ASA 240

This Auditing Standard applies to: 

a. an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with the Corporations Act 2001; and 

b. an audit of a financial report, or a complete set of financial statements, for any other purpose.

This Auditing Standard also applies, as appropriate, to an audit of other historical financial information.

This Auditing Standard is operative for financial reporting periods beginning on or after 15 December 2026.

This Australian Standard on Auditing (ASA) deals with the auditor’s responsibilities relating to fraud in an audit of a financial report and the implications for the auditor’s report. The requirements and guidance in this ASA refer to, or expand on, the application of other relevant ASAs, in particular ASA 200^[1], ASA 220^[2], ASA 315^[3], ASA 330^[4], and ASA 701^[5]. Accordingly, this ASA is intended to be applied in conjunction with other relevant ASAs.

Responsibilities of the Auditor

The auditor’s responsibilities relating to fraud when conducting an audit in accordance with this ASA, and other relevant ASAs, are to: (Ref: Para. A1)

a. Plan and perform the audit to obtain reasonable assurance about whether the financial report as a whole is free from material misstatement due to fraud. These responsibilities include identifying and assessing risks of material misstatement in the financial report due to fraud and designing and implementing responses to address those assessed risks.

b. Communicate and report about matters related to fraud.

Responsibilities of Management and Those Charged with Governance

The primary responsibility for the prevention and detection of fraud rests with both management and those charged with governance of the entity. It is important that management, with the oversight of those charged with governance, place a strong emphasis on fraud prevention, which may reduce opportunities for fraud to take place, and fraud deterrence, which could persuade individuals not to commit fraud because of the likelihood of detection and punishment. This involves a commitment to creating and maintaining a culture of honesty and ethical behaviour that can be reinforced by active oversight by those charged with governance. Oversight by those charged with governance includes considering the potential for override of controls or other inappropriate influence over the financial reporting process, such as efforts by management to manipulate earnings in order to influence the perceptions of financial report users regarding the entity’s performance.

Characteristics of Fraud

Misstatements in the financial report can arise from either fraud or error. The distinguishing factor between fraud and error is whether the underlying action that results in the misstatement of the financial report is intentional or unintentional.

Two types of intentional misstatements are relevant to the auditor – misstatements resulting from fraudulent financial reporting and misstatements resulting from misappropriation of assets. (Ref: Para. A2–A6)

Fraud or Suspected Fraud

Although fraud is a broad legal concept, for the purposes of the ASAs, the auditor is concerned with a material misstatement of the financial report due to fraud. Although the auditor may identify or suspect the occurrence of fraud as defined by this ASA, the auditor does not make legal determinations of whether fraud has actually occurred.

The auditor may identify fraud or suspected fraud when performing audit procedures in accordance with this and other ASAs. Suspected fraud includes allegations of fraud that come to the auditor’s attention during the course of the audit. (Ref: Para. A7–A10 and A28)

The auditor’s determination of whether a fraud or suspected fraud is material to the financial report involves the exercise of professional judgement. For identified misstatement(s) due to fraud, this includes consideration of the nature of the circumstances giving rise to the fraud. Judgements about materiality involve both qualitative and quantitative considerations. (Ref: Para. A11)

Inherent Limitations

While the risk of not detecting a material misstatement resulting from fraud is higher than the risk of not detecting one resulting from error, that does not diminish the auditor’s responsibility to plan and perform the audit to obtain reasonable assurance about whether the financial report as a whole is free from material misstatement due to fraud. Reasonable assurance is a high, but not absolute, level of assurance.^[6]

Because of the significance of the inherent limitations of an audit as it relates to fraud, there is an unavoidable risk that some material misstatements of the financial report may not be detected, even though the audit is properly planned and performed in accordance with the ASAs.^[7] However, the inherent limitations of an audit are not a justification for the auditor to be satisfied with less than persuasive audit evidence.^[8] (Ref: Para. A12)

Furthermore, the risk of the auditor not detecting a material misstatement resulting from management fraud is greater than for employee fraud because management is frequently in a position to directly or indirectly manipulate accounting records, present fraudulent financial information, or override controls designed to prevent similar frauds by other employees.

Professional Scepticism and Professional Judgement

In accordance with ASA 200,^[9] the auditor is required to plan and perform the audit with professional scepticism and to exercise professional judgement. The auditor is required by this ASA to remain alert to the possibility that other audit procedures performed may bring information about fraud or suspected fraud to the auditor’s attention. Accordingly, it is important that the auditor maintain professional scepticism throughout the audit, considering the potential for management override of controls, and recognising that audit procedures that are effective for detecting error may not be effective in detecting fraud.

