The correct answers are: Internal auditors should report deficiencies in systems that may permit fraud, and actual instances of fraud, to management at an appropriate level; Internal auditors may be permitted to report deficiencies in systems that may permit fraud, and actual instances of fraud, to external auditors.

Internal auditors should report deficiencies in systems that may permit fraud, and actual instances of fraud, to management at an appropriate level - sometimes to the audit committee if there is one. Internal auditors may be permitted to report deficiencies in systems that may permit fraud, and actual instances of fraud, to external auditors, although they should not do so without permission. If internal auditors discover management fraud, they are permitted to report that fraud outside the company under the 'whistle-blowing' legislation, and in certain other circumstances, although this can be difficult and is rare in practice. Where fraud is discovered, it is for others to discipline those involved. Internal auditors' procedures are not necessarily inadequate if they do not uncover serious instances of management fraud because management fraud is often well-hidden. The same is true of external auditors' procedures.