# 16. Can risk, compliance and internal audit share a GRC platform without compromising independence?

A shared platform can be evaluated without assuming shared decision rights. The IIA’s refreshed Three Lines material, published on 8 July 2026, emphasises coordination alongside safeguards for internal audit independence; its accompanying podcast explicitly distinguishes independence from isolation. [Current statements](https://www.theiia.org/en/resources/statements-of-position) · [IIA podcast and transcript](https://www.theiia.org/en/content/podcast/getting-started-with/2026/ep-0040/). ([theiia.org](https://www.theiia.org/en/resources/statements-of-position))

Our recommended platform design separates:

- Management’s control operation and self-assessment.
- Second-line monitoring, challenge and review.
- Internal audit’s scope, workpapers, conclusions and reporting.

Share suitable reference information and evidence, but retain separate conclusions and approval responsibilities. Ask who can modify an audit finding, change its rating, approve management’s response and determine whether follow-up work is complete.

**Demonstration test:** management disputes an audit conclusion. Management must be able to record its response without overwriting the auditor’s conclusion or removing the original supporting record.

Review administrative privileges as well as ordinary roles. Technical access to maintain the platform should not become unreviewed authority to alter assurance records.

Finally, map responsibilities beyond the software. Permission settings do not, by themselves, settle organisational independence, reporting lines or conflicts arising when an assurance function owns the process it later assesses.