# 9. How can audit, compliance and security share evidence without sharing away their independence?

**A good answer should separate common information from independent scope, judgement and approval rights.**

**Why it matters to buyers.** The IIA published refreshed Statements of Position on 8 July 2026. Its Three Lines material supports coordination and appropriate reliance while retaining safeguards for independence and objectivity, including where the chief audit executive has second-line responsibilities. ([theiia.org](https://www.theiia.org/en/resources/statements-of-position))

**Put it to:** Norman Marks, Carole Switzer and the buyer’s chief audit executive.

**A strong answer should cover:**
- Who owns the control, supplies evidence, performs testing and approves conclusions.
- Which evidence may be reused and what evaluation is needed before relying on another function’s work.
- Separate management responses, audit workpapers and final conclusions.
- Protection against self-review, inappropriate changes and restricted escalation.
- How platform administration is governed where administrators support functions being audited.

**Ask for proof:** run the same finding through control owner, compliance reviewer and auditor accounts. Test whether each can perform authorised work without rewriting another function’s conclusion or concealing its history.

The IIA’s 2026 statement explicitly treats independence as more than isolation: it addresses reporting lines, autonomy, access, resources and safeguards. Do not let an access-control demonstration stand in for that broader organisational assessment. ([theiia.org](https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf))

**Follow-up:** “Which independence risk remains even if every permission setting works correctly?”

> **Expert quote — pending interview:** [Insert approved quotation and attribution.]