According to IIA guidance, the chief audit executive (CAE) is responsible for establishing policies and procedures for the internal audit activity, including the retention of audit records. These requirements should be aligned with the organization's overall processes and procedures to ensure consistency and compliance with legal and regulatory requirements. This approach ensures that the retention policy is tailored to the specific needs and context of the organization, while also maintaining alignment with broader organizational policies.
:
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing, Standard
2330 - Documenting Information
The Institute of Internal Auditors (IIA) - Practice Advisory 2330-1: Document Retention

According to the IIA Standards, particularly in the context of risk management consulting, internal audit activities may provide risk management consulting services under specific conditions. These conditions include:
There is a clear strategy and timeline to migrate risk management responsibility back to management.
This condition ensures that the internal audit's involvement in risk management is temporary and transitional, emphasizing the principle that management retains ultimate responsibility for risk management.
The nature of services provided to the organization is documented in the internal audit charter.
This condition ensures transparency and clarity about the internal audit's role in risk management, as outlined in the internal audit charter. This documentation is essential for defining the scope and limitations of the internal audit's consulting role.
In contrast, options 2 and 3 are inappropriate under the Standards:
The internal audit activity has the final approval on any risk management decisions (Option 2): This would compromise the independence and objectivity of the internal audit function, as internal auditors should not make management decisions.
The internal audit activity gives objective assurance on all parts of the risk management framework for which it is responsible (Option 3): This creates a conflict of interest because internal auditors cannot objectively audit areas where they have direct responsibility.
IIA Reference:
IIA Standard 2050: Coordination and Reliance emphasizes that internal audit should not assume management responsibilities, including final risk management decisions, to maintain objectivity and independence.
IIA Standard 1000: Purpose, Authority, and Responsibility and related guidance stress the importance of documenting the internal audit's role in the audit charter, especially when the internal audit is involved in consulting activities like risk management.