The retention and maintenance of internal audit engagement records, including the period of time they must be kept, is governed by the internal audit activity's policies and procedures. These policies provide guidance on record retention consistent with organizational requirements, legal and regulatory obligations, and professional standards.
The charter (Option A) defines purpose, authority, and responsibility but does not detail document retention.
The annual plan (Option B) outlines engagements but not recordkeeping. The quality assurance and improvement program (Option D) addresses continuous improvement and compliance with standards, not retention guidelines.
Therefore, the correct source for document retention requirements is internal audit policies (Option C).
Reference:
IIA Standards - Standard 2330: Documenting Information; Implementation Guide 2330.