Should internal audit review marketing ad fraud risk?

Yes, if the risk assessment supports it. Internal audit does not need to audit marketing every year, but marketing can contain meaningful risk: significant spend, third-party execution, privacy exposure, regulatory messaging, brand impact, and performance reporting that management relies on.

The audit rationale should be framed around business risk rather than curiosity. For example, a paid lead-generation campaign may involve vendor contracts, platform configuration, invoice approvals, consent capture, CRM handoff, and quality monitoring. If those controls are weak, management may pay for activity that does not support real pipeline or may accept data without sufficient source validation.

The audit plan should also consider competence. If the team lacks digital advertising expertise, the engagement may require marketing operations, data analytics, IT, legal, or an external specialist. That is not a reason to ignore the area. It is a reason to scope the work carefully.

For a CIA-style answer, the best position is: include marketing when risk-based planning, spend, third-party reliance, fraud risk, or compliance exposure makes it significant.