In the CFE curriculum, auditors are grouped into three categories, each with distinct fraud-related responsibilities.

Internal auditors are employees of the organization (or outsourced providers) who evaluate the effectiveness of governance, risk management, and internal controls. Under the IIA's International Professional Practices Framework, they must possess sufficient knowledge to evaluate the risk of fraud and how the organization manages it, though they are not expected to have the expertise of a fraud investigation specialist. Standards require them to consider fraud risk when developing engagement objectives, assess the organization's fraud risk exposure, and report significant fraud indicators to senior management and the board. They often support anti-fraud programs, assist with investigations, and recommend control improvements, but detecting all fraud is not their primary purpose.

External auditors are independent CPAs who express an opinion on whether financial statements are fairly presented. Their fraud duties are defined by AU-C Section 240 (AICPA), PCAOB AS 2401 for public companies, and ISA 240 internationally. They must plan and perform the audit to obtain reasonable (not absolute) assurance that statements are free of material misstatement due to error or fraud. Required procedures include brainstorming among the engagement team, exercising professional skepticism, inquiring of management and others, identifying and responding to fraud risks (including presuming revenue recognition and management override as risks), and communicating identified fraud to management, those charged with governance, and in some cases regulators. The Sarbanes-Oxley Act added internal control attestation (Section 404) and auditor independence rules.

Government auditors work for agencies such as the GAO or state audit offices, following Generally Accepted Government Auditing Standards (the 'Yellow Book'). They audit public entities and recipients of government funds, performing financial audits, attestation engagements, and performance audits. GAGAS requires them to design procedures to detect fraud, noncompliance with laws, regulations, and grant agreements, and abuse that could be material, and to report such findings to appropriate officials or oversight bodies.

Collectively, all three provide layers of assurance, but none guarantees fraud detection, which is why CFEs complement their work.

Financial statement materiality is a foundational concept in auditing and fraud examination that defines the threshold at which a misstatement, omission, or error becomes significant enough to influence the economic decisions of a reasonable user relying on the financial statements. In the CFE context, understanding materiality is essential because it shapes how auditors design procedures, evaluate evidence, and determine whether detected misstatements, including those arising from fraud, must be corrected or disclosed.

Auditing standards (such as AU-C 320 and ISA 320) require auditors to establish overall materiality for the financial statements as a whole, typically using a benchmark like a percentage of pre-tax income, total revenues, or total assets. Auditors then set performance materiality, a lower amount, to reduce the risk that uncorrected and undetected misstatements collectively exceed overall materiality. Materiality has both quantitative and qualitative dimensions. A numerically small misstatement may still be material if it conceals a change in earnings trends, converts a loss into a profit, affects compliance with debt covenants, masks an illegal act, or increases management compensation.

From a fraud perspective, materiality is particularly important because fraud is intentional. Standards such as AU-C 240 and ISA 240 emphasize that auditors must consider the implications of any fraud discovered, regardless of amount, since even an immaterial fraud by management may indicate a pervasive integrity problem, weak internal controls, or a higher risk of larger undetected misstatements. Fraud examiners generally do not apply materiality thresholds in the same way auditors do; a CFE investigating a $5,000 embezzlement treats it as significant because the objective is to establish facts and accountability, not to express an opinion on fair presentation.

Understanding materiality helps CFEs recognize why financial statement audits may fail to detect fraud below the threshold, appreciate the limits of audit assurance, and recognize how perpetrators deliberately structure schemes beneath materiality levels to avoid detection, which is a common fraud red flag.

Internal auditors play a critical role in an organization's anti-fraud framework, though their responsibilities differ from those of external auditors and fraud examiners. According to the Institute of Internal Auditors (IIA) International Standards for the Professional Practice of Internal Auditing, internal auditors must possess sufficient knowledge to evaluate the risk of fraud and the manner in which the organization manages it. However, they are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud.

