A newly appointed IS audit manager discovers that the internal audit function has been operating without a formally approved audit charter for the past two years. The manager wants to establish the charter's authority appropriately. To BEST ensure the audit function's independence and organizational authority, who should approve the audit charter?