CIA-1 - Fraud Risks (15% of the exam) - Section D.5
Recognize techniques and the internal audit function's role related to fraud investigation, including interviewing, investigation techniques, fraud testing methods, and coordinating with fraud investigators.
Define the internal audit function's role in relation to fraud investigations, which is typically to support and coordinate rather than to lead, unless the mandate provides otherwise. Describe interviewing and investigation techniques and fraud testing methods at a conceptual level, and recognise opportunities for auditors to coordinate with dedicated fraud investigators and to review their risk assessments, prior investigations, trends, and whistleblower complaints.
The audit committee of Renshaw Group asks the chief audit executive how internal audit should contribute to the organisation's response to a spate of suspected frauds, given that a specialist forensic team leads investigations. Which contribution best fits internal audit's proper role?
ATake over the leadership of each investigation from the specialist forensic team in order to ensure objectivity.
BDecide the guilt of the suspects and recommend the specific penalty that each of them should receive.
CWithdraw from all fraud-related matters entirely, on the basis that fraud response is solely a management concern.
DSupport the forensic team and review fraud risk assessments, prior investigations, and emerging trends to strengthen controls.check_circle Correct
Internal audit's role in fraud response is to support investigators and review risk assessments, prior investigations and trends, not to lead cases or judge suspects. Where a specialist team leads investigations, internal audit adds value by supporting that team and reviewing fraud risk assessments, prior investigations and emerging trends to strengthen controls; taking over the case, deciding guilt or withdrawing entirely all misstate the function's supporting and assurance role.
Why A is wrong: Leading investigations may sound like a strong use of independence, but it displaces the specialists and pulls internal audit out of its assurance and coordination role.
Why B is wrong: Judging guilt and setting penalties is tempting as a decisive contribution, yet those are management, legal and forensic responsibilities, not internal audit's.
Why C is wrong: Fraud response is a management responsibility, but withdrawing wholesale ignores internal audit's legitimate assurance and coordination contribution to it.
Why D is correct: This is internal audit's proper contribution: supporting the investigators while reviewing risk assessments, past cases and trends to help improve controls, keeping objectivity intact.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
The external auditor's management letter and the published annual report taken alone.
errorWhy it is wrong: These documents can mention control matters, but on their own they are too high level and backward looking to reveal fraud hotspots, so relying on them alone is the weaker choice.
Interview the warehouse manager directly to try to obtain an admission of guilt before anyone else in the organisation is alerted.
errorWhy it is wrong: Confronting the suspect early feels decisive, but it can tip off the wrongdoer, destroy evidence and compromise a formal investigation the auditor is not mandated to lead.
Internal audit should take command of the investigation, direct the forensic specialists, and decide the disciplinary outcome for those involved.
errorWhy it is wrong: This is tempting because internal audit understands the organisation's controls, but casting the function as the lead investigator overstates its role and can compromise its later objectivity, so it is wrong.