Professional judgement is exercised in making informed decisions about the courses of action that are appropriate in the circumstances, including when the auditor identifies fraud or suspected fraud. Professional scepticism supports the quality of judgements made by the engagement team and, through these judgements, supports the overall effectiveness of the engagement team in achieving quality at the engagement level. (Ref: Para. A13–A14)

Non-Compliance with Laws and Regulations

For the purposes of this and other relevant ASAs, fraud ordinarily constitutes an instance of non-compliance with laws and regulations. As such, if the auditor identifies fraud or suspected fraud, the auditor also has responsibilities in accordance with ASA 250.^[10] (Ref: Para. A15–A17)

Some ASAs that address specific topics also have requirements and guidance that are applicable to the auditor’s work on the identification and assessment of the risks of material misstatement due to fraud and responses to address such assessed risks of material misstatement due to fraud. In these instances, the other ASAs expand on how this ASA is applied. (Ref: Para. A18)

[Deleted by the AUASB. Refer Aus 0.3]

The objectives of the auditor are:

1. To identify and assess the risks of material misstatement of the financial report due to fraud;

2. To obtain sufficient appropriate audit evidence regarding the assessed risks of material misstatement due to fraud, through designing and implementing appropriate responses;

3. To respond appropriately to fraud or suspected fraud identified during the audit; and

4. To report in accordance with this ASA.

For purposes of the ASAs, the following terms have the meanings attributed below:

Fraud – An intentional act by one or more individuals among management, those charged with governance, employees, or third parties, involving the use of deception to obtain an unjust or illegal advantage. (Ref: Para. A19–A23)

Fraud risk factors – Events or conditions that indicate an incentive or pressure to commit fraud, or provide an opportunity to commit fraud, or an attitude or rationalisation that justifies the fraudulent action. (Ref: Para. A24–A26)

In applying ASA 200,^[11] the auditor shall maintain professional scepticism throughout the audit, recognising the possibility that a material misstatement due to fraud could exist. (Ref: Para. A27)

The auditor shall remain alert throughout the audit for information that indicates that one or more fraud risk factors are present and circumstances that may be indicative of fraud or suspected fraud. (Ref: Para. A28–A32)

Where responses to enquiries of management, those charged with governance, individuals within the internal audit function, or others within the entity are inconsistent, the auditor shall investigate the inconsistencies. (Ref: Para. A33)

If conditions identified during the audit cause the auditor to believe that a record or document may not be authentic or that terms in a document have been modified but not disclosed to the auditor, the auditor shall investigate further. (Ref: Para. A34–A37)

In applying ASA 220,^[12] the engagement partner shall determine that members of the engagement team collectively have the appropriate competence and capabilities, including sufficient time and appropriate specialised skills or knowledge to perform risk assessment procedures, identify and assess the risks of material misstatement due to fraud, design and perform further audit procedures to respond to those risks, or evaluate the audit evidence obtained. (Ref: Para. A38–A42)

In applying ASA 220,^[13] the engagement partner shall determine that the nature, timing and extent of direction, supervision and review is responsive to the nature and circumstances of the audit engagement, considering matters identified during the course of the audit engagement, including: (Ref: Para. A43)

a. Fraud risk factors;

b. Fraud or suspected fraud; and

c. Control deficiencies related to the prevention or detection of fraud.

The auditor shall communicate with management and those charged with governance matters related to fraud at appropriate times throughout the audit engagement. (Ref: Para. A44–A48)

In applying ASA 315,^[14] the auditor shall perform the procedures in paragraphs 27–38. In doing so, the auditor shall consider whether one or more fraud risk factors are present. (Ref: Para. A49)

Information from Other Sources

In applying ASA 315,^[15] the auditor shall consider whether information from other sources obtained by the auditor indicates that one or more fraud risk factors are present. (Ref: Para. A50–A51)

Retrospective Review of the Outcome of Previous Accounting Estimates

In applying ASA 540,^[16] the auditor shall perform a retrospective review of management judgements and assumptions related to the outcome of previous accounting estimates, or where applicable, their subsequent re-estimation to assist in identifying and assessing the risks of material misstatement due to fraud in the current period. In doing so, the auditor shall take into account the characteristics of the accounting estimates in determining the nature and extent of that review. (Ref: Para. A52)

Engagement Team Discussion

In applying ASA 315,^[17] when holding the engagement team discussion, the engagement partner and other key engagement team members shall place particular emphasis on how and where the entity’s financial report may be susceptible to material misstatement due to fraud, including how fraud may occur. In doing so, the engagement team discussion shall include: (Ref: Para. A43, A53–A54 and A59)

a. An exchange of ideas about:

i. The entity’s culture, management’s commitment to integrity and ethical values, and related oversight by those charged with governance; (Ref: Para. A55)

ii. Fraud risk factors, including: (Ref: Para. A56–A57)

a. Incentives or pressures on management, those charged with governance, or employees to commit fraud;

b. How one or more individuals among management, those charged with governance, or employees could perpetrate and conceal fraudulent financial reporting; and

c. How assets of the entity could be misappropriated by management, those charged with governance, employees or third parties.

iii. Which types of revenue, revenue transactions or relevant assertions may give rise to the risks of material misstatement due to fraud in revenue recognition; and

iv. How management may be able to override controls. (Ref: Para. A58)

b. A consideration of any fraud or suspected fraud that may impact the overall audit strategy and audit plan, including fraud that has occurred at the entity during the current or prior years.

