Its the audit firm who has an MLRO and audit team should report any suspicions to him. What if somebody from the client wants to report a suspicion.. its basically whistle blowing right.. does he also come to mlro ?
It would be reported internally first – ideally the audit committee if there is one. If no action is taken then it would be normal to go to the authorities (eg police). I suppose it could also be reported to the auditors’ MLRO who would be duty-bound to react.