If an outside auditor determines an illegal act may have occurred, what is their first step?

When an outside auditor discovers evidence suggesting that an illegal act may have occurred, the first step they should take is to report it to the board of director's audit committee. This action is crucial because the audit committee is part of the governance structure designed to oversee the integrity of financial reporting and compliance within a company. The audit committee comprises independent members who can take appropriate actions without undue influence from management, ensuring that the matter is addressed transparently and properly.

By reporting to the audit committee, the auditor ensures that the information is conveyed to those charged with governance, who can then evaluate the situation, decide on the necessary course of action, and communicate with or involve other necessary stakeholders, including legal counsel and potentially regulators, if needed. This step also reflects the auditor's responsibilities under auditing standards, which typically require an escalation of significant issues to those in governance.

The other options might involve steps taken later in the process but are not the immediate first action an auditor should take in such a situation.