That is a great question.
While I am new to the role, I have been in the office about 15 years, and I must admit that I don't know whether or not our office has been consulted on developing other policies in the past.
I do know that we have provided advice on controls. Many of our audits do comment on gaps in policy, when we look at the implementation of a policy to see whether it's done effectively. As I mentioned, you do need to be cautious about being too involved up front and doing management work when you're then going to come in and audit. That's not our domain. Our domain is to audit the implementation of a policy and not to create the policy.