit’s role in enterprise risk management lists roles internal audit should not take on, among them setting the risk appetite, imposing risk management processes, making decisions on risk responses, implementing responses on management’s behalf and being accountable for risk management. The principle extends well beyond risk management.
| Internal audit may | Internal audit may not |
|---|---|
| Assess whether controls are designed and operating effectively | Design, implement or operate your controls |
| Recommend changes and comment on management’s proposed actions | Decide which action management takes |
| Advise on a new process or system before it is built, with safeguards | Approve the process or system as management, or sign off transactions |
| Report findings and ratings to management and the board | Discipline employees or decide on sanctions |
| Interview employees and request information from them | Direct your staff’s work or change their priorities |
| Report facts that suggest fraud and refer them under the organization’s procedures | Declare that someone has committed a crime, which is a matter for investigators and courts |
| Access records and data it needs | Alter records or data, or keep information longer than it needs |
| Challenge management’s acceptance of risk and escalate it | Accept or reject risk on management’s behalf |
| Conduct or support investigations where its mandate and procedures allow | Use powers it does not have: searching personal property, compelling non-employees, recording without consent where that is unlawful |
Auditors are also bound by the ethics principles in the Standards’ second domain: integrity, objectivity, competency, due professional care and confidentiality. In practice that means they must not audit work they were responsible for within the previous twelve months, must not use what they learn for any purpose other than their work, must protect it from unauthorized disclosure, and must base their conclusions on evidence. If an auditor seems to be overstepping any of these lines, the site’s guide to disagreements beyond the findings explains how to raise it.
What stays management’s decision
An audit changes what management knows, not who decides. Some managers experience a report as a set of instructions; it is better understood as information with a deadline. The decisions that stay with management are the important ones.
- How to fix a finding. Auditors recommend; management chooses the action, which may differ from the recommendation if it addresses the cause. Standard 14.4 requires a way for both sides to state their positions when management disagrees with a recommendation or action plan.
- Whether to fix it at all. Management may accept a risk rather than reduce it. Under Standard 11.5, if the chief audit executive concludes the accepted risk exceeds the organization’s appetite, it must be discussed with senior management and, if unresolved, raised with the board. The decision still belongs to management and the board, not to internal audit.
- Priorities and resources. When to do the work, with which people and what budget, within the dates agreed in the action plan.
- People decisions. Performance, discipline and staffing remain with line management and HR, even when an audit finding describes an individual’s error.
- Whether to ask for advice. Advisory work is requested by management and agreed by internal audit, which may decline work that would impair its objectivity.
Understanding this boundary helps in both directions. It means you do not have to adopt a recommendation you think is wrong, provided you can show your alternative addresses the risk. And it means the audit function will not rescue you from a decision that is yours: “internal audit told us to” is not a defense for a poor process change, and “internal audit approved it” is never true of an assurance engagement. The site’s guides to management action plans and risk acceptance by management cover the two main decisions in detail.
Authority in audits, advisory work and investigations
Internal audit does three kinds of work, and its authority feels different in each. In an assurance engagement, the ordinary audit, the function sets the scope, has full access and reports its conclusions to management and the board whether management agrees or not. In an advisory engagement, management usually asks for the work and agrees its scope with the function, and the output is advice that management may take or leave; access follows from the request, and the nature of the engagement is made clear at the start so that nobody mistakes advice for assurance. In an investigation, which some functions conduct and others support, the purpose is to establish facts about a specific allegation, and the work is governed by the organization’s investigation procedures as well as the charter, usually with legal and HR involved from the start.
The difference matters most for the person on the other side of the table. In an audit, questions are about how a process works and whether controls operate, and the answers are about the process. In an investigation, questions may be about your own actions, and different rules apply: you should be told the purpose, you may have rights under the organization’s policies, and what you say may be used in decisions about individuals. If an audit conversation turns into questions about your conduct rather than the process, it is reasonable to ask whether its purpose has changed.
