Can internal audit help document controls and still provide assurance later?

It depends on the role internal audit plays. Internal audit may document its understanding of processes and controls as part of an engagement. It may also provide advisory support, templates, facilitation, and recommendations. But management should approve the control design, own the process documentation, assign control owners, and decide remediation.

If internal audit designs the controls or operates them, later assurance over those same controls creates an objectivity concern. A safer model is to label documentation assistance as advisory, record management's decisions, and consider safeguards before internal audit provides assurance over the area later.

For CIA purposes, keep the boundary clear: internal audit can advise and evaluate, but management owns internal control.