Responding to Actual or Suspected Fraud: The Specific Requirements of ISA 240 (Revised)
Key takeaways
- ISA 240 (Revised) applies to audits of financial statements for periods beginning on or after 15 December 2026.
- Paragraphs 55–58 form a dedicated ‘Fraud or Suspected Fraud’ section with specific requirements.
- An allegation of fraud from another party is treated as suspected fraud once it comes to the auditor’s attention.
- ‘Clearly inconsequential’ is not the same as ‘below materiality’; small frauds involving senior management may still be significant.
- The auditor should not simply continue with the original audit programme: reassess risks, evidence reliability, the opinion, communication and any external reporting duties.
Fraud has always been an important consideration in a financial statement audit, but ISA 240 (Revised), applicable to audits of financial statements for periods beginning on or after 15 December 2026, places greater emphasis on the auditor’s response when fraud or suspected fraud is identified.
A significant practical change is the introduction of a dedicated section dealing with ‘Fraud or Suspected Fraud’. ISA 240 (Revised), paragraphs 55–58, establishes specific requirements that apply when fraud or suspected fraud comes to the auditor’s attention. The auditor is, therefore, required to do more than simply consider the matter as part of the general audit response.
Understand the fraud or suspected fraud
When the auditor identifies fraud or suspected fraud, the first step is to obtain an understanding of the matter and determine its potential effect on the audit.
The auditor must make enquiries of the appropriate level of management and, where appropriate, those charged with governance. The auditor must also evaluate the entity’s response to the matter. Where the entity has a process for investigating the matter, the auditor must evaluate whether that process is appropriate. Similarly, where management has implemented remedial actions, the auditor must evaluate whether those actions are appropriate in the circumstances.
This does not mean that the auditor must conduct a forensic investigation in every case. The auditor’s role remains that of an auditor, rather than an investigator. They should, however, invest sufficient effort to understand the matter and determine its implications for the audit.
Depending on the circumstances, the auditor may need to involve an auditor’s expert with forensic skills, inspect whistleblower programme files, or make further enquiries of legal counsel or internal audit.
Importantly, an allegation of fraud received from another party is treated as suspected fraud, once it comes to the auditor’s attention. The stipulations of paragraphs 55–58 may, therefore, be implemented, even though the auditor has not established that fraud actually occurred.
The ‘clearly inconsequential’ exception
Once the auditor has obtained an understanding of the matter, the engagement partner must take further action, unless the fraud or suspected fraud is determined to be clearly inconsequential.
This threshold provides some proportionality. A genuinely insignificant instance of employee misconduct would not necessarily require the same response as suspected manipulation of revenue by senior management.
However, ‘clearly inconsequential’ should not be equated with ‘below materiality’. A relatively small fraud involving senior management may still be significant because it raises questions about management’s integrity and the reliability of other information obtained during the audit.
Reassess the risks and audit approach
In the case of fraud or suspected fraud that is not clearly inconsequential, the engagement partner must determine whether additional risk assessment procedures are necessary and whether further audit procedures should be performed, in response to the risks of material misstatement, due to fraud.
The engagement partner must also consider whether there are additional responsibilities under ISA 250 (Revised), relating to non-compliance with laws and regulations. Fraud ordinarily constitutes non-compliance with laws or regulations, for purposes of the ISAs.
The practical message is clear: the auditor should not simply continue with the original audit programme after identifying fraud. The matter may indicate that the original risk assessment was incomplete, or that the fraud risk is more extensive than initially thought.
The engagement partner should, therefore, reconsider the audit strategy and determine whether additional procedures, resources or specialist skills are required. The auditor should also consider whether the matter has implications for prior-period audits.
Where a misstatement, due to fraud, is identified
Where the auditor identifies an actual misstatement due to fraud, the auditor:
- Determines whether the misstatement is material, considering both qualitative and quantitative factors. The amount involved is, therefore, not the only consideration.
- Determines whether control deficiencies exist, including significant deficiencies relating to the prevention or detection of fraud.
- Considers the implications of the misstatement for other aspects of the audit, particularly where management may be involved.
- Reconsiders the reliability of management's representations and audit evidence previously obtained. This is particularly important in cases where collusion between employees, management or third parties may have occurred.
The auditor, therefore, needs to consider whether the identified fraud is an isolated matter or an indication of a wider problem.
