Internal, External and Government Auditors
5 minutes
5 Questions
In the CFE curriculum, auditors are grouped into three categories, each with distinct fraud-related responsibilities. Internal auditors are employees of the organization (or outsourced providers) who evaluate the effectiveness of governance, risk management, and internal controls. Under the IIA's International Professional Practices Framework, they must possess sufficient knowledge to evaluate the risk of fraud and how the organization manages it, though they are not expected to have the expertise of a fraud investigation specialist. Standards require them to consider fraud risk when developing engagement objectives, assess the organization's fraud risk exposure, and report significant fraud indicators to senior management and the board. They often support anti-fraud programs, assist with investigations, and recommend control improvements, but detecting all fraud is not their primary purpose. External auditors are independent CPAs who express an opinion on whether financial statements are fairly presented. Their fraud duties are defined by AU-C Section 240 (AICPA), PCAOB AS 2401 for public companies, and ISA 240 internationally. They must plan and perform the audit to obtain reasonable (not absolute) assurance that statements are free of material misstatement due to error or fraud. Required procedures include brainstorming among the engagement team, exercising professional skepticism, inquiring of management and others, identifying and responding to fraud risks (including presuming revenue recognition and management override as risks), and communicating identified fraud to management, those charged with governance, and in some cases regulators. The Sarbanes-Oxley Act added internal control attestation (Section 404) and auditor independence rules. Government auditors work for agencies such as the GAO or state audit offices, following Generally Accepted Government Auditing Standards (the 'Yellow Book'). They audit public entities and recipients of government funds, performing financial audits, attestation engagements, and performance audits. GAGAS requires them to design procedures to detect fraud, noncompliance with laws, regulations, and grant agreements, and abuse that could be material, and to report such findings to appropriate officials or oversight bodies. Collectively, all three provide layers of assurance, but none guarantees fraud detection, which is why CFEs complement their work.
Internal, External and Government Auditors: Fraud-Related Responsibilities (ACFE CFE Exam Guide)
1. Why This Topic Matters
Auditors are often the first professionals the public, boards, regulators and courts look to when fraud surfaces. Yet an auditor's actual duty to find fraud is far narrower than most people assume. This gap between what the public expects and what professional standards actually require is known as the expectation gap, and it sits at the heart of this CFE topic.
For a Certified Fraud Examiner, understanding the fraud-related responsibilities of internal, external and government auditors is essential for several reasons:
• Working relationships. Fraud examiners routinely work alongside, receive referrals from, or are engaged by auditors. Knowing where the auditor's duty ends tells you where your own role begins.
• Testimony and litigation. In audit malpractice or securities litigation, the question is frequently whether the auditor met the applicable professional standard. A CFE must know those standards to evaluate conduct.
• Governance advice. Boards and audit committees need to understand that an unmodified (clean) audit opinion is not a certification that no fraud exists. CFEs help close the expectation gap.
• Exam weight. This content falls within the Fraud Prevention and Deterrence section of the CFE Exam, under Auditors' Fraud-Related Responsibilities. Questions here are typically definitional and standards-based, which makes them highly scorable if you learn the key distinctions.
2. What the Topic Covers
The topic distinguishes three categories of auditors, each governed by its own body of professional standards and each with a different fraud mandate:
• Internal auditors - employees (or outsourced providers) who serve the organization itself, governed by the standards of The Institute of Internal Auditors (IIA).
• External (independent) auditors - outside public accountants who express an opinion on financial statements, governed in the United States by AICPA standards (AU-C Section 240) for non-public companies, PCAOB standards (AS 2401) for public companies, and internationally by ISA 240.
• Government auditors - auditors of government entities and recipients of government funds, governed primarily by Generally Accepted Government Auditing Standards (GAGAS), commonly called the Yellow Book, issued by the U.S. Government Accountability Office (GAO), together with requirements such as the Single Audit Act and the OMB Uniform Guidance.