Analytical Procedures Performed and Unusual or Unexpected Relationships Identified

The auditor shall determine whether unusual or unexpected relationships that have been identified in performing analytical procedures, including those related to revenue accounts, may indicate risks of material misstatement due to fraud. (Ref: Para. A60)

Understanding the Entity and Its Environment, and the Applicable Financial Reporting Framework

In applying ASA 315,^[18] based on the auditor’s understanding of the entity and its environment, the applicable financial reporting framework and the entity’s accounting policies, the auditor shall obtain an understanding of matters that may lead to an increased susceptibility to misstatement due to management bias or other fraud risk factors. (Ref: Para. A61–A70)

Understanding the Components of the Entity’s System of Internal Control 

Control Environment

In applying ASA 315,^[19] the auditor shall:

a. Obtain an understanding of:

i. How management’s oversight responsibilities are carried out, such as the entity’s culture and management’s commitment to integrity and ethical values, including how management communicates with its employees its views on business practices and ethical behaviour with respect to the prevention and detection of fraud. (Ref: Para. A71–A72)

ii. The entity’s whistleblower program (or other program to report fraud), if the entity has such a program, including how management and, if applicable, those charged with governance address allegations of fraud made through the program. (Ref: Para. A73–A75)

iii. How those charged with governance exercise oversight of management’s processes for identifying and responding to the fraud risks and the controls that management has established to address these risks. (Ref: Para. A76–A79)

b. Make enquiries of management regarding management’s communications with those charged with governance regarding its processes for identifying and responding to the risks of fraud in the entity.

c. Make enquiries of those charged with governance about: (Ref: Para. A80–A82)

i. Whether they have knowledge of any fraud or suspected fraud including allegations of fraud, including those received from tips or complaints, affecting the entity, and if so, how they have responded to such matters;

ii. Their views about whether and how the financial report may be materially misstated due to fraud, including their views on possible areas that are susceptible to misstatement due to management bias or management fraud; and

iii. Whether they are aware of deficiencies in the system of internal control related to the prevention and detection of fraud, and the remediation efforts to address such deficiencies.

The Entity’s Risk Assessment Process

In applying ASA 315,^[20] the auditor shall:

1. Obtain an understanding of how the entity’s risk assessment process: (Ref: Para. A83–A91, A107)
   1. Identifies fraud risks related to the misappropriation of assets and fraudulent financial reporting, including any classes of transactions, account balances, or disclosures for which risks of fraud exist;
   2. Assesses the significance of the identified fraud risks, including the likelihood of their occurrence; and
   3. Addresses the assessed fraud risks.
2. Make enquiries of management and of other appropriate individuals within the entity about: (Ref: Para. A92–A95)
   1. Whether they have knowledge of any fraud or suspected fraud, including allegations of fraud, affecting the entity; and
   2. Their views about whether and how the financial report may be materially misstated due to fraud.

The Entity’s Process to Monitor the System of Internal Control

In applying ASA 315,^[21] the auditor shall:

1. Obtain an understanding of:
   1. Aspects of the entity’s process to monitor the system of internal control that address the ongoing and separate evaluations for monitoring the effectiveness of controls to prevent or detect fraud, and the identification and remediation of related control deficiencies identified; and (Ref: Para. A96)
   2. If the entity has an internal audit function, the internal audit function’s objectives in respect of monitoring controls over risks of fraud.
2. If the entity has an internal audit function, make enquiries of appropriate individuals within the internal audit function about whether: (Ref: Para. A97–A98)
   1. They have performed any procedures in respect of monitoring controls over risks of fraud during the period;
   2. They have knowledge of any fraud or suspected fraud, including allegations of fraud, affecting the entity and to obtain their views about the risks of fraud; and
   3. They are aware of deficiencies in the system of internal control related to the prevention and detection of fraud.

The Information System and Communication

In applying ASA 315,^[22] the auditor’s understanding of the entity’s information system and communication relevant to the preparation of the financial report shall include understanding how journal entries and other adjustments are initiated, processed, recorded, and corrected as necessary. (Ref: Para. A99–A101)

Control Activities

In applying ASA 315,^[23] the auditor’s understanding of the entity’s control activities shall include identifying controls that address risks of material misstatement due to fraud at the assertion level, including controls over journal entries and other adjustments, designed to prevent or detect fraud. (Ref: Para. A102–A107)

Control Deficiencies Within the Entity’s System of Internal Control

In applying ASA 315,^[24] based on the auditor’s evaluation of each of the components of the entity’s system of internal control, the auditor shall determine whether there are deficiencies in internal control identified that are relevant to the prevention or detection of fraud. (Ref: Para. A108–A109)

