d. Management implements controls over the investigation. They include (1) developing policies and procedures, (2) preserving evidence, (3) responding to results, (4) reporting, and (5) communications.
1) Such standards often are documented in a fraud policy, and the internal audit activity may assist in the evaluation of the policy.
2) Policies and procedures address (a) the rights of individuals; (b) the qualifications of investigators; (c) the relevant laws; and (d) the disciplining of employees, suppliers, or customers, including legal measures.
3) The authority and responsibilities of those involved in the investigation, especially the investigator and legal counsel, should be clear.
4) Internal communications about an ongoing investigation should be minimized.
5) A policy needs to specify the investigator’s role in determining whether a fraud has been committed. Either the investigator or management decides whether fraud has occurred, and management decides whether to notify outside authorities.