According to IIA guidance on IT auditing, which of the following would not be an...

Internal audit examines IT governance, risk management, security, operations, change management, and control effectiveness. However, policy development is a management responsibility. Internal audit may review whether policies are adequate, approved, communicated, and followed, but it should not own or develop those policies because doing so could impair objectivity. Access system security, change management, and operations processes are all normal IT audit areas. These reviews help determine whether logical access is controlled, system changes are authorized and tested, and IT operations are reliable and secure. The boundary is simple: internal audit evaluates and advises; management designs and implements. Therefore, Option B is the activity that would not normally be examined as an audit area in the same way.