The auditor shall evaluate whether the audit evidence obtained from the risk assessment procedures and related activities indicates that one or more fraud risk factors are present. (Ref: Para. A24–A26 and A110–A112)

In applying ASA 315,^[25] the auditor shall:

a. Identify and assess the risks of material misstatement due to fraud and determine whether they exist at the financial report level, or the assertion level for classes of transactions, account balances and disclosures, taking into account fraud risk factors. (Ref: Para. A113–A114, A116)

b. Treat those assessed risks of material misstatement due to fraud as significant risks. Accordingly, to the extent not already done so, the auditor shall identify controls that address such significant risks, evaluate whether they have been designed effectively to address the risks of material misstatement, or designed effectively to support the operation of other controls, and determine whether they have been implemented. (Ref: Para. A115)

Risks of Material Misstatement Due to Fraud Related to Management Override of Controls

Due to the unpredictable way in which management is able to override controls and irrespective of the auditor’s assessment of the risks of management override of controls, the auditor shall: (Ref: Para. A117–A118)

a. Treat the risks of management override of controls as risks of material misstatement due to fraud at the financial report level; and

b. Determine whether such risks affect the assessment of risks at the assertion level.

Risks of Material Misstatement Due to Fraud in Revenue Recognition

When identifying and assessing the risks of material misstatement due to fraud, the auditor shall, based on a presumption that there are risks of material misstatement due to fraud in revenue recognition, determine which types of revenue, revenue transactions or relevant assertions give rise to such risks, taking into account related fraud risk factors. (Ref: Para. A119–A125)

Designing and Performing Audit Procedures in a Manner That Is Not Biased

The auditor shall design and perform audit procedures in response to the assessed risks of material misstatement due to fraud in a manner that is not biased towards obtaining audit evidence that may corroborate management’s assertions or towards excluding audit evidence that may contradict such assertions.

Unpredictability in the Selection of Audit Procedures

In determining responses to address assessed risks of material misstatement due to fraud, the auditor shall incorporate an element of unpredictability in the selection of the nature, timing and extent of audit procedures. (Ref: Para. A126–A127)

Overall Responses

In accordance with ASA 330,^[26] the auditor shall determine overall responses to address the assessed risks of material misstatement due to fraud at the financial report level. (Ref: Para. A128)

In determining overall responses to address the assessed risks of material misstatement due to fraud at the financial report level, the auditor shall evaluate whether the selection and application of accounting policies by the entity, particularly those related to subjective measurements and complex transactions, may be indicative of fraudulent financial reporting.

Audit Procedures Responsive to the Assessed Risks of Material Misstatement Due to Fraud at the Assertion Level

In accordance with ASA 330,^[27] the auditor shall design and perform further audit procedures whose nature, timing and extent are based on and are responsive to the assessed risks of material misstatement due to fraud at the assertion level. (Ref: Para. A129–A135)

Audit Procedures Responsive to Risks of Material Misstatement Due to Fraud Related to Management Override of Controls

Irrespective of the auditor’s assessment of the risks of management override of controls, the auditor shall design and perform the audit procedures in accordance with paragraphs 48–52, and determine whether other audit procedures are needed in addition to those in paragraphs 48–52, in order to respond to the identified risks of management override of controls.

Journal Entries and Other Adjustments

The auditor shall design and perform audit procedures to test the appropriateness of journal entries recorded in the general ledger and other adjustments made in the preparation of the financial report. (Ref: Para. A136–A139)

In designing and performing audit procedures in accordance with paragraph 48, the auditor shall: (Ref: Para. A99)

a. Make enquiries of individuals involved in the financial reporting process about their knowledge of inappropriate or unusual activity relating to the processing of journal entries and other adjustments;

b. Obtain audit evidence about the completeness of the population of journal entries and other adjustments made throughout the period; (Ref: Para. A140 and A147)

c. Select journal entries and other adjustments made at the end of a reporting period; and (Ref: Para. A141–A143, A144 and A146–A147)

d. Determine the need to test journal entries and other adjustments made throughout the period. (Ref: Para. A142–A143 and A145–A146)

Accounting Estimates

In applying ASA 540,^[28] if indicators of possible management bias are identified, the auditor shall evaluate whether they may represent a risk of material misstatement due to fraud. (Ref: Para. A148–A150)

In performing the evaluation in accordance with paragraph 50, the auditor shall:

a. Consider the audit evidence obtained from the retrospective review performed in accordance with paragraph 28; and

b. If indicators of possible management bias are identified, re-evaluate the accounting estimates taken as a whole. (Ref: Para. A150–A152)

Significant Transactions Outside the Normal Course of Business or Otherwise Appear Unusual

