230. The Board should define, approve and put in place an internal audit charter.
231. The internal audit activity should adhere to the International Internal Auditing Standards (IIAS)
and Code of Ethics.
232. An internal audit plan or activity should –:
(a) follow a risk based approach;
(b) be informed by the strategy and risks of the company;
(c) be agreed and approved by the audit committee;
(d) be independent of management;
(e) be an objective provider of assurance predicated on -:
(i) the risks that may prevent or slow down the attainment of strategic goals;
(ii) whether controls are in place and functioning effectively to mitigate risks;
(iii) the opportunities that will promote the attainment of strategic goals as may be
identified, assessed and effectively managed by the company’s management
team;
(f) submit to the Board at least once a year a written assessment of the effectiveness of
the company’s system of internal control and risk management;
(g) form an integral part of the combined assurance model as an internal assurance
provider; and
(h) submit to the audit committee a written assessment of internal financial controls.
233. Management should specify the elements of the risk control framework.

• According to the NATIONAL CODE ON CORPORATE GOVERNANCE ZIMBABWE