How should internal audit handle whistleblower evidence during an engagement?

Question

AcadiFi · Accepted Answer

Whistleblower evidence should be treated as a serious lead, not as an automatic conclusion. Internal audit needs to protect confidentiali...

Unlock with Scholar — $19/month

Get full access to all Q&A answers, practice question explanations, and progress tracking.

Start 7-Day Free Trial Compare Plans

No credit card required for free trial

Suppose a former employee of fictional Alder Grove Housing sends documents suggesting that maintenance invoices were split to avoid approval limits. The audit team should log when the documents were received, restrict access, notify the appropriate investigation or ethics channel if required, and compare the documents to system records. They might test invoice sequences, vendor master changes, approval timestamps, and payment history.

```mermaid
flowchart TD
  A[Whistleblower information] --> B[Secure and log evidence]
  B --> C[Assess credibility]
  C --> D[Corroborating procedures]
  D --> E[Legal or ethics escalation]
  D --> F[Supported audit conclusion]
```

The team should avoid promising outcomes to the whistleblower or disclosing details unnecessarily. If fraud may be involved, internal audit may need to coordinate with legal, compliance, or a designated investigations function while maintaining objectivity.

For the CIA exam, the best answer usually balances responsiveness with due professional care. Do not ignore the lead, but do not write a final finding based only on uncorroborated documents. Evidence quality still governs. Practice more in our CIA question bank.

How should internal audit handle whistleblower evidence during an engagement?

Master Part 2 with our CIA Course

Related Questions

Practice Questions