For significant transactions that are outside the normal course of business for the entity, or that otherwise appear to be unusual given the auditor’s understanding of the entity and its environment and information from other sources obtained during the audit, the auditor shall evaluate whether the business rationale (or the lack thereof) of the transactions suggests that they may have been entered into to engage in fraudulent financial reporting or to conceal misappropriation of assets. (Ref: Para. A153)

Analytical Procedures Performed Near the End of the Audit in Forming an Overall Conclusion

In applying ASA 520,^[29] the auditor shall determine whether the results of analytical procedures that are performed near the end of the audit, when forming an overall conclusion as to whether the financial report is consistent with the auditor’s understanding of the entity, indicate a previously unrecognised risk of material misstatement due to fraud. (Ref: Para. A154–A155)

In applying ASA 330,^[30] the auditor shall evaluate, based on the audit procedures performed and audit evidence obtained, whether:

a. The assessments of the risks of material misstatement due to fraud remain appropriate; and

b. Sufficient appropriate audit evidence has been obtained in response to the assessed risks of material misstatement due to fraud.

(Ref: Para. A7–A11, A28 and A156–A172)

If the auditor identifies fraud or suspected fraud, the auditor shall obtain an understanding of the matter(s) in order to determine the effect on the audit engagement. In doing so, the auditor shall: (Ref: Para. A158–A162)

a. Make enquiries about the matter(s) with the appropriate level of management and, when appropriate in the circumstances, make enquiries about the matter(s) with those charged with governance;

b. If the entity has a process to investigate the matter(s), evaluate whether it is appropriate in the circumstances; and

c. If the entity has implemented remedial actions to respond to the matter(s), evaluate whether they are appropriate in the circumstances.

Except for fraud or suspected fraud determined by the auditor to be clearly inconsequential based on the procedures performed in paragraph 55, the engagement partner shall: (Ref: Para. A163–A165)

a. Determine whether:

i. To perform additional risk assessment procedures to provide an appropriate basis for the identification and assessment of the risks of material misstatement due to fraud in accordance with ASA 315;

ii. To design and perform further audit procedures to appropriately respond to the risks of material misstatement due to fraud in accordance with ASA 330; and

iii. There are additional responsibilities for the auditor under law, regulation or relevant ethical requirements about the entity’s non-compliance with laws or regulations in accordance with ASA 250.

b. If applicable, consider the impact on prior period audits.

If the auditor identifies a misstatement due to fraud, the auditor shall: (Ref: Para. A166–A172)

a. Determine whether the identified misstatement is material by considering the nature of the qualitative or quantitative circumstances giving rise to the misstatement;

b. Determine whether control deficiencies exist, including significant deficiencies in internal control related to the prevention or detection of fraud, relating to the identified fraud or suspected fraud;

c. Determine the implications of the misstatement in relation to other aspects of the audit, including when the auditor has reason to believe that management is involved; and

d. Reconsider the reliability of management’s representations and audit evidence previously obtained, including when the circumstances or conditions giving rise to the misstatement indicate possible collusion involving employees, management or third parties.

If the auditor determines that the financial report is materially misstated due to fraud or the auditor is unable to obtain sufficient appropriate audit evidence to enable the auditor to conclude whether the financial report is materially misstated due to fraud, the auditor shall:

a. Determine the implications for the audit and the auditor’s opinion on the financial report in accordance with ASA 705;^[31] and

b. If appropriate, obtain advice from legal counsel.

If, as a result of a misstatement resulting from fraud or suspected fraud, the auditor encounters exceptional circumstances that bring into question the auditor’s ability to continue performing the audit engagement, the auditor shall:

a. Determine the professional and legal responsibilities applicable in the circumstances, including whether there is a requirement for the auditor to report to the person or persons who made the audit appointment or, in some cases, to regulatory authorities;

b. Consider whether it is appropriate to withdraw from the engagement, where withdrawal is possible under applicable law or regulation;

c. If the auditor withdraws:

i. Discuss with the appropriate level of management and those charged with governance the auditor’s withdrawal from the engagement and the reasons for the withdrawal; and

ii. Determine whether there is a professional or legal requirement to report to the person or persons who made the audit appointment or, in some cases, to regulatory authorities, the auditor’s withdrawal from the engagement and the reasons for the withdrawal; and (Ref: Para. A173–A176)

d. Where law or regulation prohibits the auditor from withdrawing from the engagement, consider whether the exceptional circumstances will result in a disclaimer of opinion on the financial report.

Determining Key Audit Matters Related to Fraud

In applying ASA 701,^[32] the auditor shall determine, from the matters related to fraud communicated with those charged with governance, those matters that required significant auditor attention in performing the audit. In making this determination, the auditor shall take into account the following: (Ref: Para. A177–A183)

a. Identified and assessed risks of material misstatement due to fraud;

b. The identification of fraud or suspected fraud; and

c. The identification of significant deficiencies in internal control that are relevant to the prevention and detection of fraud.