A unifying principle across all three: management, not the auditor, bears primary responsibility for preventing and detecting fraud through the design and operation of internal controls. Auditors provide assurance; they do not replace management's duty.
3. How It Works: Internal Auditors
Governing framework. The IIA's International Professional Practices Framework (IPPF). For many years the relevant requirements were found in the International Standards for the Professional Practice of Internal Auditing; these have been carried forward into the IIA's Global Internal Audit Standards, effective in 2025. The substance of the fraud requirements is unchanged, so learn the concepts rather than memorizing only standard numbers.
Core fraud-related requirements:
• Proficiency, not expertise. Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed by the organization, but they are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud (legacy Standard 1210.A2). This is one of the most frequently tested sentences in the topic.
• Due professional care. Internal auditors must exercise due professional care by considering the probability of significant errors, fraud or noncompliance (legacy 1220.A1). Due care does not imply infallibility.
• Risk management evaluation. The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk (legacy 2120.A2).
• Engagement planning. Internal auditors must consider the probability of significant errors, fraud, noncompliance and other exposures when developing engagement objectives (legacy 2210.A2).
• Reporting. The chief audit executive must report periodically to senior management and the board on significant risk exposures and control issues, including fraud risks (legacy 2060).
Practical role. Internal auditors assess fraud risk, evaluate the design and effectiveness of anti-fraud controls, remain alert to red flags during every engagement, and, when fraud is suspected, notify the appropriate parties (typically management, the audit committee, and legal counsel) and determine whether a formal investigation is needed. Depending on the organization, internal audit may conduct the investigation, support it, or hand it to fraud examiners. The IIA's guidance Internal Auditing and Fraud and the joint ACFE/IIA/AICPA publication Managing the Business Risk of Fraud (and its successor Fraud Risk Management Guide with COSO) describe this role in detail.
Key exam distinction: Internal auditors contribute to fraud deterrence by evaluating controls, but the responsibility for the system of internal control itself belongs to management.
4. How It Works: External Auditors
Governing frameworks.
• AICPA AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (which absorbed the former SAS No. 99).
• PCAOB AS 2401, Consideration of Fraud in a Financial Statement Audit, for audits of issuers.
• ISA 240, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, issued by the IAASB for international engagements.
The core duty. The external auditor is responsible for obtaining reasonable assurance that the financial statements as a whole are free of material misstatement, whether caused by error or fraud. Note the three limiting words: reasonable (not absolute), material (not every dollar), and financial statement misstatement (not fraud generally). An external auditor is not engaged to detect immaterial fraud or fraud that does not affect the financial statements.
Two types of fraud relevant to the auditor:
• Fraudulent financial reporting - intentional misstatements or omissions designed to deceive financial statement users (cooking the books).
• Misappropriation of assets - theft of an entity's assets, relevant to the auditor only when its effect on the financial statements is material.
Required procedures and attitudes:
• Professional skepticism throughout the audit: a questioning mind and critical assessment of evidence, regardless of past experience with management's honesty.
• Engagement team brainstorming (discussion among the engagement team) about how and where the entity's financial statements might be susceptible to material misstatement due to fraud.
• Inquiries of management, the audit committee, internal audit and others about knowledge of fraud, suspected fraud, and fraud risk assessments.
• Analytical procedures in planning, with particular attention to revenue.
• Evaluating fraud risk factors using the fraud triangle framework (incentives/pressures, opportunities, attitudes/rationalizations).
• Presumed risks. The auditor must presume that improper revenue recognition is a fraud risk (unless rebutted) and must address the risk of management override of controls by testing journal entries, reviewing accounting estimates for bias, and evaluating the business rationale of significant unusual transactions.
• Unpredictability. Incorporate an element of unpredictability in the nature, timing and extent of procedures.
Communication and reporting:
• Any fraud involving senior management, or any fraud causing a material misstatement, must be communicated to those charged with governance (typically the audit committee).
• Fraud involving lower-level employees should be reported to an appropriate level of management, at least one level above where the fraud occurred.
