I think our issue may be relative to our environment because we have found that IF a user  has site  owner permssions at the top level site of a site collection they can indeed create a Information management  policy on any list  in the site collection where they have permssions, HOWEVER, if they have FULL CONTROL (site owner permssions) in a sub site (and not the top level site) THEN they get a access  denied page  when they try to go to the Information management policy settings  page. We do turn on publishing for our site collections so this may be a contributing factor.