In applying ASA 701,^[33] the auditor shall determine which of the matters determined in accordance with paragraph 60 were of most significance in the audit of the financial report of the current period and therefore are key audit matters. (Ref: Para. A184–A186)

Communicating Key Audit Matters Related to Fraud

In applying ASA 701,^[34] in the Key Audit Matters section of the auditor’s report, the auditor shall use an appropriate subheading that clearly describes that the matter relates to fraud. (Ref: Para. A187–A192)

The auditor shall obtain written representations from management and, where appropriate, those charged with governance that: (Ref: Para. A193–A194)

a. They acknowledge their responsibility for the design, implementation, and maintenance of internal control to prevent or detect fraud and have appropriately fulfilled those responsibilities;

b. They have disclosed to the auditor the results of management’s assessment of the risk that the financial report may be materially misstated as a result of fraud;

c. They have disclosed to the auditor their knowledge of any fraud or suspected fraud, including allegations of fraud, affecting the entity involving:

i. Management;

ii. Employees who have significant roles in internal control; or

iii. Others where the fraud could have an effect on the financial report; and

d. They have disclosed to the auditor their knowledge of suspected fraud, including allegations of fraud, affecting the entity’s financial report communicated by employees, former employees, analysts, regulators, or others.

Communication with Management

If the auditor identifies fraud or suspected fraud, the auditor shall communicate these matters, unless prohibited by law or regulation, on a timely basis with the appropriate level of management in order to inform those with primary responsibility for the prevention and detection of fraud of matters relevant to their responsibilities. (Ref: Para. A195–A196)

Communication with Those Charged with Governance

Unless all of those charged with governance are involved in managing the entity, if the auditor identifies fraud or suspected fraud, involving:

a. Management;

b. Employees who have significant roles in internal control; or

c. Others, except for matters that are clearly inconsequential,

the auditor shall communicate these matters with those charged with governance on a timely basis. If the auditor identifies suspected fraud involving management, the auditor shall communicate the suspected fraud with those charged with governance and discuss with them the nature, timing, and extent of audit procedures necessary to complete the audit. Such communications with those charged with governance are required unless the communication is prohibited by law or regulation. (Ref: Para. A195 and A197–A199)

The auditor shall communicate, unless prohibited by law or regulation, with those charged with governance any other matters related to fraud that are, in the auditor’s judgement, relevant to the responsibilities of those charged with governance. (Ref: Para. A195 and A200)

If the auditor identifies fraud or suspected fraud, the auditor shall determine whether law, regulation or relevant ethical requirements: (Ref: Para. A201–A205)

a. Require the auditor to report to an appropriate authority outside the entity.

b. Establish responsibilities or rights under which reporting to an appropriate authority outside the entity may be appropriate in the circumstances.

In applying ASA 230,^[35] the auditor shall include the following in the audit documentation: (Ref: Para. A206) 

a. The matters discussed among the engagement team regarding the susceptibility of the entity’s financial report to material misstatement due to fraud in accordance with paragraph 29. 

b. Key elements of the auditor’s understanding in accordance with paragraphs 31–36, the sources of information from which the auditor’s understanding was obtained and the risk assessment procedures performed.

c. The identified and assessed risks of material misstatement due to fraud at the financial report level and at the assertion level, and the rationale for the significant judgements made.

d. If the auditor has concluded that the presumption that a risk of material misstatement due to fraud related to revenue recognition is not applicable in the circumstances of the engagement, the reasons for that conclusion.

e. The results of audit procedures performed to address the risks of management override of controls, the significant professional judgements made, and the conclusions reached.

f. Fraud or suspected fraud identified, the results of audit procedures performed, the significant professional judgements made, and the conclusions reached.

g. The matters related to fraud or suspected fraud communicated with management, those charged with governance, regulatory and enforcement authorities, and others, including how management, and where applicable, those charged with governance have responded to the matters.

Responsibilities of the Auditor (Ref: Para. 2) 

Considerations Specific to Public Sector Entities

The public sector auditor’s responsibilities relating to fraud may be a result of law, regulation or other authority applicable to public sector entities or separately covered by the auditor’s mandate. Consequently, the public sector auditor’s responsibilities may not be limited to consideration of risks of material misstatement of the financial report but may also include a broader responsibility to consider risks of fraud.

Characteristics of Fraud (Ref: Para. 5)

Fraud, whether fraudulent financial reporting or misappropriation of assets, involves incentive or pressure to commit fraud, a perceived opportunity to do so and some rationalisation of the act.

Fraudulent financial reporting involves intentional misstatements, including omissions of amounts or disclosures in financial report, to deceive financial report users. It can be caused by the efforts of management to manage earnings to deceive financial report users by influencing their perceptions as to the entity’s performance and profitability. Such earnings management may start out with small actions, or adjustment of assumptions, and changes in judgements by management. Pressures and incentives may lead these actions to increase to the extent that they result in material fraudulent financial reporting.