• The auditor's duty of confidentiality generally precludes disclosure to outside parties, except where legally required - for example, to comply with legal and regulatory requirements, in response to a subpoena, to a successor auditor, or to a funding agency.
• Section 10A of the Securities Exchange Act of 1934 imposes a specific duty on auditors of public companies: if an illegal act with a material effect is detected and the board fails to take timely remedial action, the auditor must report to the board, and if the board does not notify the SEC within one business day, the auditor must furnish its report to the SEC (or resign and furnish the report).
Inherent limitations. Standards openly acknowledge that even a properly planned and performed audit may fail to detect fraud because fraud involves concealment, collusion, forged documents and management override. A clean opinion is therefore not a guarantee that no fraud occurred.
5. How It Works: Government Auditors
Governing frameworks.
• GAGAS / Yellow Book, issued by the GAO, which applies to audits of federal entities, and to state, local and nonprofit entities when required by law, regulation, contract or grant agreement. GAGAS incorporates the AICPA standards by reference and then adds requirements.
• Single Audit Act and OMB Uniform Guidance (2 CFR Part 200), which govern audits of non-federal entities expending federal awards above the threshold.
• Government auditors may also follow IIA standards (for government internal auditors) or standards of bodies such as the Association of Local Government Auditors.
Core fraud-related requirements under GAGAS:
• Financial audits. Auditors must follow the AICPA fraud requirements and, in addition, design the audit to provide reasonable assurance of detecting material misstatements resulting from noncompliance with provisions of laws, regulations, contracts and grant agreements.
• Performance audits. Auditors must assess the risk of fraud occurring that is significant within the context of the audit objectives. If fraud indicators are identified and the fraud could be significant, auditors must extend procedures to determine whether fraud has likely occurred and, if so, its effect on findings.
• Waste and abuse. The 2018 and 2024 Yellow Book revisions reframed abuse (behavior deficient compared to what a prudent person would consider reasonable) and waste as matters auditors may consider and report, rather than matters they must specifically design the audit to detect. Fraud and noncompliance remain mandatory considerations.
• Reporting. Auditors must report fraud and noncompliance that is material (financial audits) or significant to the objectives (performance audits). Instances that are not material but warrant the attention of those charged with governance must be communicated, generally in writing.
• Reporting directly to outside parties. GAGAS requires auditors to report known or likely fraud directly to parties outside the audited entity when (a) management fails to satisfy legal or regulatory requirements to report to specified external parties, or (b) management fails to take timely and appropriate remedial action in response to fraud that is likely to have a material effect and that involves funding from a government agency or regulator. This is a notable difference from the generally confidential posture of private-sector external auditors.
• Independence and public accountability. Because government audits concern public funds, the Yellow Book places heavy emphasis on independence, transparency and the public's right to know how resources were used.
6. Comparing the Three at a Glance
Who they serve: Internal auditors serve the organization and its board; external auditors serve financial statement users; government auditors serve legislatures, oversight bodies and the public.
Fraud mandate: Internal - evaluate fraud risk and controls, remain alert, have sufficient (not expert) knowledge. External - reasonable assurance regarding material misstatement due to fraud. Government - the external auditor duties plus noncompliance with laws, regulations, contracts and grants, with broader reporting obligations.
Reporting path: Internal - senior management and board/audit committee. External - management and those charged with governance; outside parties only when legally required. Government - those charged with governance and, in defined circumstances, directly to outside oversight bodies.
Common thread: None of the three has primary responsibility for preventing fraud; that belongs to management and those charged with governance. None guarantees the absence of fraud. All must exercise professional skepticism and due professional care.
7. Answering CFE Exam Questions on This Topic
CFE questions in this area tend to be true/false or multiple-choice items that test whether you understand the scope and limits of each auditor's duty. The following approach works well:
Step 1 - Identify the type of auditor. The correct answer often changes depending on whether the question says internal, external/independent, or government auditor. Read that word first.
Step 2 - Identify the standard-setter. Internal = IIA. External = AICPA (AU-C 240), PCAOB (AS 2401), or IAASB (ISA 240). Government = GAO Yellow Book / GAGAS. If a question pairs an auditor type with the wrong standard-setter, it is false.
Step 3 - Apply the limiting language. Ask: does the answer claim reasonable or absolute assurance? Material or all misstatements? Sufficient knowledge or expert knowledge? The standards always use the narrower term.
Step 4 - Check who holds primary responsibility. If an option says the auditor is primarily responsible for preventing or detecting fraud, it is almost certainly wrong. Management is.
Step 5 - Check the reporting path. Fraud involving senior management goes to those charged with governance (audit committee). Outside disclosure is the exception for external auditors, but government auditors have affirmative outside-reporting duties in defined situations.
8. Exam Tips: Answering Questions on Internal, External and Government Auditors
• Memorize the IIA sentence. Internal auditors must have sufficient knowledge to evaluate the risk of fraud and how it is managed, but are not expected to have the expertise of someone whose primary responsibility is detecting and investigating fraud. Any option that says internal auditors must be fraud experts is false.
• Reasonable, not absolute. External auditors obtain reasonable assurance about material misstatement due to fraud or error. Options containing words like guarantee, all fraud, absolute assurance, or certify that no fraud exists are distractors.
• Know the two fraud types. Fraudulent financial reporting and misappropriation of assets are the two categories relevant to external auditors. Corruption is not a separate category in the audit standards even though it is one of the three branches of the ACFE Fraud Tree - do not confuse the two frameworks.
• Presumed risks are tested. Improper revenue recognition is a presumed fraud risk; management override of controls must always be addressed. If asked which risk the auditor must presume exists, choose revenue recognition.
• Brainstorming is mandatory. The engagement team discussion about fraud susceptibility is a required procedure, not optional.
• Professional skepticism is an attitude, not a procedure. It is required throughout the engagement regardless of prior experience with management's integrity.
• Reporting levels. Senior management fraud or material fraud goes to those charged with governance. Minor employee fraud goes to management at least one level above the perpetrator. Immaterial fraud still gets communicated internally; it is not ignored.
• Outside disclosure. For external auditors, confidentiality is the rule and disclosure to outsiders is the exception (legal requirement, subpoena, successor auditor inquiry, funding agency). For government auditors under GAGAS, direct reporting to outside parties is required when management fails to report as legally obligated or fails to take remedial action on likely material fraud involving government funds.
• Section 10A. Associate Section 10A of the Securities Exchange Act with illegal acts, public companies, the board's duty to notify the SEC within one business day, and the auditor's duty to report to the SEC or resign if the board fails to act.
• Yellow Book adds compliance. Government auditors must consider noncompliance with laws, regulations, contracts and grant agreements in addition to fraud. For performance audits, fraud risk is assessed in the context of the audit objectives.
• Management owns the controls. Whenever an option assigns primary responsibility for internal controls or fraud prevention to any auditor, reject it. Management and those charged with governance own that responsibility; auditors evaluate and provide assurance.
• Audits are not fraud examinations. Remember the ACFE contrast: audits are recurring, general in scope, based on sampling and opinion-oriented; fraud examinations are non-recurring, specific, conducted with predication and aimed at affixing blame. A question that describes an auditor conducting a full investigation to prove who committed fraud is describing a fraud examiner's role.
• Read for absolutes. Words such as always, never, every, all, and must detect are red flags in options about auditor responsibilities, because the standards are deliberately qualified.
• When in doubt, pick the narrower duty. If two options differ only in how expansive the auditor's responsibility is, the more limited, standards-based version is usually correct.
9. Quick Self-Check
Test yourself before the exam:
• True or false: External auditors are responsible for detecting all fraud within an organization. (False - reasonable assurance regarding material misstatement only.)
• Which body issues the Yellow Book? (The U.S. Government Accountability Office.)
• Must internal auditors possess the same fraud expertise as a fraud examiner? (No - sufficient knowledge to evaluate fraud risk, not investigative expertise.)
• To whom must an external auditor report fraud involving senior management? (Those charged with governance, typically the audit committee.)
• Which fraud risk must an external auditor presume exists? (Improper revenue recognition.)
• Under GAGAS, when must a government auditor report fraud directly to outside parties? (When management fails to meet legal reporting requirements or fails to take timely remedial action on likely material fraud involving government funding.)
Master the limits of each auditor's duty, the standard-setter behind it, and the reporting path, and you will handle virtually any CFE Exam question on internal, external and government auditors with confidence.
Auditors are often the first professionals the public, boards, regulators and courts look to when fraud surfaces. Yet an auditor's actual duty to find fraud is far narrower than most people assume. This gap between what the public expects and what professional standards actually require is known as the expectation gap, and it sits at the heart of this CFE topic.
For a Certified Fraud Examiner, understanding the fraud-related responsibilities of internal, external and government auditors is essential for several reasons:
• Working relationships. Fraud examiners routinely work alongside, receive referrals from, or are engaged by auditors. Knowing where the auditor's duty ends tells you where your own role begins.
• Testimony and litigation. In audit malpractice or securities litigation, the question is frequently whether the auditor met the applicable professional standard. A CFE must know those standards to evaluate conduct.
• Governance advice. Boards and audit committees need to understand that an unmodified (clean) audit opinion is not a certification that no fraud exists. CFEs help close the expectation gap.
• Exam weight. This content falls within the Fraud Prevention and Deterrence section of the CFE Exam, under Auditors' Fraud-Related Responsibilities. Questions here are typically definitional and standards-based, which makes them highly scorable if you learn the key distinctions.
2. What the Topic Covers
The topic distinguishes three categories of auditors, each governed by its own body of professional standards and each with a different fraud mandate:
• Internal auditors - employees (or outsourced providers) who serve the organization itself, governed by the standards of The Institute of Internal Auditors (IIA).
• External (independent) auditors - outside public accountants who express an opinion on financial statements, governed in the United States by AICPA standards (AU-C Section 240) for non-public companies, PCAOB standards (AS 2401) for public companies, and internationally by ISA 240.
• Government auditors - auditors of government entities and recipients of government funds, governed primarily by Generally Accepted Government Auditing Standards (GAGAS), commonly called the Yellow Book, issued by the U.S. Government Accountability Office (GAO), together with requirements such as the Single Audit Act and the OMB Uniform Guidance.
A unifying principle across all three: management, not the auditor, bears primary responsibility for preventing and detecting fraud through the design and operation of internal controls. Auditors provide assurance; they do not replace management's duty.
3. How It Works: Internal Auditors
Governing framework. The IIA's International Professional Practices Framework (IPPF). For many years the relevant requirements were found in the International Standards for the Professional Practice of Internal Auditing; these have been carried forward into the IIA's Global Internal Audit Standards, effective in 2025. The substance of the fraud requirements is unchanged, so learn the concepts rather than memorizing only standard numbers.
Core fraud-related requirements:
• Proficiency, not expertise. Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed by the organization, but they are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud (legacy Standard 1210.A2). This is one of the most frequently tested sentences in the topic.
• Due professional care. Internal auditors must exercise due professional care by considering the probability of significant errors, fraud or noncompliance (legacy 1220.A1). Due care does not imply infallibility.
• Risk management evaluation. The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk (legacy 2120.A2).
• Engagement planning. Internal auditors must consider the probability of significant errors, fraud, noncompliance and other exposures when developing engagement objectives (legacy 2210.A2).
• Reporting. The chief audit executive must report periodically to senior management and the board on significant risk exposures and control issues, including fraud risks (legacy 2060).
Practical role. Internal auditors assess fraud risk, evaluate the design and effectiveness of anti-fraud controls, remain alert to red flags during every engagement, and, when fraud is suspected, notify the appropriate parties (typically management, the audit committee, and legal counsel) and determine whether a formal investigation is needed. Depending on the organization, internal audit may conduct the investigation, support it, or hand it to fraud examiners. The IIA's guidance Internal Auditing and Fraud and the joint ACFE/IIA/AICPA publication Managing the Business Risk of Fraud (and its successor Fraud Risk Management Guide with COSO) describe this role in detail.
Key exam distinction: Internal auditors contribute to fraud deterrence by evaluating controls, but the responsibility for the system of internal control itself belongs to management.
4. How It Works: External Auditors
Governing frameworks.
• AICPA AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (which absorbed the former SAS No. 99).
• PCAOB AS 2401, Consideration of Fraud in a Financial Statement Audit, for audits of issuers.
• ISA 240, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, issued by the IAASB for international engagements.
The core duty. The external auditor is responsible for obtaining reasonable assurance that the financial statements as a whole are free of material misstatement, whether caused by error or fraud. Note the three limiting words: reasonable (not absolute), material (not every dollar), and financial statement misstatement (not fraud generally). An external auditor is not engaged to detect immaterial fraud or fraud that does not affect the financial statements.
Two types of fraud relevant to the auditor:
• Fraudulent financial reporting - intentional misstatements or omissions designed to deceive financial statement users (cooking the books).
• Misappropriation of assets - theft of an entity's assets, relevant to the auditor only when its effect on the financial statements is material.
Required procedures and attitudes:
• Professional skepticism throughout the audit: a questioning mind and critical assessment of evidence, regardless of past experience with management's honesty.
• Engagement team brainstorming (discussion among the engagement team) about how and where the entity's financial statements might be susceptible to material misstatement due to fraud.
• Inquiries of management, the audit committee, internal audit and others about knowledge of fraud, suspected fraud, and fraud risk assessments.
• Analytical procedures in planning, with particular attention to revenue.
• Evaluating fraud risk factors using the fraud triangle framework (incentives/pressures, opportunities, attitudes/rationalizations).
• Presumed risks. The auditor must presume that improper revenue recognition is a fraud risk (unless rebutted) and must address the risk of management override of controls by testing journal entries, reviewing accounting estimates for bias, and evaluating the business rationale of significant unusual transactions.
• Unpredictability. Incorporate an element of unpredictability in the nature, timing and extent of procedures.
Communication and reporting:
• Any fraud involving senior management, or any fraud causing a material misstatement, must be communicated to those charged with governance (typically the audit committee).
• Fraud involving lower-level employees should be reported to an appropriate level of management, at least one level above where the fraud occurred.
• The auditor's duty of confidentiality generally precludes disclosure to outside parties, except where legally required - for example, to comply with legal and regulatory requirements, in response to a subpoena, to a successor auditor, or to a funding agency.
• Section 10A of the Securities Exchange Act of 1934 imposes a specific duty on auditors of public companies: if an illegal act with a material effect is detected and the board fails to take timely remedial action, the auditor must report to the board, and if the board does not notify the SEC within one business day, the auditor must furnish its report to the SEC (or resign and furnish the report).
Inherent limitations. Standards openly acknowledge that even a properly planned and performed audit may fail to detect fraud because fraud involves concealment, collusion, forged documents and management override. A clean opinion is therefore not a guarantee that no fraud occurred.
5. How It Works: Government Auditors
Governing frameworks.
• GAGAS / Yellow Book, issued by the GAO, which applies to audits of federal entities, and to state, local and nonprofit entities when required by law, regulation, contract or grant agreement. GAGAS incorporates the AICPA standards by reference and then adds requirements.
• Single Audit Act and OMB Uniform Guidance (2 CFR Part 200), which govern audits of non-federal entities expending federal awards above the threshold.
• Government auditors may also follow IIA standards (for government internal auditors) or standards of bodies such as the Association of Local Government Auditors.
Core fraud-related requirements under GAGAS:
• Financial audits. Auditors must follow the AICPA fraud requirements and, in addition, design the audit to provide reasonable assurance of detecting material misstatements resulting from noncompliance with provisions of laws, regulations, contracts and grant agreements.
• Performance audits. Auditors must assess the risk of fraud occurring that is significant within the context of the audit objectives. If fraud indicators are identified and the fraud could be significant, auditors must extend procedures to determine whether fraud has likely occurred and, if so, its effect on findings.
• Waste and abuse. The 2018 and 2024 Yellow Book revisions reframed abuse (behavior deficient compared to what a prudent person would consider reasonable) and waste as matters auditors may consider and report, rather than matters they must specifically design the audit to detect. Fraud and noncompliance remain mandatory considerations.
• Reporting. Auditors must report fraud and noncompliance that is material (financial audits) or significant to the objectives (performance audits). Instances that are not material but warrant the attention of those charged with governance must be communicated, generally in writing.
• Reporting directly to outside parties. GAGAS requires auditors to report known or likely fraud directly to parties outside the audited entity when (a) management fails to satisfy legal or regulatory requirements to report to specified external parties, or (b) management fails to take timely and appropriate remedial action in response to fraud that is likely to have a material effect and that involves funding from a government agency or regulator. This is a notable difference from the generally confidential posture of private-sector external auditors.
• Independence and public accountability. Because government audits concern public funds, the Yellow Book places heavy emphasis on independence, transparency and the public's right to know how resources were used.
6. Comparing the Three at a Glance
Who they serve: Internal auditors serve the organization and its board; external auditors serve financial statement users; government auditors serve legislatures, oversight bodies and the public.
Fraud mandate: Internal - evaluate fraud risk and controls, remain alert, have sufficient (not expert) knowledge. External - reasonable assurance regarding material misstatement due to fraud. Government - the external auditor duties plus noncompliance with laws, regulations, contracts and grants, with broader reporting obligations.
Reporting path: Internal - senior management and board/audit committee. External - management and those charged with governance; outside parties only when legally required. Government - those charged with governance and, in defined circumstances, directly to outside oversight bodies.
Common thread: None of the three has primary responsibility for preventing fraud; that belongs to management and those charged with governance. None guarantees the absence of fraud. All must exercise professional skepticism and due professional care.
7. Answering CFE Exam Questions on This Topic
CFE questions in this area tend to be true/false or multiple-choice items that test whether you understand the scope and limits of each auditor's duty. The following approach works well:
Step 1 - Identify the type of auditor. The correct answer often changes depending on whether the question says internal, external/independent, or government auditor. Read that word first.
Step 2 - Identify the standard-setter. Internal = IIA. External = AICPA (AU-C 240), PCAOB (AS 2401), or IAASB (ISA 240). Government = GAO Yellow Book / GAGAS. If a question pairs an auditor type with the wrong standard-setter, it is false.
Step 3 - Apply the limiting language. Ask: does the answer claim reasonable or absolute assurance? Material or all misstatements? Sufficient knowledge or expert knowledge? The standards always use the narrower term.
Step 4 - Check who holds primary responsibility. If an option says the auditor is primarily responsible for preventing or detecting fraud, it is almost certainly wrong. Management is.
Step 5 - Check the reporting path. Fraud involving senior management goes to those charged with governance (audit committee). Outside disclosure is the exception for external auditors, but government auditors have affirmative outside-reporting duties in defined situations.
8. Exam Tips: Answering Questions on Internal, External and Government Auditors
• Memorize the IIA sentence. Internal auditors must have sufficient knowledge to evaluate the risk of fraud and how it is managed, but are not expected to have the expertise of someone whose primary responsibility is detecting and investigating fraud. Any option that says internal auditors must be fraud experts is false.
• Reasonable, not absolute. External auditors obtain reasonable assurance about material misstatement due to fraud or error. Options containing words like guarantee, all fraud, absolute assurance, or certify that no fraud exists are distractors.
• Know the two fraud types. Fraudulent financial reporting and misappropriation of assets are the two categories relevant to external auditors. Corruption is not a separate category in the audit standards even though it is one of the three branches of the ACFE Fraud Tree - do not confuse the two frameworks.
