Final answer:
An auditor who discovers an illegal act at a public company must first inform the company's management and board. If they don't act appropriately, the auditor should then notify the Securities and Exchange Commission (SEC).
Step-by-step explanation:
If an auditor uncovers an illegal act at a public company, the auditor themselves is not responsible for notifying local law enforcement officials; instead, they must first bring it to the attention of the company's management and its board of directors. According to the Sarbanes-Oxley Act and various professional auditing standards, if the management and the board do not take appropriate action to address the illegal act, the auditor then has a responsibility to take the matter further. The next step would typically involve informing the Securities and Exchange Commission (SEC), as they have authority over securities laws and public companies. The auditor does not have an obligation to report the matter to the Public Company Accounting Oversight Board (PCAOB) directly unless it pertains to a violation of the PCAOB's standards. The answer to the student's question would be (C) the Securities and Exchange Commission.