Fraudulent financial reporting may be accomplished by the following: 

• Manipulation, falsification (including forgery), or alteration of accounting records or supporting documentation from which the financial report is prepared. 
• Misrepresentation in, or intentional omission from, the financial report of events, transactions or other significant information. 
• Intentional misapplication of the applicable financial reporting framework relating to amounts, classification, manner of presentation, or disclosure.

Fraudulent financial reporting often involves management override of controls that otherwise may appear to be operating effectively. Fraud can be committed by management overriding controls using such techniques as intentionally: 

• Recording fictitious journal entries to manipulate operating results or achieve other objectives. 
• Inappropriately adjusting assumptions and changing judgements used to estimate account balances. 
• Omitting, advancing or delaying recognition in the financial report of events and transactions that have occurred during the reporting period. 
• Misstating disclosures, including omitting and obscuring disclosures, required by the applicable financial reporting framework, or disclosures that are necessary to achieve fair presentation. 
• Concealing facts that could affect the amounts recorded in the financial report. 
• Engaging in complex transactions that are structured to misrepresent the financial position or financial performance of the entity. 
• Altering records and terms related to transactions. 
• Altering reports that would highlight inappropriate activity or transactions. 
• Taking advantage of inadequate information processing controls in information technology (IT) applications, including controls over and review of IT application event logs (e.g., modifying the application logic, or where users can access a common database using generic access identification, or modify access identification, to conceal activity).

Misappropriation of assets involves the theft of an entity’s assets and is often perpetrated by employees in relatively small and immaterial amounts. However, it can also involve management, who are usually better positioned to disguise or conceal misappropriations in ways that are difficult to detect. In addition, misappropriation of assets can involve third parties who are able to exploit the entity’s assets in order to obtain an unjust or illegal advantage. Misappropriation of assets can be accomplished in a variety of ways and is often accompanied by false or misleading records or documents in order to conceal the fact that the assets are missing or have been pledged without proper authorisation.

Fraud or Suspected Fraud (Ref: Para. 7, 8 and 55–58)

Audit evidence obtained when performing risk assessment procedures and further audit procedures in accordance with this ASA may indicate the existence of fraud or suspected fraud.

Audit procedures performed to comply with other ASAs may also bring instances of fraud or suspected fraud to the auditor’s attention including, for example, those performed in accordance with ASA 600^[36] when responding to assessed risks of material misstatement due to fraud arising from the consolidation process.

The auditor may use automated tools and techniques to perform audit procedures related to identifying and assessing the risks of material misstatement due to fraud or when responding to assessed risks of material misstatement due to fraud. This may allow the auditor to evaluate large amounts of data more easily to, for example, provide deeper insights or identify unusual trends, which enhances the ability of the auditor to exercise professional scepticism and more effectively challenge management’s assertions. The auditor may also use automated tools and techniques to perform audit procedures related to journal entry testing in a more efficient and effective manner. However, the use of automated tools and techniques does not replace the need to maintain professional scepticism and to exercise professional judgement throughout the audit.

For the purpose of this ASA, allegations of fraud by another party involving the entity are treated by the auditor as suspected fraud once the allegations have come to the auditor’s attention (e.g., identified as a result of enquiries made by the auditor of management, or when obtaining an understanding of the entity’s whistleblower program (or other program to report fraud)). The party making the allegations may be internal or external to the entity. Accordingly, the auditor performs audit procedures in accordance with paragraphs 55–58 to address the suspected fraud.

Even when an identified misstatement due to fraud is not quantitatively material, it may be qualitatively material depending on:

a. Who instigated or perpetrated the fraud – an otherwise insignificant fraud perpetrated by senior management, or a public official is ordinarily considered qualitatively material irrespective of the amount involved. This may in turn give rise to concerns about the integrity of management responsible for the entity’s system of internal control.

b. Why the fraud was perpetrated – misstatements that are not material quantitatively, either individually or in the aggregate, may have been made intentionally by management to “manage” key performance indicators in order to, for example, meet market expectations, maximise compensation based on performance, or comply with the terms of debt covenants. In the public sector, misstatements may have been made intentionally by management to achieve a surplus when a deficit is prohibited by legislation or to misreport expenses incurred to avoid breaching statutory limits.

Inherent Limitations (Ref: Para. 10)

The risk of not detecting a material misstatement resulting from fraud exists because fraud may involve sophisticated and carefully organised schemes designed to conceal it, such as forgery, deliberate failure to record transactions, or intentional misrepresentations being made to the auditor. Such attempts at concealment may be even more difficult to detect when accompanied by collusion. Collusion may cause the auditor to believe that audit evidence is persuasive when it is, in fact, false. The auditor’s ability to detect a fraud depends on factors such as the skilfulness of the perpetrator, the frequency and extent of manipulation, the degree of collusion involved, the relative size of individual amounts manipulated, and the seniority of those individuals involved. While the auditor may be able to identify potential opportunities for fraud to be perpetrated, it is difficult for the auditor to determine whether misstatements in areas requiring judgement such as accounting estimates are caused by fraud or error.

