The authority of the Internal audit activity is limited to that granted by.

Answer is C. Management and board together have a say in the internal audit charter. 

The authority of the Internal audit activity is limited to that granted by the Management and the Board. Normally, Internal Audit act on behalf of the management and the Board.

Answer (C) is correct.

REQUIRED: The source of authority of the Internal audit activity

DISCUSSION:The purpose,authority,and responsibility of the Internal audit activity must be formally defined in a charter,The CAE must periodically review and present the charter to senior management and the board for approval

Answer (A) is incorrect, The controller is not the only member of management .Answer (B) is incorrect,The standards cannot provide actual authority to an internal audit activity. Answer (D) is incorrect, Management and the board ,not a particular manager,give the internal audit activity its authority.

Option (D) is the right answer, because C.F.O is part of the board, as a matter of fact he chairs board meetings. So this is the highest authority and it is them who set scope of internal audit department and it's them, to whom auditor report on his findings.

The board and the controller.

Board and the Controller option is the right answer