> For the same reason why companies don't have their internal audit in the same org as their accountants and their financial controllers under business unit man

> For the same reason why companies don't have their internal audit in the same org as their accountants and their financial controllers under business unit managers, inherent conflict of interest. That's bogus. Having the policies be in the same org as the provider just makes sense. You can run a separate security auditing department if you're keen to do that, nothing is stopping you. You can have independent oversight while you don't totally hamstring your organization. Those auditors aren't also the ones approving expenditures, are they?