The International Standards for the Professional Practice of Internal Auditing are clear: Internal auditors must possess the knowledge, skills, and competencies needed to carry out their responsibilities. Some internal auditors also have the knowledge and skills to carry out a fraud examination effectively, but most do not. And in an upcoming position paper, The IIA emphasizes that internal auditors should not be expected to have the expertise of those professionals whose primary responsibility is to investigate fraud. The IIA believes fraud investigations are best carried out by those experienced to undertake such assignments.
Hopefully, your organization has a fraud response plan that assigns specific duties and responsibilities. But if not, don’t automatically assume that, as an internal auditor, you should undertake a fraud investigation single-handedly or that you should lead a fraud investigation team yourself.
We all need to be familiar with the indicators of fraud, and we need to be able to evaluate anti-fraud controls. But few internal auditors are fully equipped to be fraud investigators. An interrogation is very different from an audit interview, and there can be great risk between reviewing evidence and contaminating it. When fraud is suspected, a simple mistake can easily become a costly and career-limiting move.
I have seen too many instances during my career where well-intentioned internal auditors inadvertently damaged the chances of a successful fraud investigation because they were either careless or simply didn’t understand the risks of their actions. I always cautioned my teams to be careful not to “break the eggs” when they came upon a potential fraud during the course of an internal audit. From my experience, the following are just a few types of mistakes that internal auditors can make when they encounter evidence of fraud.
Fraud investigations can be high-risk engagements. If you think there is a possibility of fraud, don’t break the eggs. You should not take any action that might tip off potential fraudsters or compromise evidence so that it can’t be investigated later. I don’t mean to imply that internal audit should never be involved in fraud investigations, but if the internal auditors are not fully trained investigators, it’s time to seek help from specialists. A wise internal auditor understands the limits of his or her own knowledge and knows when to ask for help.
I look forward to your thoughts on this important subject.