At Institution C, both the internal auditor and the information systems security manager agreed that
internal audit's role was to function as an adviser and consultant, rather than as a policeman looking to
write up shortcomings. As a result, there was a great deal of mutual trust: