Under ISA 240, when an auditor identifies or suspects fraud involving management, especially senior management, the auditor must communicate the matter to those charged with governance unless clearly inappropriate. Because Jeffrey is the CEO, reporting directly to him would not be appropriate. The auditor should not immediately report to a government authority unless law, regulation, or professional duty requires external reporting. The auditor also should not remain silent simply because legal liability might exist. Confronting the CEO to obtain a confession is not the auditor’s role and could compromise the audit, investigation, or evidence. Those charged with governance, such as the board or audit committee, are responsible for oversight and should be informed of suspected senior management fraud. Therefore, option B is correct.

The internal audit function has an important role in evaluating governance, risk management, controls, and fraud risk management activities. Its reporting should include significant risk and control issues, including fraud risks, governance issues, and matters requiring attention from senior management or the board. Therefore, if management does not cooperate with the assessment of fraud risk management, that fact is relevant and should be communicated to the board. Internal audit should not wait until fraud occurs before communicating about fraud risk. It also should not hide fraud audit results from senior management or the board in the name of independence. Fraud communication is not solely a legal department responsibility. Accordingly, option D best reflects the internal audit function’s reporting responsibilities concerning fraud.

The ACFE Code of Professional Ethics requires fraud examiners to continually strive to increase the competence and effectiveness of the professional services performed under their direction. Related professional standards also require due professional care, adequate planning, and competence supported by appropriate education and experience. A complex international money laundering engagement involving multiple jurisdictions and technologies requires more than minimal exposure through a seminar. Accepting such an engagement without sufficient competence and choosing to handle it alone would fall short of the ethical obligation to perform only with proper capability and professional care. The violation does not depend on whether banking regulations were broken or whether Benjamin ultimately found fraud. The problem is accepting and conducting work beyond his demonstrated competence.

 Fraud Risk Management Program Requirements:

A fraud risk management program includes mechanisms to detect and respond to noncompliance, sanctions for violations, and measures to address control failures.

 Why B is Incorrect:

Responsibility for handling suspected incidents should remain within the organization, typically assigned to compliance officers or internal audit teams. Delegating it to external parties undermines internal governance.

 Why Other Options are Correct:

A, C, and D describe essential elements of a fraud risk management program, including monitoring, sanctions, and corrective measures for anti-fraud controls​​.

Purpose of the Task:

The team seeks candid feedback on ethical tone, which requires a confidential and direct interaction method.

Comparison of Techniques:

A. Interviews:Effective for obtaining one-on-one feedback in a private setting.

B. Focus groups:Group dynamics may inhibit candid responses due to peer pressure.

C. Anonymous feedback mechanisms:These provide insights but lack the depth and follow-up opportunities of interviews.

D. Surveys:While useful for broad input, surveys are less effective for detailed exploration of ethical tone.

Conclusion:Interviews are the most helpful technique for gathering one-on-one candid feedback.

Employee background checks are considered a preventive control because they are designed to identify potentially risky hires before employment. The manual states that “background checks are a front-line preventive measure in combating fraud by screening out individuals who pose higher risk.”

Management is ultimately responsible for setting the organization’s ethical tone. This concept is commonly called “tone at the top.” A strong anti-fraud culture depends on management demonstrating, communicating, and enforcing ethical expectations consistently. Fraud examiners can investigate allegations and advise on controls, but they do not set the organization’s culture. General counsel can advise on legal obligations, and human resources can help administer policies, discipline, and training, but neither replaces management’s responsibility for ethical leadership. Employees observe whether senior leaders follow the same standards they impose on others. If management tolerates misconduct, applies rules inconsistently, or ignores warning signs, the fraud prevention program becomes less effective. Therefore, the party ultimately responsible for setting and reinforcing ethical tone is management, making option D correct.