Incorrect, the internal auditor does not initially write the controls.
Incorrect, the management writes the ethical conduct code.
Incorrect, this is a duty of the outside auditor.
Correct, the internal auditor is an advisor or staff member of the organization.