The most important determinant of the objectives and scope of assurance engagements is the preliminary risk assessment performed by internal auditors. This assessment identifies the key risks that the engagement should address and ensures that the audit is focused on areas of highest risk and significance to the organization. While organizational charts, business objectives, and management requests are important inputs, the internal auditors' preliminary risk assessment ensures that the audit addresses the most critical areas. Reference:
The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 2210 - Engagement Objectives.
The IIA's Practice Guide on Engagement Planning.