Quaestor Volume 22, Issue 1

The last edition of the Quaestor explored Domain IV: Managing the Internal Audit Function, which addresses the Chief Audit Executive’s (CAE’s) responsibility for leading and managing the internal audit activity. This edition concludes the series with Domain V: Performing Internal Audit Services, the fifth and final domain of the Standards.

Domain V includes three principles (Principles 13 through 15) and 14 related standards focused on planning and conducting individual engagements, communicating results, and monitoring corrective actions:

Principle 13: Plan Engagements Effectively – Internal auditors must plan each engagement using a systematic and disciplined approach. Planning includes understanding the activity under review, assessing risks, establishing objectives and scope, identifying evaluation criteria and resources, and developing the work program.

• Standard 13.1 Engagement Communication – Internal auditors must communicate the objectives, scope, timing, changes, and results throughout the engagement.
• Standard 13.2 Engagement Risk Assessment – Internal auditors must understand the activity, assess significant risks, including fraud risks, and prioritize them for review.
• Standard 13.3 Engagement Objectives and Scope – Internal auditors must document the engagement’s purpose, objectives, and boundaries.
• Standard 13.4 Evaluation Criteria – Internal auditors must identify relevant criteria for evaluating the activity.
• Standard 13.5 Engagement Resources – Internal auditors must identify the resources needed to achieve the engagement objectives.
• Standard 13.6 Work Program – Internal auditors must document the tasks, methodologies, tools, and assignments needed to complete the engagement.

Examples of Conformance:

• IACA meets with management during planning to understand the business environment, discuss key functions, risks, known control concerns, recent or expected changes, and establish the preliminary scope, key contacts, timing, and communication plan.
• IACA assesses risks for significant activities, establishes engagement objectives and scope, and develops a work plan that may include process documentation reviews, interviews, transaction testing, account analysis, and data analysis.

Principle 14: Conduct Engagement Work – Internal auditors must complete the work program, gather and analyze evidence, evaluate findings, develop recommendations or action plans with management, reach conclusions, and document the results.

• Standard 14.1 Gathering Information for Analyses and Evaluation – Internal auditors must obtain relevant, reliable, and sufficient information.
• Standard 14.2 Analyses and Potential Engagement Findings – Internal auditors must analyze information to identify differences between the applicable criteria and existing conditions.
• Standard 14.3 Evaluation of Findings – Internal auditors must evaluate potential findings, identify root causes when possible, assess the effects and significance, and prioritize each finding.
• Standard 14.4 Recommendations and Action Plans – Internal auditors must determine appropriate actions to address findings, root causes, and related risks.
• Standard 14.5 Engagement Conclusions – Internal auditors must develop a conclusion that summarizes the engagement results and their professional judgment regarding the overall significance of the findings.
• Standard 14.6 Engagement Documentation – Internal auditors must document the information, analyses, evaluations, and evidence supporting engagement results so that a knowledgeable person could repeat the work and reach the same conclusions.

Examples of Conformance:

• During fieldwork, IACA reviews and evaluates internal controls through process documentation, interviews, transaction testing, account analysis, data analysis, and other procedures considered appropriate for the engagement.
• When a control weakness is identified, IACA documents the observation and related risk and reviews the matter with responsible management for accuracy. Observations are assessed based on their impact and likelihood.
• At the audit exit meeting, IACA discusses final observations, associated risks, and recommendations with management. Management may adopt IACA’s recommendation or propose another action that adequately mitigates the identified risk.
• IACA reports an overall assessment of the control environment, or control design when no testing is performed, for each scope area using the ratings Effective/Adequate, Needs Improvement, or Ineffective/Inadequate.

Principle 15: Communicate Engagement Results and Monitor Action Plans – Internal auditors must communicate engagement results to the appropriate parties and monitor management’s progress in implementing recommendations or action plans.

• Standard 15.1 Final Engagement Communication – Internal auditors must issue a final communication that includes the engagement objectives, scope, findings, conclusions, and recommendations and/or action plans, as applicable. For assurance engagements, the communication also must address the significance and prioritization of findings, any scope limitations, and the effectiveness of the governance, risk management, and control processes reviewed.
• Standard 15.2 Confirming the Implementation of Recommendations or Action Plans – Internal auditors must follow an established methodology to monitor progress, perform risk-based follow-up, and confirm that management’s agreed-upon actions have been implemented.

Examples of Conformance:

• At the conclusion of an engagement, IACA issues an Executive Summary and, as applicable, Detailed Observations and Advisory Observations reports. Detailed Observations include the observation, related risks, IACA’s recommendation, management’s action plan, responsible responder, and estimated implementation date.
• IACA reviews engagement results with management before issuing the final reports and distributes each report to the parties appropriate for its level of detail and the nature of the observations.
• IACA monitors management action plans based on the agreed implementation dates and requires supporting documentation to confirm completion. Delays, alternative actions, and decisions to accept risk must be documented; past-due items and risks accepted by senior management are reported periodically to the Risk and Audit Committee.