Key internal audit fraud responsibilities include: (1) Fraud risk assessment – internal auditors must consider the probability of significant errors, fraud, noncompliance, and other exposures when developing engagement objectives and the overall audit plan. (2) Evaluating controls – they assess the design and operating effectiveness of the organization's anti-fraud programs, internal controls, and governance processes, identifying weaknesses that could allow fraud to occur or go undetected. (3) Due professional care – auditors must exercise the care and skill of a reasonably prudent and competent internal auditor, remaining alert to red flags such as unusual transactions, override of controls, or unexplained variances. (4) Reporting – when fraud is suspected, internal auditors should promptly notify appropriate management, the audit committee, or the board, and may recommend investigation by qualified personnel. (5) Supporting investigations – internal auditors may assist in or conduct fraud investigations, provided they have adequate skills, or they may coordinate with forensic specialists, legal counsel, and CFEs.

Internal auditors also contribute to deterrence by creating a perception of detection through continuous monitoring, data analytics, and surprise audits. The IIA's Practice Guide on Fraud emphasizes that management, not internal audit, holds primary responsibility for preventing and detecting fraud; internal audit provides independent assurance that management's fraud risk management processes are adequate and effective. Ultimately, internal auditors serve as a key line of defense, bridging governance, risk management, and operational oversight within the organization.

External auditors' fraud-related responsibilities are defined primarily by professional auditing standards, notably the AICPA's AU-C Section 240 (Consideration of Fraud in a Financial Statement Audit), the PCAOB's AS 2401, and the IAASB's ISA 240. Under these standards, the external auditor's objective is to obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by error or fraud. Importantly, the standards recognize that the primary responsibility for preventing and detecting fraud rests with management and those charged with governance, not the auditor; auditors are not insurers against fraud and are not expected to detect every instance, particularly where collusion or forgery is involved.

Auditors focus on two types of fraud relevant to the audit: fraudulent financial reporting and misappropriation of assets. To address these risks, auditors must maintain professional skepticism throughout the engagement, recognizing that fraud may exist regardless of past experience with the client's integrity. Required procedures include holding engagement team discussions (brainstorming) about how and where the entity's financial statements might be susceptible to fraud, making inquiries of management, the audit committee, internal audit, and others about fraud risks and known or suspected fraud, and evaluating fraud risk factors using the fraud triangle (incentive/pressure, opportunity, rationalization).

Auditors must identify and assess fraud risks at the financial statement and assertion levels, presuming revenue recognition is a fraud risk, and consider the risk of management override of controls. Responses include testing journal entries and adjustments, reviewing accounting estimates for bias, evaluating unusual transactions, and incorporating unpredictability into procedures.

When fraud is identified or suspected, auditors must communicate it to the appropriate level of management, to those charged with governance when it involves management or is material, and, where required by law or regulation, to regulatory authorities. Auditors must also document their fraud-related procedures and conclusions.

Government audit fraud responsibilities are set primarily by Generally Accepted Government Auditing Standards (GAGAS), issued by the U.S. Government Accountability Office (GAO) in the 'Yellow Book.' These standards apply to audits of federal, state, and local government entities and to nongovernmental organizations that receive government funds, such as grantees audited under the Single Audit Act. GAGAS incorporates AICPA standards for financial audits (including AU-C 240 on fraud) but adds requirements that expand the auditor's duties regarding fraud, waste, and abuse. For financial audits, government auditors must plan and perform procedures to obtain reasonable assurance of detecting material misstatements caused by fraud and must also design the audit to detect material noncompliance with laws, regulations, contracts, and grant agreements. For performance audits, auditors must assess the risk of fraud occurring that is significant within the context of the audit objectives, gather information to identify fraud risks, and, if they encounter indicators of fraud, extend audit procedures to determine whether fraud likely occurred and what effect it has on the audit findings. Although auditors are not expected to provide reasonable assurance of detecting abuse, GAGAS encourages them to remain alert to it and consider its implications. Reporting requirements are stricter than in private-sector audits: auditors must report fraud and material noncompliance that have occurred or are likely to have occurred, present findings with criteria, condition, cause, and effect, and communicate significant matters to those charged with governance. When entity management fails to disclose fraud to appropriate authorities or when law requires it, auditors must report directly to outside parties such as funding agencies or law enforcement. GAGAS also imposes independence, competence, and continuing education requirements that support the auditor's ability to recognize fraud. Ultimately, government auditors serve as stewards of public accountability, so their fraud responsibilities extend beyond financial statements to protecting taxpayer resources.