When internal audit is authorized to conduct fraud investigations, collected evidence must be protected and documented so its integrity, authenticity, and handling can be demonstrated. Maintaining a proper chain of custody records who obtained the evidence, when it was obtained, how it was transferred, where it was stored, and who subsequently accessed it. This is particularly important if investigation results could lead to legal, regulatory, employment, or disciplinary proceedings. Internal auditors are not automatically required to report every fraud directly to external authorities because reporting responsibilities depend on organizational policies and applicable law. Determining disciplinary action is generally management’s responsibility. Investigations may also require legal counsel, forensic specialists, security personnel, or other qualified parties, so participation is not necessarily restricted to internal audit. Therefore, maintaining evidence custody is the appropriate role.