While conducting a payroll audit, an internal auditor in a large government organization found inadequate segregation in the duties assigned to the assistant director of personnel. When the auditor explained the risk of fraud, the assistant director became upset, terminated the interview, and threatened to sue the organization for defamation of character if the audit engagement was not curtailed. The auditor discussed the situation with the chief audit executive (CAE). The
CAE should then:
The correct course of action for the chief audit executive (CAE) is to provide a report to senior management recommending a fraud investigation. This approach ensures that senior management and possibly the board are informed of the potential risks and can take appropriate actions. Curtailing the audit engagement to avoid legal action would undermine the integrity of the audit function. Continuing the engagement with just a comment about the reaction does not address the fraud risk comprehensively. Adding additional testing may be useful, but reporting to senior management is critical to ensure that the issue receives the appropriate level of attention and action.
why not C
C will not adequately cover the fraud risk