According to HA guidance, if an internal auditor suspects fraud during an assurance engagement, what should the auditor do first?

Question

Options

• ARecommend parties involved to be sanctioned in accordance with the organization's policy.
• BDetermine whether any additional audit work needs to be performed.
• CLaunch an investigation to obtain details of the fraud and parties involved.
• DRequest that the responsible process owner remediate the issue immediately.

• A
  14% (7)
• B
  76% (37)
• C
  4% (2)
• D
  6% (3)

Explanation

When an internal auditor suspects fraud, the key word is suspects - the suspicion has not been confirmed. Per IIA Standards, the auditor must first determine whether additional audit procedures are warranted to substantiate or rule out the suspicion before taking any other action (B); jumping ahead would be premature and potentially harmful to a fair process.

Why the distractors are wrong:

• A (Recommend sanctions): Recommending punishment before fraud is even confirmed conflates the auditor's assurance role with a disciplinary one - that authority belongs to management/HR, not the auditor.
• C (Launch an investigation): Formal fraud investigations are typically outside the internal auditor's standard assurance scope and require specialist involvement; the auditor's first step is not to investigate, but to assess whether more audit work is needed.
• D (Request immediate remediation): You cannot remediate something that hasn't been confirmed; demanding action on an unverified suspicion is both procedurally wrong and potentially unfair to process owners.

Memory tip: Think of the auditor as a gatekeeper, not a judge - before escalating to management, investigators, or sanctions, the auditor must first decide: "Do I have enough evidence to even take the next step?" That decision = B.

No community discussion yet for this question.