Effect on the audit opinion
If the auditor determines that the financial statements are materially misstated, due to fraud, or cannot obtain sufficient appropriate audit evidence to determine whether they are materially misstated, due to fraud, the auditor must determine the implications for the audit and the auditor's opinion, in accordance with ISA 705 (Revised).
Where appropriate, the auditor should also obtain legal advice.
In exceptional circumstances, the fraud may be so serious that the auditor questions the viability of continuing the engagement. The auditor must then consider applicable professional and legal responsibilities, whether withdrawal is appropriate and, where withdrawal is not permitted, whether the circumstances may result in a disclaimer of opinion.
Communication and reporting
The response to fraud does not end with additional audit procedures.
Fraud or suspected fraud must be communicated on a timely basis to the appropriate level of management, unless prohibited by law or regulation. Where the fraud involves management, employees with significant internal control responsibilities, or other matters that are not clearly inconsequential, communication to those charged with governance is also required.
Where suspected fraud involves management, the auditor must discuss with those charged with governance, the nature, timing and extent of audit procedures necessary to complete the audit.
The auditor must also determine whether law, regulation or relevant ethical requirements require, or permit reporting to an appropriate authority outside the entity. This must be considered, together with the auditor's responsibilities, under ISA 250 (Revised), and applicable professional and legal requirements.
Documentation
Where fraud or suspected fraud is identified, the audit documentation should clearly record the matter identified, procedures performed, significant professional judgments and conclusions reached.
The auditor should also document communications with management, those charged with governance and, where applicable, external authorities, including the responses received.
Thorough documentation is crucial because the audit file should demonstrate how the auditor responded to the fraud risk and why the conclusions reached were appropriate.
Conclusion
The key message from ISA 240 (Revised) is that identifying fraud or suspected fraud should trigger a deliberate ‘pause and reassess’ response.
The auditor must understand the matter, evaluate management's investigation and remediation, reconsider the fraud risks, determine whether additional audit work is required, reassess the reliability of evidence already obtained, consider the effect on the audit opinion, communicate appropriately, and assess any external reporting obligations.
The revised requirements reinforce the fact that the appropriate response is not simply to investigate the individual transaction. The auditor must consider what the matter tells the auditor about the wider audit, management's integrity, the reliability of audit evidence and the possibility that further fraud may exist.
References
- ISA 240 (Revised), The auditor’s responsibilities relating to fraud in an audit of financial statements
- ISA 250 (Revised), Consideration of laws and regulations in an audit of financial statements
- ISA 705 (Revised), Modifications to the opinion in the independent auditor’s report
Frequently asked questions
What does ISA 240 (Revised) require when fraud or suspected fraud is identified?
The auditor must understand the matter, evaluate the entity’s response, and unless the matter is clearly inconsequential, have the engagement partner reassess risks and the audit approach, consider the effect on the opinion, communicate appropriately and document the work.
Does the auditor have to investigate the fraud?
No. The auditor’s role remains that of an auditor, not an investigator, but the auditor must invest enough effort to understand the matter and its implications for the audit. In some cases an auditor’s expert with forensic skills may be needed.
What does ‘clearly inconsequential’ mean?
It is a proportionality threshold, and it is not the same as being below materiality. A relatively small fraud involving senior management may still raise questions about management’s integrity and the reliability of other audit evidence.
Who must be told about fraud or suspected fraud?
It must be communicated on a timely basis to the appropriate level of management, unless prohibited by law or regulation. Where it involves management, employees with significant internal control responsibilities, or other matters that are not clearly inconsequential, those charged with governance must also be informed.
This newsletter is also published on LEAF’s LinkedIn newsletter. To receive future editions, subscribe using the newsletter sign-up on this page.
Latest Updates
What's News
Navigating the Audit Ecosystem: Aligning Value, Responsibility, and Cost
In a healthy business ecosystem, the primary objective is to serve clients and the community responsibly. Achieving this requires a management structure tailored to the organisation’s specific size, risks, and business model. However, a significant ‘expectation gap’ often arises regarding the role of the audit within this ecosystem, particularly concerning who is responsible for safety and how much that safety should cost.
The responsibility paradox
Management is tasked with implementing risk...
Audit Issues & Trends to Consider
Expected credit losses
When auditing clients that apply IFRS Accounting Standards, one of the most challenging areas to consider is expected credit losses (ECL). Audit clients often find it challenging themselves and, in some cases, make use of experts to assist them with their assessment. In other cases, management attempt to justify why they are not providing for expected credit losses...