• Presumed risks are tested. Improper revenue recognition is a presumed fraud risk; management override of controls must always be addressed. If asked which risk the auditor must presume exists, choose revenue recognition.
• Brainstorming is mandatory. The engagement team discussion about fraud susceptibility is a required procedure, not optional.
• Professional skepticism is an attitude, not a procedure. It is required throughout the engagement regardless of prior experience with management's integrity.
• Reporting levels. Senior management fraud or material fraud goes to those charged with governance. Minor employee fraud goes to management at least one level above the perpetrator. Immaterial fraud still gets communicated internally; it is not ignored.
• Outside disclosure. For external auditors, confidentiality is the rule and disclosure to outsiders is the exception (legal requirement, subpoena, successor auditor inquiry, funding agency). For government auditors under GAGAS, direct reporting to outside parties is required when management fails to report as legally obligated or fails to take remedial action on likely material fraud involving government funds.
• Section 10A. Associate Section 10A of the Securities Exchange Act with illegal acts, public companies, the board's duty to notify the SEC within one business day, and the auditor's duty to report to the SEC or resign if the board fails to act.
• Yellow Book adds compliance. Government auditors must consider noncompliance with laws, regulations, contracts and grant agreements in addition to fraud. For performance audits, fraud risk is assessed in the context of the audit objectives.
• Management owns the controls. Whenever an option assigns primary responsibility for internal controls or fraud prevention to any auditor, reject it. Management and those charged with governance own that responsibility; auditors evaluate and provide assurance.
• Audits are not fraud examinations. Remember the ACFE contrast: audits are recurring, general in scope, based on sampling and opinion-oriented; fraud examinations are non-recurring, specific, conducted with predication and aimed at affixing blame. A question that describes an auditor conducting a full investigation to prove who committed fraud is describing a fraud examiner's role.
• Read for absolutes. Words such as always, never, every, all, and must detect are red flags in options about auditor responsibilities, because the standards are deliberately qualified.
• When in doubt, pick the narrower duty. If two options differ only in how expansive the auditor's responsibility is, the more limited, standards-based version is usually correct.
9. Quick Self-Check
Test yourself before the exam:
• True or false: External auditors are responsible for detecting all fraud within an organization. (False - reasonable assurance regarding material misstatement only.)
• Which body issues the Yellow Book? (The U.S. Government Accountability Office.)
• Must internal auditors possess the same fraud expertise as a fraud examiner? (No - sufficient knowledge to evaluate fraud risk, not investigative expertise.)
• To whom must an external auditor report fraud involving senior management? (Those charged with governance, typically the audit committee.)
• Which fraud risk must an external auditor presume exists? (Improper revenue recognition.)
• Under GAGAS, when must a government auditor report fraud directly to outside parties? (When management fails to meet legal reporting requirements or fails to take timely remedial action on likely material fraud involving government funding.)
Master the limits of each auditor's duty, the standard-setter behind it, and the reporting path, and you will handle virtually any CFE Exam question on internal, external and government auditors with confidence.
Test mode:
CFE - Internal, External and Government Auditors Example Questions
Test your knowledge of Internal, External and Government Auditors
Question 1
An external auditor is engaged to express an opinion on whether an organization's financial statements are presented fairly in accordance with the applicable financial reporting framework.
Question 2
A public hospital that receives government funding is reviewed by three parties: its internal audit department, an independent accounting firm, and a government audit office. A legislator wants to know which review is meant to judge whether public money was spent economically and efficiently and whether the hospital's programs met their intended results. The legislator also wants that review's findings available to the public. Which review BEST meets this need?
Question 3
To cut costs, a company's CEO proposes that the internal audit department, rather than an outside firm, issue the annual opinion on the financial statements given to shareholders and lenders. Which of the following BEST explains why this proposal is inappropriate?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Internal, External and Government Auditors questions
18 questions (total)