According to IIA guidance, the audit objective for an assurance engagement must consider the possibility of fraud and noncompliance. This consideration is essential for ensuring that the audit adequately addresses potential risks that could impact the organization. Assessing the possibility of fraud and noncompliance helps in identifying areas where controls might be deficient and where significant risks might be present, thus enabling the internal audit activity to provide meaningful and relevant recommendations.
References:
* The Institute of Internal Auditors (IIA) Standard 2120 - Risk Management: "The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk."
* IIA Practice Guide on "Fraud Risk Assessment"