This statement is false. The correct protocol is for the auditor to promptly report the irregularity or suspected illegal act to a level of management one tier above where the activity occurred. If the suspected activity involves those responsible for internal controls, the matter should be escalated to the highest available level of management — typically the audit committee. The auditor should never contact law enforcement directly unless specifically advised to do so by their own legal counsel.