Are there internal auditors who write policies for various areas of the bank? When I write up in my findings to have a policy for a particular area, management responds with they will be willing to view the policy internal audit wants to write.

As an internal auditor I have never and would never write policy for management.

I'm right there with Dazed Auditor. To assist management with that task you can provide some guidance such as "a comprehensive policy should include...". Ultimately these are management decisions, not IA.

The auditor audits for compliance to the policy. They do not write them. That is management's responsibility.

"If you already know what should be in the policy, go ahead and write it. Why should I reinvent the wheel?"

Uh, because I can't audit myself? Here is what we have in our audit charter/policy:

The Board and its Audit Committee should ensure that internal audit staff is independent of bank management. The audit staff should be free of management influence as to scheduling, audit hours budgeted, and report findings. Members of the Audit Department should not have the responsibility of fixing internal control deficiencies, correcting deviations from bank policies and procedures, writing policies, or otherwise becoming part of the process under audit review as this impedes audit objectivity and independence.

You can always have a little chat with your audit committee chairman and/or examiners if you have a good relationship with them. If your audit chairman can't/won't educate management, your examiners should be able to discuss audit independence.

Thank you all for your input!

As the internal auditor, if I see a deficiency in a certain policy/procedure, it would be irresponsible to not notify management and recommend something more appropriate. For instance, if I see an employee possessing incompatible duties, part of my job is to notify management/audit committee of the internal control weakness and make an appropriate recommendation. Does that mean that internal control can't be put in policy because I "wrote" it?

Creating a policy/procedure and performing operations guided by that policy/procedure are two different things.

The acceptance and approval of policies/procedures are still the responsibility of management and the Board....so, if my experience and expertise enables me to strengthen the policies of my Bank through recommendations, how can I not offer those suggestions???

Making a recommendation is not "writing a policy".