Senior management at a financial institution has received allegations of fraud at its derivatives trading desk and has asked the internal audit activity to investigate and issue a report concerning the allegations. The internal audit activity has not yet developed sufficient proficiency regarding derivatives trading to conduct a thorough fraud investigation in this area. Which of the following courses of action should the chief audit executive (CAE) take to comply with the Standards?
When the internal audit activity lacks sufficient proficiency to conduct a thorough fraud investigation, especially in a specialized area such as derivatives trading, the appropriate course of action is to engage an external expert with the necessary experience. This approach ensures that the investigation is thorough and meets the required standards. By contracting with an external certified fraud examiner with derivatives experience, the internal audit activity can still oversee the process and maintain responsibility for the coordination of the investigation, ensuring that the findings are reliable and support the CAE's report to senior management.
The CAE retains the responsibility and the coordination even if the audit engagement is co-sourced or outsourced.
Because with C it seems that the auditor is giving orders to Senior Management: look at the verbs used: "Request that senior management..." and "Contract with an external CFE..."
If the auditor does not have expertise in the subject matter, he should exclude himself from it, right ? Then why not C ?