Which of the following statements is TRUE regarding the internal audit function’s reporting responsibilities concerning...

The internal audit function has an important role in evaluating governance, risk management, controls, and fraud risk management activities. Its reporting should include significant risk and control issues, including fraud risks, governance issues, and matters requiring attention from senior management or the board. Therefore, if management does not cooperate with the assessment of fraud risk management, that fact is relevant and should be communicated to the board. Internal audit should not wait until fraud occurs before communicating about fraud risk. It also should not hide fraud audit results from senior management or the board in the name of independence. Fraud communication is not solely a legal department responsibility. Accordingly, option D best reflects the internal audit function’s reporting responsibilities concerning fraud.