A staff auditor, nearly finished with an audit engagement, discovers that the director of marketing has a gambling habit. The gambling issue is not…

The auditor's actions were appropriate and professionally responsible. The gambling habit is a potential fraud risk indicator, but it is outside the scope of the current engagement. The auditor did not ignore the information; instead, they documented it and escalated it to the appropriate level of authority, the Chief Audit Executive (CAE). The CAE is responsible for managing the internal audit activity's resources and determining how to address such information, which may include initiating a separate investigation or a new audit. The staff auditor fulfilled their duty by reporting the matter and can continue to complete their assigned engagement.

A. The auditor did not withhold information. They disclosed it to the CAE, which is the correct internal reporting channel for such a sensitive and out-of-scope issue.
B. The auditor did follow up appropriately by escalating the red flag to the CAE. A staff auditor is not typically authorized to unilaterally expand an engagement or begin a new one.
D. The auditor did not violate the Code of Ethics. By reporting the issue to the CAE, they demonstrated integrity and objectivity, ensuring the information was handled by the appropriate authority.

1. The IIA, International Standards for the Professional Practice of Internal Auditing (Standards), January 2017.

Standard 1220: Due Professional Care: The Implementation Guide for this standard states, "When an internal auditor suspects wrongdoing, he or she must inform the appropriate parties within the organization." The CAE is the appropriate party within the internal audit function. The auditor's action aligns with this guidance.

Standard 2060: Reporting to Senior Management and the Board: "The chief audit executive must report periodically to senior management and the board on...significant risk and control issues, including fraud risks..." This establishes the CAE's role as the central point for handling such information, justifying the staff auditor's decision to report to them.

2. The IIA, Code of Ethics, January 2017.

Rule of Conduct 2.3 (Integrity): "Internal auditors...shall disclose all material facts known to them that, if not disclosed, may distort the reporting of activities under review." The auditor's disclosure to the CAE fulfills this requirement. They did not conceal the information.