Internal audit can assist management by facilitating a fraud risk assessment. Management should make the decision both on the level of risk and whether it is acceptable. Internal audit can provide their opinion and advice on both.
Reducing the risk of fraud from both external and internal sources is something that all businesses have to consider at some time, or continually, depending on the owner's approach and taste for living on the edge. But seriously, fraud is a serious problem that can damage or even destroy a business, particularly small and medium ones, which can't afford the potential losses.