A whistleblower line receives an anonymous tip that a warehouse supervisor is approving payments to a vendor nobody can locate. Whether that tip becomes a prosecutable case or an evidentiary mess is decided in the first forty-eight hours, mostly by people who are not investigators.
Internal audit's role in a fraud investigation is whatever the internal audit charter and organizational policy assign it, and nothing more. The exam tests three distinct postures.
- Lead investigator: The function conducts the investigation because the charter grants it that responsibility and the staff have the competency.
- Participant: The function supplies data analysis, process knowledge, and evidence support to a team led by legal, security, or an external forensic specialist.
- Observer or excluded: The function stays out to preserve independence for a later assurance engagement, or because the suspected party is inside internal audit's own reporting line.
KEY: Detecting fraud is not internal audit's primary responsibility. Management owns fraud prevention and detection. Internal audit evaluates whether management's fraud risk management is adequate, and exercises due professional care by remaining alert...
Common mistakes
- Interviewing the suspect first. The suspect is last, after evidence is established. Early confrontation lets them destroy records and align stories.
- Sampling instead of testing the population. Fraud is rare by design. A 25-item sample from 14 payments spread across thousands finds nothing; full-population analytics finds the pattern.
- Opening files before imaging. Access timestamps change on open, destroying metadata evidence. Image first, examine the image.
Bottom line
- Internal audit's investigation role is set by the charter: lead, participate, or stay out; management owns fraud prevention and detection.
- First move on suspicion: preserve evidence, notify the chief audit executive, who informs the board and legal counsel. Do not confront or expand testing unilaterally.
- Interview order runs periphery to center: neutral parties, corroborating witnesses, co-conspirators, suspect last.
- Informational interviews are open-ended and non-accusatory; admission-seeking interviews come last and rest on established evidence.
Exam shortcut
Read the stem for who is acting and when. If the auditor acts before the chief audit executive is told, the answer is wrong. Reject on sight: "interview the suspect to confirm," "notify law enforcement immediately," "expand the sample before reporting," and "resolve it with the department manager." If the stem gives a transaction pattern (amounts near a threshold, duplicate vendors, sequential invoice gaps), the tested answer is full-population data...
The full lesson (about 2,074 words, 14 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 5
Browse all free CIA Part 1 lessons or jump into free CIA Part 1 practice questions.