What happens when someone says no
Refusals are rare, and outright refusals rarer still. Most start as delay: a request that is never quite answered, an interview that keeps being rescheduled, a system extract that is always coming next week. Auditors treat persistent delay and outright refusal the same way, because the effect on the audit is the same. The escalation path is predictable. The auditor raises it with the manager concerned, then with the audit manager and the chief audit executive, who takes it to the relevant senior executive. If it is still unresolved, it becomes a scope limitation: the report states that the auditors could not obtain the information and what that means for their conclusion. Standard 7.1 requires the chief audit executive to confirm the function’s independence to the board at least annually, including any incidents where independence may have been impaired, and the board is expected to keep internal audit free from interference in its scope, its work and its reporting, so a significant refusal reaches the audit committee by design.
| What the manager says | How it is treated | Usual outcome |
|---|---|---|
| “Not now: we are in the close; can it be the 15th?” | A scheduling request | Usually agreed |
| “Not like that: can we give you system access instead of copies?” | A proposal about form | Usually welcomed |
| “Only with legal involved: this is privileged” | A legitimate limit | A protocol agreed with counsel |
| “Only with names removed” | A legitimate data protection request | Pseudonymized data, with a key if items must be traced |
| “You do not need that” | A question about relevance | The auditors explain, or drop the request |
| Repeated delay without explanation | Treated as refusal after a reasonable period | Escalation; possible scope limitation |
| “No” | A refusal of access granted by the board | Escalation to senior management and, if unresolved, the audit committee; a scope limitation in the report |
For individual employees, refusal also has consequences under the organization’s own rules. Most codes of conduct require employees to cooperate with internal audits and investigations, and obstruction, such as refusing access, destroying records or instructing others not to cooperate, is usually a disciplinary matter. In regulated sectors it can be more than that: regulators expect the internal audit function to have full access, and a pattern of obstruction is itself a governance failing they will want to hear about. None of this should be needed in ordinary audits, and in a healthy organization it almost never is.
How authority differs by sector
The source of internal audit’s authority is the same everywhere, the board, but the weight behind it varies. In some sectors law or regulation requires the function and sets expectations of its access; in others its authority is exactly as strong as the board’s and the owners’ backing.
| Sector | What reinforces the authority | What it means for access |
|---|---|---|
| US listed companies | NYSE listing rules require listed companies to have an internal audit function; audit committees oversee it | Access is backed by an audit committee with its own obligations |
| Banks | The Basel Committee’s principles on the internal audit function in banks; national supervisors’ expectations, such as the Federal Reserve’s supplemental policy statement on internal audit (SR 13-1) | Expected access to all records, data and personnel, including the minutes of decision-making bodies; supervisors review the function |
| Insurers | In the European Union, Solvency II requires an internal audit function (Article 47) | Access and independence are supervisory matters |
| Public sector | Legislation and public sector standards; in the UK, the Global Internal Audit Standards apply with a public sector application note from April 2025 | Authority is often statutory; separate statutory auditors may have wider legal powers |
| Private and family-owned companies | The owners’ and board’s endorsement | Authority is only as strong as the charter and the owners’ backing; cultural deference can help or hinder |
| Nonprofits | The board, and sometimes funders’ requirements | Access to programs and partners may depend on grant and partnership agreements |
Culture shapes how authority is exercised more than whether it exists. In organizations where hierarchy is strongly respected, an audit function backed by the chief executive and the owners is rarely challenged openly, but staff may be reluctant to raise problems with auditors who seem to speak for the top. In flatter organizations, auditors are challenged more and trusted more. Neither changes the underlying position, and experienced auditors adapt their approach to both. For regulated financial firms, the site’s guide to what regulators expect of internal audit covers supervisory expectations in more detail.
Worked example: four access requests in one bank audit
Lakeshore Bancorp, the $9 billion regional bank used across this site, audited its commercial lending process. Four access requests during fieldwork produced four different answers, and between them they show how authority and its limits work in practice.
Credit committee minutes. The auditors asked for a year of credit committee minutes and the credit memoranda for a sample of approvals. The chief credit officer initially declined, saying the committee’s deliberations were confidential to its members. The chief audit executive called him the same afternoon, pointed to the charter’s access to “the minutes of all management and board committees”, and the minutes were provided the next morning. Nothing about the request was unusual; the refusal was a reflex, and it was treated as one.
