You are an information system auditor for HDA Inc., and you are helping to set up the privacy program for an organization. Which of the following is a role that internal audit could play in helping to set up the program without impacting its independence ?