The most accurate statement regarding the internal audit charter according to IIA guidance is that the charter must be approved by both senior management and the board. This ensures that the internal audit activity's purpose, authority, and responsibility are clearly defined and acknowledged by the organization's leadership, facilitating alignment with organizational governance.
The IIA's guidance on internal audit charters, which emphasizes approval by senior management and the board as a key requirement.

According to IIA standards, the internal audit activity should assist in maintaining effective controls but should not assume management's responsibilities, such as implementing or ensuring controls, to preserve its independence.

The organization aspect of an internal audit charter relates to the reporting structure for the internal audit activity. It establishes the position of the internal audit activity within the organization, and defines its functional and administrative reporting lines. The organization aspect also ensures that the internal audit activity has sufficient independence and authority to perform its work effectively and objectively.

In developing a formal internal control framework, globally accepted frameworks such as COSO or COBIT emphasize the importance of organization-wide objectives. These objectives provide a foundation for aligning internal controls with the organization's goals, ensuring comprehensive coverage and relevance of the control framework.
* Option A: Independent assessments are part of the assurance process but not the foundation of the framework.
* Option B: Continuous monitoring is a control activity within the framework.
* Option C: Business continuity and backups are specific control activities but not foundational elements of the framework.
COSO Internal Control - Integrated Framework.
COBIT Framework for IT Governance and Control.

According to the IIA guidance on using the maturity model for assessing an organization's risk management program, a key activity to examine is "Monitor and Review." This element evaluates how well the organization continues to monitor its risk environment and reviews the effectiveness of risk management strategies over time. It is crucial for ensuring that risk management adapts to changes and continues to align with organizational objectives.
Institute of Internal Auditors (IIA) - Guidance on Risk Management Maturity Models