A litigation file. One sampled loan had defaulted and was in litigation. The file included correspondence with outside counsel. The general counsel explained that showing it to the auditors risked waiving privilege and offered a privilege log and a summary of the dispute instead. The auditors accepted, tested the non-privileged parts of the loan file, including the collateral and covenant monitoring, and reported no limitation. This was a legitimate limit, and the protocol gave the audit what it needed.
Relationship managers’ text messages. Several relationship managers told the auditors they agreed terms with customers by text message from their personal phones. The auditors asked to see the messages. The bank had no policy covering personal devices, so the phones were outside the charter, and the auditors did not press. Instead, the finding they reported was about the bank: business communications with customers were taking place on channels the bank could not retain or supervise, and the policy was silent. The limit on access became the finding.
A borrower’s management accounts. The auditors wanted to check one borrower’s covenant calculations against its monthly management accounts. The borrower is a third party, and the loan agreement required only quarterly compliance certificates, so the auditors had no right to the accounts. They tested what the bank was entitled to and responsible for instead: whether the certificates had been received and reviewed on time. Four of the forty-five sampled loans lacked a current certificate, which became a finding about covenant monitoring.
| Request | Kind of limit | Answer | How the audit got its assurance |
|---|---|---|---|
| Credit committee minutes | None | Access given after a call from the chief audit executive | Direct review of the minutes and memoranda |
| Litigation file with counsel’s correspondence | Legal privilege | Privilege log and summary from the general counsel | Testing of the non-privileged loan file |
| Texts on personal phones | Personal property outside the charter | Not accessed | A finding on the bank’s communications policy and supervision |
| Borrower’s management accounts | Third party without contractual audit rights | Not accessed | Testing of the bank’s own covenant monitoring |
Questions people ask about internal audit’s authority
Can internal audit audit the chief executive or the board?
Yes, within its mandate. Executive expenses, governance processes and the way decisions are made at the top are all auditable, and some of the most valuable audits cover them. Because the chief audit executive reports functionally to the board, the audit committee, not the chief executive, decides whether such work goes ahead.
Can internal audit read my email?
Company email systems belong to the organization, and most monitoring policies allow access for legitimate purposes. In ordinary audits, auditors rarely need it; where they do, typically in investigations, access is usually authorized with legal or HR involvement and limited to what is relevant.
Can I refuse to be interviewed?
Employees are generally expected to cooperate, and most codes of conduct say so. You can ask about the purpose, ask for a convenient time, and, in an investigation, ask what the organization’s policy says about having someone with you. The site’s guide to when internal audit interviews you covers what to expect.
Does internal audit need my permission to talk to my staff?
No. The charter gives the function access to personnel, and auditors often talk to staff without their manager present. Good practice is to tell you who they will speak to and why, and to schedule around the work; if that is not happening, it is a fair point to raise with the audit lead.
Who audits internal audit?
The audit committee oversees it, the function runs its own quality assurance and improvement program, and Standard 8.4 requires an external quality assessment at least once every five years. In regulated sectors, supervisors review the function as well.
Is internal audit the same as the external auditor, or compliance?
No. External auditors are independent of the organization and give an opinion on its financial statements; compliance is a second-line function that helps management meet its obligations. The site explains the differences in its guides to internal versus external audit and internal audit versus compliance.
Related guides
- Being audited? — every guide for auditees and management, by stage of the audit.
- Creating an internal audit charter — where authority and access are written down.
- GIAS Domain III: governing the internal audit function — the board’s essential conditions.
- Disagreements beyond the findings — scope, timing, access and conduct.
- When you disagree with a finding — how findings are disputed.
- Risk acceptance by management — the decision that stays with management.
- Internal audit’s role in corporate governance — the relationship with the board.
- Internal controls and the three lines — who owns controls and who assures them.
- When will internal audit come? — how audit plans choose areas.
- What to expect during an internal audit — the engagement from start to finish.
Leave a Reply