Advisory Work and Self-Review Risk: Design Safeguards

Internal audit can advise on change without becoming responsible for the decisions it may later assess.

The boundary that matters

A company asks internal audit to help redesign its procurement approval workflow. The audit team facilitates risk workshops, identifies control gaps, and presents alternative designs. Six months later, the audit plan includes assurance over the same process. Can the team audit the workflow it helped shape?

The answer is not an automatic yes or no. The crucial questions are what the auditors actually did, whether they assumed management responsibilities, whether objectivity could reasonably be questioned, and what safeguards are implemented.

Advisory does not mean management ownership

Advisory services can add value through structured challenge, risk insight, and options analysis. Management should retain responsibility for selecting the design, approving risk responses, implementing controls, and operating the process. Internal audit should document the agreed advisory scope and clarify that recommendations do not constitute management approval.

Recognize the self-review threat

If auditors design, approve, or operate a control and subsequently provide assurance over it, they may be placed in the position of evaluating their own work. Even without actual bias, the appearance of compromised objectivity can undermine confidence in the assurance conclusion.

The IIA Global Internal Audit Standards, Standard 2.2, requires auditors to avoid or mitigate actual, potential, and perceived impairments to objectivity. When the internal audit function provides assurance over an area where it previously delivered advisory services, the chief audit executive must confirm the advisory work did not impair objectivity and assign resources to manage individual objectivity. Standard 2.3 addresses disclosure of impairments. This is a conditional safeguard framework, not a blanket prohibition on later assurance.

A practical fictional example

Scenario: Internal audit facilitates a procurement risk workshop and recommends that management consider maker-checker approval, threshold-based authority, and exception reporting. Management evaluates options, chooses the design, approves the procedure, and implements it.

Lower-risk arrangement: Internal audit documents its advisory contribution, management decision records, and boundaries. A separate auditor who did not develop the recommendations is assigned to test the new controls, subject to the CAE's assessment of objectivity.

Higher-risk arrangement: The original advisory auditor writes the final approval matrix, approves the system configuration, signs off implementation, and then leads assurance over that configuration. Here the auditor has potentially assumed management responsibilities and is effectively reviewing their own decisions.

These are illustrative professional judgments, not findings about a real organization.

Five safeguards that should be considered

1. Define the mandate: Document advisory scope, decision rights, deliverables, and management accountability.
2. Keep decisions with management: Audit may offer options and challenge assumptions; management selects and owns the solution.
3. Record involvement: Maintain a transparent trail of recommendations, approvals, and any operational responsibility.
4. Assess objectivity before assurance: The CAE considers the nature of prior advisory work, individual involvement, perceived impairment, and resource assignments.
5. Escalate and disclose impairments: Use the audit function's established methodology and appropriate governance channels; consider independent oversight or alternative assurance arrangements when required.

A board-level question

The question is not simply, “Did internal audit advise on this process?” It is, “Can the board reasonably rely on an impartial assurance conclusion given the audit team's prior role?”

The objective is to preserve both advisory value and assurance credibility. Strong boundaries allow internal audit to contribute to improvement without becoming the owner of the controls it may later evaluate.

Beyond the numbers. Inside the business.