Nord Utilities is building a new customer billing system. The project sponsor asks the internal audit function to advise on the control requirements while the system is still in design. Which approach best preserves the internal auditor's objectivity during this advisory engagement?
- AApprove the final control design on management's behalf so that the delivered controls meet the audit function's expectations.
- BDecline the request and advise management to engage an external consultant to advise on the control design instead.
- CRecommend suitable controls and let the project team decide which to build, documenting that management retains the decision. Correct
- DDesign and implement the required controls directly, then exclude the billing system from all future audit coverage.
Why A is wrong: Approving the design looks efficient, but deciding on the controls transfers management responsibility to the auditor and impairs any later assurance over the system.
Why B is wrong: Handing the work to an outside consultant looks conservative, but advisory work on a system in design is permitted when the auditor advises rather than decides, so declining forgoes legitimate value the function could add.
Why C is correct: An advisory engagement lets the auditor recommend controls while management keeps the design decision, so no management responsibility is assumed and later assurance stays possible.
Why D is wrong: Building the controls may seem helpful, but it takes on a first-line role and dropping the system from coverage abandons the audit mandate rather than protecting objectivity.