A. Reporting to management and the board should occur when the incidence of significant fraud has been established to a reasonable certainty.

B. Reporting of suspicious acts should alert an auditor to do some preliminary investigating. However, it would not be appropriate to make a report to management and the board at that stage.

C. When an internal auditor suspects fraud, he or she should determine the possible effects and discuss the matter with the appropriate level of management, who should then initiate an investigation. However, the internal auditor should have solid reasons to suspect that fraud has taken place before reporting it to management and the board.

D. Until the irregular transactions have been investigated further, it would not be appropriate to make a report to management and the board.