Can an auditor build a risk-control matrix without taking ownership of management's controls?

The auditor can build an audit working version of a risk-control matrix to plan and document the engagement. That is different from designing management's control framework. The distinction should be visible in the workpapers and in the report.

An audit working matrix says, in effect, "Based on walkthroughs and evidence, this is how internal audit understood the objective, risk, expected control, actual practice, owner, and evidence." Management still must decide whether the controls are accurate, sufficient, approved, and sustainable. If management wants a formal control inventory, the recommendation should require management to create, approve, and maintain it.

Objectivity becomes more exposed if internal audit chooses the control response, writes the policy as the owner, or operates the monitoring process. A safer advisory role is to facilitate discussion, provide examples of good criteria, document decisions made by management, and avoid later assurance work unless safeguards are in place.