When an internal auditor discovers a significant issue, such as a manager's spouse receiving paychecks without being employed, it's essential to follow the appropriate protocols for reporting the finding.
Detailed Explanation:
IIA Standard 2060 - Reporting to Senior Management and the Board:
This standard mandates that the chief audit executive (CAE) must communicate significant risk exposures and control issues to senior management and the board. Following the normal chain of command ensures that the issue is escalated appropriately without bypassing necessary channels.
Ethical Considerations and Confidentiality:
According to the IIA's Code of Ethics, internal auditors must respect the confidentiality of the information they handle. Reporting through the established chain of command ensures that sensitive issues are handled discreetly and appropriately.
IIA Standard 2440 - Disseminating Results:
This standard requires that the results of the audit, including significant findings, should be communicated to the appropriate parties. Reporting to senior management first allows for an initial review and appropriate action before escalating to higher levels, if necessary.
Why Not Other Options?
Option A (Contacting the external auditor): While external auditors may need to be informed, this step should follow internal reporting protocols, not precede them.
Option C (Meeting with the local manager): This could compromise the investigation, as the local manager may be involved in the issue.
Option D (Bypassing the chain of command): This should only be done in extreme circumstances, such as when senior management is directly involved in the wrongdoing, which is not indicated in this scenario.