* International Standards on Auditing (ISAs) Requirements:
* ISAs require auditors to communicate suspected or confirmed fraud to "those charged with governance" of the organization, as they have the responsibility for oversight.
* ISA 240, "The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements," mandates that findings be reported to appropriate governance bodies before considering further actions.
* Confidentiality and Legal Obligations:
* Auditors must maintain confidentiality unless legal or regulatory frameworks require disclosure to authorities. Immediate reporting to law enforcement (option B) may breach confidentiality without proper internal escalation.
* Why Option D is Correct:
* Reporting to governance ensures proper internal actions are taken and protects the integrity of the audit process. It allows the organization to address the issue before external involvement if required.