e. The role of the internal audit activity in investigations needs to be defined in its charter as well as in fraud policies and procedures.
1) For example, internal auditing may
a) Have the primary responsibility for fraud investigations,
b) Act as a resource for investigations, or
c) Avoid involvement because it is responsible for assessing investigations or lacks resources.
2) Any role is acceptable if its effect on independence is recognized and managed appropriately.
3) Internal auditors typically not only assess investigations but also advise management about the process, including control improvements.
4) To maintain proficiency fraud investigation teams must obtain sufficient knowledge of (a) fraudulent schemes, (b) investigation techniques, and (c) applicable laws.
5) If the internal audit activity is responsible for the investigation, it may use in-house staff, outsourcing, or a combination.