Christopher is conducting an external audit of a company in a jurisdiction that is subject to International Standards on Auditing (ISAs). While conducting his audit procedures, he discovers evidence of a fraud involving Jeffrey, the company's chief executive officer. Which of the following is Christopher's BEST response to these findings?

• A. Christopher should report his findings to those charged with governance of the organization.
• B. Christopher should immediately report his findings to the relevant government authority.
• C. Christopher should confront Jeffrey with his audit findings and try to get a confession.
• D. Christopher should not disclose his findings to any other parties due to legal liability.

Which of the following is FALSE regarding a fraud risk assessment?

• A. The assessment should be used to improve employee fraud awareness
• B. The assessment team should consider how employees behave as part of its assessment
• C. The designation of an area as high risk should only occur if the assessment has conclusively revealed that fraud is occurring there.
• D. The objective of the assessment is to help the organization identify what makes it most vulnerable to fraud.

Based on research regarding the criminogenic nature of organizations, employees with strong personal values and ethics will always disobey a superior's direct order to engage in fraudulent behavior, despite an inherent desire to obey authority figures.

• A. Flase
• B. True

According to Silk and Vogel's research, which of the following is one of the ways that businesses rationalize illegal conduct?

• A. Violations are caused by innocent errors in judgment rather than economic necessity.
• B. Corporate violations that involve large sums of money are often spread among so many organizations that each gains very little individually.
• C. Government regulations are justified because the additional costs of regulations and bureaucratic procedures increase government profits.
• D. Government regulation is unnecessary because the matters being regulated are unimportant.

Which of the following statements is MOST ACCURATE regarding an organization's fraud risk management program?

• A. Systems to monitor and identify breaches in compliance must be included in the fraud risk management program.
• B. Punishment for intentional noncompliance should be individualized based on the offender's personal circumstances.
• C. Formal sanctions for intentional noncompliance should be kept private and only shared if a party absolutely needs to know.
• D. All employees at the organization should be responsible for monitoring compliance with the program.