1. External – scope should be unlimited/determined by statutory responsibilities. Internal – the audit committee (if there is one – otherwise the board) – see page 14 of our notes. 2. Audit committee or board 3. Whoever has responsibility – e.g. may be delegated to an HR department – but head of internal audit may have a say/make a recommendation.