An internal audit function is planning an assurance engagement.

A risk matrix is the most appropriate tool for evaluating fraud risks identified during brainstorming because it enables internal auditors to organize fraud scenarios and assess their relative significance according to factors such as likelihood, potential impact, exposure, and control effectiveness. This structured assessment helps the engagement team determine which fraud risks warrant additional audit procedures. A questionnaire may provide management’s views, but those views alone do not provide the systematic prioritization needed. Walkthroughs are useful after significant risks have been selected for further examination. Root-cause analysis generally investigates why an identified problem or event occurred and is therefore premature during initial fraud-risk prioritization. The appropriate sequence is to identify potential fraud scenarios, assess their significance, prioritize them, and then design procedures addressing the most significant exposures.