To whom should the auditor report suspicion of fraud if management is suspected?

When an auditor suspects fraud involving management, the most appropriate course of action is to report the suspicion to internal management or governance, such as the board of directors or an audit committee. This approach is grounded in the auditor's obligation to maintain professional conduct and to follow established protocols for addressing concerns within the organization.

Reporting to internal management or governance allows the responsible parties who oversee management to investigate the matter further and take appropriate action. Governance structures are generally in place to handle such suspicions, ensuring that the organization can address potential misconduct while maintaining confidentiality and protecting whistleblowers.

Additionally, reporting to the shareholders directly or to the general public is not advisable at this stage, as it can lead to unnecessary panic, reputational harm, or legal implications before a thorough investigation has been completed. Likewise, external regulators should only be informed if internal governance mechanisms fail to address the issue adequately or if required by law, typically after the internal reporting and investigation have taken place. Therefore, the correct answer emphasizes the importance of following the proper internal channels before escalating the matter externally.