The scope of internal audit within an organization can be broad and may include topics such as organizational management, governance and management controls over: operational efficiency / effectiveness risks (including asset protection), reliability of financial and management reporting and compliance with laws and regulations. Internal audit may also include conducting proactive fraud audits to identify potentially fraudulent acts; participating in fraud investigations under the guidance of a fraud investigation expert and conducting a postinvestigation fraud audit to identify control breaches and identify financial loss. Regardless of the policies and procedures established by the organization, only reasonable assurance can be given that internal controls are effective and that financial information is accurate. The effectiveness of internal controls is limited by human judgment. The company will often be particularly high-level given the opportunity to override internal controls for reasons of operational efficiency, and internal controls can be circumvented by negotiation. Within these areas, it is important to think of the internal auditor as a critical friend of the organization - someone who can challenge existing practice, advocate best practice and be a catalyst for improvement so that the organization as a whole achieves its strategic goals.