When taken by a chief audit executive, which of the following actions would be most likely to prevent division management from exaggerating sales…

The most effective strategy to prevent the exaggeration of sales reports combines a strong ethical directive with a robust, continuous monitoring control. Issuing a policy statement from top leadership (the president and the board) establishes a clear "tone at the top," which is a fundamental component of the control environment and a primary preventative measure against fraud. Assisting the controller in developing and monitoring correlated, independent business process indicators creates a powerful deterrent. Management is less likely to exaggerate sales if they know that the falsified data will not align with operational metrics (e.g., shipping volumes, raw material usage) and that these discrepancies will be flagged automatically and continuously.

1. Announcing a series of internal audit engagements focusing on compliance with corporate sales-reporting policies. This is a detective and deterrent control, but audits are periodic and sample-based, making them less effective for ongoing prevention than continuous monitoring.
3. Setting up a hotline for employees to report fraudulent behavior anonymously. While a valuable detective control, a hotline's preventative power is indirect, relying on a potential wrongdoer's fear of being reported by others, which is less certain than data-driven detection.

1. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control – Integrated Framework: Executive Summary.

Page 4, Control Environment: "The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The board of directors and senior management establish the tone at the top regarding the importance of internal control including expected standards of conduct." This supports the effectiveness of Option 2.

Page 6, Monitoring Activities: "Ongoing evaluations, built into business processes at different levels of the entity, provide timely information." This supports the continuous monitoring approach described in Option 4.

2. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing.

Standard 2110 – Governance: "The internal audit activity must assess and make appropriate recommendations to improve the organization’s governance processes for... promoting appropriate ethics and values within the organization." This standard validates the CAE's role in advocating for the policy statement in Option 2.

Standard 2130 – Control: "The internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement." This supports the CAE's advisory role in developing monitoring indicators as described in Option 4.

3. Gramling, A. A., & Schneider, A. (2018). The Role of the Internal Audit Function in the Corporate Governance of Fraud Prevention. Journal of Forensic and Investigative Accounting, 10(2).

This article discusses that a strong tone at the top and an ethical culture are critical deterrents to fraudulent financial reporting. It also emphasizes the value of internal audit's involvement in evaluating and recommending controls, such as analytical procedures (similar to Option 4), that can detect anomalies indicative of fraud. This publication supports the combined effectiveness of Options 2 and 4.