An internal auditor assessed the controls within his organization ' s payroll process and suspects...

When an internal auditor suspects fraudulent activity, such as erroneous payments to a fraudulent bank account, the appropriate course of action is to escalate the concern to the engagement supervisor (Option D). This step ensures that the issue is handled with the necessary urgency and oversight. According to the IIA Standards, particularly Standard 2060: Reporting to Senior Management and the Board, the CAE must communicate significant risk exposures and control issues, including fraud risks, to senior management and the board. Escalating the concern ensures the appropriate levels of the organization are aware and can take timely action.

IIA Standards, Standard 2060: Reporting to Senior Management and the Board

IIA Practice Guide: Internal Auditing and Fraud