How would internal audit approach marketing spend when the risk is fake traffic or inflated campaign KPIs?

Question

AcadiFi · Accepted Answer

Treat the engagement as a risk-based operational audit, not as a hunt for a bad actor. The audit objective is to determine whether market...

Unlock with Scholar — $19/month

Get full access to all Q&A answers, practice question explanations, and progress tracking.

Start 7-Day Free Trial Compare Plans

No credit card required for free trial

At fictional Northstar Retail, management spent $2.4 million on digital campaigns tied to lead-volume bonuses. Internal audit found that the dashboard counted every click as a qualified lead, even when the same device created hundreds of visits in one hour. The audit team did not begin with an accusation. It mapped risks and controls first.

```mermaid
flowchart TD
  A[Campaign budget] --> B[Vendor selection]
  B --> C[Traffic monitoring]
  C --> D[KPI validation]
  D --> E[Payment approval]
  C --> F[Exception review]
  F --> D
```

Useful procedures include reconciling invoices to approved purchase orders, testing a sample of campaign metrics to independent platform reports, reviewing bot-filter rules, checking whether incentive plans reward quality rather than raw volume, and confirming that suspicious traffic is escalated before vendor payment. The strongest finding is usually not "marketing bought bad traffic." It is "management relies on an unvalidated KPI to approve spend and bonuses." That wording ties the issue to governance, control design, and measurable business risk. Practice more in our CIA question bank.

How would internal audit approach marketing spend when the risk is fake traffic or inflated campaign KPIs?

Master Part 2 with our CIA Course

Related Questions

Practice Questions