Domain V brings the Standards from strategy into practice. By applying a consistent approach to planning, fieldwork, communication, and follow-up, internal auditors provide stakeholders with objective, well-supported results and help strengthen governance, risk management, and control processes across the university.

Seeing Is No Longer Believing

In January 2024, a finance employee at a multi-national engineering firm joined a video call with the company’s CFO and several colleagues. He was asked to send a series of urgent, confidential payments, and he did: 15 transfers totaling over $20 million. Everyone else on that call was a deepfake.

The employee had been suspicious of the first email. What convinced him was seeing and hearing familiar faces. Company sources later noted that none of the company’s systems were hacked. The attackers simply persuaded one person to act.

Why This Matters at RIT

Every day, RIT faculty and staff approve payments, update payroll and vendor details, handle student records, and manage research data, often from a smartphone between meetings. That makes us an attractive target. Our names, titles, and contact details are easy to find in public directories and on department pages, and many of us have recorded lectures, talks, or interviews online. That is exactly the material attackers use to clone a voice or a face. Attackers don’t need to break into RIT’s systems if they can convince one of us to open the door for them.

How These Attacks Work Together

These tactics are often combined to build a more persuasive story. A text (smishing) sets up the story, a phone call (vishing) adds pressure, and a familiar voice or face removes the doubt. In 2025, the FBI warned about a campaign that did exactly this, using texts and AI-generated voice messages that impersonated senior U.S. officials to build rapport before stealing account access.

The losses are significant. The Federal Trade Commission (FTC) reported that consumers lost $470 million to scams that started with a text message in 2024, five times the amount reported in 2020. In 2025, imposter scams of all kinds accounted for $3.5 billion in reported losses.

Attacks That Succeeded

In these cases, the request was acted on before anyone verified it.

The Harvard and Penn cases hit closest to home. Universities hold exactly the data these groups want, and the attackers reached it through administrative staff, not through technical hacking.

Attacks That Were Stopped

In these cases, an employee paused and checked before acting. 

None of these attacks were stopped by technology. They were stopped by people who took a moment to verify.

Why These Attacks Are Hard to Detect

The FBI has noted that “AI-generated content has advanced to the point that it is often difficult to identify.” A 2025 Gartner survey of security leaders found that 43% had dealt with audio deepfakes and 37% had encountered deepfakes on video calls. Three things make these attacks especially hard to catch:

1. The usual warning signs are gone. There are no typos, strange links, or odd sender addresses on a phone call or video meeting.
2. Caller ID and names can be faked. A text can appear to come from a known number, and a call can display a trusted name.
3. They target instinct, not knowledge. Attackers create urgency, invoke authority, and ask for secrecy. That pressure pushes people to act before they think.

Some deepfakes still have tells, such as a flat voice, odd pauses, or lips that don’t quite match the words. But the safest assumption is that a good deepfake will look and sound right. That is why our defense has to be a habit, not a talent for spotting fakes.

Your Best Defense: Add Friction and Pause

Almost every successful scam depends on you acting quickly. Friction takes that advantage away. A call-back, a second approval, or a quick check with a colleague adds only a minute, but it gives you time to notice that something doesn’t add up.

Pause whenever a request:

• Is urgent or comes with a deadline
• Involves money, gift cards, payroll, banking details, passwords, or MFA codes
• Asks you to keep it confidential or skip the usual process
• Moves you to a new channel, such as “text me at this number” or “join this other meeting link”

Then take these steps:

1. Stop. Don’t click, pay, or approve anything yet. A real request will still be real in ten minutes.
2. Verify on a separate channel. Hang up and call the person back on a number you already know, such as one from the RIT directory, not the number in the message.
3. Ask a question only the real person would know, the way the Ferrari executive did.
4. Never share an MFA code or approve a login prompt you didn’t start. RIT’s ISO and ITS will never ask you for your password or codes.
5. Follow the normal process, especially when the request comes from someone senior. A legitimate leader will understand.

Already Responded? Report It

Even if you’ve already clicked a link, shared a code, or approved a login, the best thing to do is report it right away. Acting quickly limits the damage. For guidance on reporting and responding to these attacks, visit the ISO’s phishing page: rit.edu/security/phishing.

The Bottom Line

Deepfakes will keep getting better, but the defense stays simple. When a request is urgent, involves money or access, or just feels off, pause and verify.

Sources

• 11 Deepfake Attack Examples (Adaptive Security, June 2026)
• Arup deepfake interview (World Economic Forum)
• FBI warns of AI voice messages impersonating top U.S. officials (CNBC, May 2025)
• FBI deepfake warning (The Register)
• FTC: Text Scam Losses hit $470 million in 2024
• FTC: $3.5 billion lost to imposter scams in 2025 (BleepingComputer)
• Harvard and Penn data leaked after vishing (State of Surveillance)