Once an observation is identified, there are several steps the internal audit function must go through to: flag the issue as a potential fraud Immediately communicate to the CAE and audit committee determine what impact, if any, the observation has on the internal audit function's evaluation of whether the related controls are designed adequately and operating effectively do nothing