An internal auditor is planning an audit engagement of a subsidiary organization.

Comprehensive and Detailed Explanation:

According to IIA Standard 2010 – Planning, the internal auditor must establish engagement objectives considering relevant risks to the activity under review. Even when an external investigator (corporate investigation team, regulator, or law enforcement) is addressing specific fraud incidents, the internal audit function still has a responsibility to evaluate fraud risks, related controls, and systemic weaknesses. Excluding fraud areas entirely (A) is inappropriate, as it ignores critical risks. Supporting investigators in an advisory-only role (B) may compromise independence, and option C only applies if the audit team lacks fraud expertise, in which case they may still assess control design without conducting the fraud investigation itself. The best approach is Option D: the auditor should consider fraud risk and control weaknesses highlighted by the investigation and incorporate them into the audit scope. This ensures the audit adds value by focusing on systemic gaps that allowed the fraud to occur in the first place.