18.2 Situations That Require Escalation

Escalation is an in-flight duty, not a reporting afterthought

C2b asks you to identify situations that require escalation. On Part 2, escalation is what you do during planning, fieldwork, and the closing-meeting window when a condition is too sensitive, too impairing, or too stuck to handle only with the process owner. It is not an invitation to write the Part 3 protocol in which the CAE communicates management’s acceptance of residual risk to the board (GIAS Standard 11.5). Your job on this exam is to recognize the red flag and move it up the internal audit chain in time for someone who has the authority to act.

The default path is short on purpose:

Engagement supervisor → chief audit executive (CAE) → board, if needed.

“If needed” is not a staff-auditor improvisation. The CAE decides whether the board (typically the audit committee) must hear the matter now — for example an independence or access impairment, suspected fraud involving senior management, or residual risk the CAE judges may be unacceptable. A staff auditor who emails the board to “show independence” has skipped supervision, broken protocol, and usually created a confidentiality problem.

The safety rule the exam will punish you for missing: escalate timely. Do not sit on a red flag until the final report. Completeness of the later communication is not an excuse for delay. A finding can be updated; a fraud window, a destroyed log, or a week of unauthorized access cannot be undone.

Six situations the syllabus expects you to recognize

1. Suspected fraud. Fraud is an intentional act involving deceit, concealment, or violation of trust. You do not need a completed investigation to escalate. Red flags — a fictitious vendor, altered receiving reports, an unexplained override, an employee who will not leave during a cash count — are enough. Stop casual discussion with anyone who may be implicated. Do not request “an explanation” from the suspected person as your first move; that can tip the scheme, taint evidence, and put you outside your competence. Escalate to the engagement supervisor immediately. If the supervisor could be involved, go to the CAE. Follow the organization’s investigation and legal protocol. GIAS Standard 4.2 Due Professional Care requires professional care around fraud risk; it does not require every internal auditor to be a forensic specialist. Past the point of reasonable suspicion, you escalate rather than freelance as an investigator unless that is your assigned, competent role.

2. Illegal acts. Bribery, sanctions evasion, environmental dumping, privacy-law violations, and similar conduct are not “control observations to workshop in the closing meeting.” Treat them like fraud for channel and speed: supervisor → CAE, with legal and compliance per protocol. Do not copy the process owner’s team on a draft labeled “possible illegal act.” Privilege, regulatory reporting, and employee rights are not solved by a thorough write-up three weeks later.

3. Scope interference. Interference is more than a busy calendar. It includes instructing staff not to speak with internal audit, withholding systems or locations after they were in scope, re-scoping the engagement downward after kickoff without CAE agreement, monitoring interviews, or stalling until the fieldwork window expires. Document the requests, the refusals, and the effect on objectives. Then escalate. Relationship management is not a reason to accept a quiet, unofficial scope cut.

4. Residual risk that may be unacceptable. During the engagement you may see that even after the activity’s likely response — or with no credible response in sight — remaining risk looks outside what the organization can tolerate (safety, going-concern-adjacent liquidity, a control vacuum over a high-value payment stream). Escalate that judgment to the supervisor and CAE now. Do not convert the item into a staff-authored board memo on risk acceptance. Standard 11.5 is the CAE’s communication after management has accepted a risk the CAE believes may be unacceptable; Part 3 tests that protocol. Part 2 tests whether you recognized the condition and did not bury it in a draft finding nobody senior will see until issuance.

5. Management refusal to provide access. The internal audit charter and GIAS Domain III essential conditions contemplate unrestricted access to data, personnel, and physical property needed for the engagement, subject to law and confidentiality rules. Two documented requests with a still-closed contract repository, payroll file, or warehouse is not a logistics inconvenience; it is an impairment. Escalate through the supervisor to the CAE. The CAE, not the staff auditor, takes access refusals to senior management and, if unresolved, the board. Keep a written log of who was asked, when, for what, and what was refused.

6. Disagreement on facts that blocks progress. Standard 13.1 wants you to discuss differences and seek mutual understanding. A process owner who says “those three invoices had director approval in the workflow” is a fieldwork discussion: pull the workflow log, corroborate, and move. Escalation starts when the disagreement stops the work — management denies facts that the evidence supports and will not allow further testing, will not make people available, or insists the condition be dropped as a condition of continued access. Escalate the deadlock. Do not change the finding to match management’s version just to keep the timeline. Do not skip the CAE and brief the board the same afternoon.

What is not an escalation

Exam stems will mix true red flags with ordinary friction. Late delivery of a sample on day two, a manager who is in another city until Thursday, or a debate over wording of a low-risk observation is usually status communication, not escalation. Escalate when sensitivity, impairment, or deadlock is present. If you escalate every awkward conversation, you train management to hide issues and you bury the CAE in noise. If you escalate nothing until the report, you fail timely communication and, in fraud or access cases, you may fail professional courage (GIAS Principle 4).

Document the escalation in the workpapers: date, facts, evidence references, who was told, and what you asked them to do. Documentation is not a substitute for the conversation; it is the evidence that the conversation happened. Keep distribution tight. An escalation email copied to the whole activity under review is a stakeholder-selection error (Section 18.3), not thoroughness.

Worked scenarios

Fraud. A purchasing analyst shows you a vendor that shares a bank account with an employee. You do not call the employee. You stop additional open discussion in the buyer's cubicles, protect the screenshots and vendor-master extracts in the workpapers, and brief the engagement supervisor the same day. The supervisor briefs the CAE. Legal or the fraud investigation unit is engaged per protocol. The closing meeting does not become a public reconstruction of the scheme.

Access. You requested the third-party contract folder twice in writing. Management says legal is “still reviewing whether audit may see it.” The contracts are in scope for a third-party risk engagement. That is refused access and likely scope interference. Escalate to the supervisor with the two requests attached. Do not silently drop the contracts from the work program to stay on schedule.

Deadlock. Management insists a duplicate payment is a “timing difference.” Your evidence shows the same invoice number paid twice to the same vendor. They will not provide the payment file for a follow-up sample and say the finding must come out or they will not attend the closing meeting. That disagreement blocks progress. Escalate. Do not delete the condition to buy attendance.

Timing. Same-day oral escalation is the default for fraud, illegal acts, and safety-adjacent residual risk. Access and interference can follow the same day you have a documented refusal, not “next week’s status.” A fact deadlock can take a short, good-faith attempt to corroborate — hours, not a second fieldwork cycle — before you move it up. What you never do is park any of the six until issuance week so the final communication will be “complete.”