Should internal audit operate automated control tests for management?

Usually no. Internal audit can use automated tests as audit procedures and can advise management on monitoring ideas. But if the test is needed to manage risk during normal operations, management should own and operate the control.

For example, if a test identifies high-risk vendor bank changes that need monthly review, internal audit should not quietly become the monthly control owner. Internal audit may validate the idea, recommend management-owned monitoring, and later test whether the control is designed and operating effectively.

The CIA logic is role clarity. Internal audit provides assurance and advice; management owns risks, controls, and responses.