If management asks internal audit to draft a policy, does that impair independence?

Question

AcadiFi · Accepted Answer

The safest CIA answer is that management owns policy creation, while internal audit provides independent assurance and, in some settings, limited advisory input. Drafting the policy yourself can create an independence or objectivity problem if you later audit the same process because you would be reviewing work you helped design.

Imagine Aurora Freight, a logistics company with revenue of $26 million. Its finance director asks internal audit to write a new expense-reimbursement policy with controls for approvals above $1,200. If internal audit fully authors the policy, selects the approval design, and later audits compliance with that same design, objectivity is weakened. A better approach is for management to draft or own the policy, while internal audit reviews the draft, asks challenge questions, highlights missing control points, and documents the advisory nature of its involvement.

The practical test is ownership. Who is accountable for designing, approving, operating, and maintaining the process? If the answer is internal audit, the line has probably moved too far. If the answer is management and internal audit is only advising, the risk is lower, though safeguards and disclosure may still matter.

On the exam, choices that preserve independence in fact and appearance usually win over choices that make internal audit part of management's first-line duties. Practice more in our CIA question bank.

If management asks internal audit to draft a policy, does that impair independence?

Master Part 1 with our CIA Course

Related Questions

Practice Questions