Professional Scepticism and Professional Judgement (Ref: Para. 13)

ASQM 1^[37] requires the firm to design, implement and operate a system of quality management for audits of the financial report. The firm’s commitment to an effective system of quality management underpins the requirement for the auditor to exercise professional scepticism when performing the audit engagement. This commitment is recognised and reinforced in the governance and leadership component, including a:

a. Commitment to quality by the leadership of the firm, such as the tone at the top by leadership contributes to the firm’s culture which in turn supports and encourages the auditor to focus on the auditor’s responsibilities relating to fraud in an audit of a financial report.

b. Recognition that the resource needs are planned for, and resources are obtained, allocated, or assigned in a manner that is consistent with the firm’s commitment to quality, such as resources with the appropriate specialised knowledge and skills that may be needed when performing audit procedures related to fraud in an audit of a financial report.

ASQM 1^[38] also explains that the quality of professional judgements exercised by the firm is likely to be enhanced when individuals making such judgements demonstrate an attitude that includes an enquiring mind.

Non-Compliance with Laws and Regulations (Ref: Para. 14)

The identification by the auditor of fraud or suspected fraud affecting the entity that has been perpetrated by a third party (see paragraphs 18(a) and A22) may also give rise to additional responsibilities for the auditor in accordance with ASA 250.

Complying with the requirements of this ASA may also fulfill certain applicable requirements in ASA 250.

Law, regulation, or relevant ethical requirements may require the auditor to perform additional procedures and take further actions. For example, the Accounting Professional & Ethical Standards Board’s APES 110 Code of Ethics for Professional Accountants (including Independence Standards) (the Code) requires the auditor to take steps to respond to identified or suspected non-compliance with laws and regulations.^[39]

(Ref: Para. 15)

Appendix 5 identifies other ASAs that address specific topics that reference fraud or suspected fraud.

(Ref: Para. 18)

Relationship of Fraud with Corruption, Bribery and Money Laundering (Ref: Para. 18(a))

Depending on the nature and circumstances of the entity, certain laws, regulations or aspects of relevant ethical requirements dealing with corruption, bribery or money laundering may be relevant to the auditor’s responsibilities to consider laws and regulations in an audit of a financial report in accordance with ASA 250.^[40]

Corruption, bribery and money laundering are forms of illegal or unethical acts. Corruption, bribery, and money laundering may be distinct concepts in law or regulation; however, they may also be fraudulent acts, or may be carried out to facilitate or conceal fraud.

While the auditor may identify or suspect corruption, bribery, or money laundering, as with fraud, the auditor does not make legal determinations on whether such acts have actually occurred.

Third-Party Fraud (Ref: Para. 18(a))

Fraud or suspected fraud committed against the entity by parties external to the entity is generally described as third-party fraud. Fraud as defined in paragraph 18(a) can include an intentional act by a third party and, accordingly, if an intentional act by a third party is identified or suspected that may have resulted in misappropriation of the entity’s assets or fraudulent financial reporting by the entity, the auditor performs audit procedures in paragraphs 55–58.

Parties external to the entity that may commit third-party fraud may include:

• Related parties, where potential opportunities for collusion with management, overly complex transactions, or bias in the structure of transactions may exist, as explained in ASA 550^[41].
• Third parties with which the entity has a relationship to support their business model such as customers, suppliers, service providers or other external parties known to the entity. These relationships may introduce the risk of collusion with employees or others in the entity to, for example, create fictitious transactions to manipulate financial results.
• Third parties unknown to the entity that may, for example, attempt to gain unauthorised access to an entity’s IT environment that affects financial reporting or assets, or disrupts the entity’s business operations or financial reporting processes.

Fraud Risk Factors (Ref: Para. 18(b) and 38)

The presence of fraud risk factors may affect the auditor’s assessment of inherent risk or control risk. Fraud risk factors may:

• Be inherent risk factors, insofar as they affect inherent risk, and may be due to management bias. They may also arise from other identified inherent risk factors (e.g., complexity or uncertainty may create opportunities that result in a susceptibility to misstatement due to fraud). When fraud risk factors are inherent risk factors, the inherent risk is assessed before consideration of controls.
• Relate to events or conditions that may exist in the entity’s system of internal control that provide an opportunity to commit fraud and are relevant to the consideration of the entity’s controls (i.e., related to control risk), and may be an indicator that other fraud risk factors are present.

While fraud risk factors may not necessarily indicate the existence of fraud, they have often been present in circumstances where frauds have occurred and therefore may indicate risks of material misstatement due to fraud.

Examples of fraud risk factors related to fraudulent financial reporting and misappropriation of assets are presented in Appendix 1. These illustrative fraud risk factors are classified based on the three conditions that are, individually or in combination, generally present when fraud exists:

• An incentive or pressure to commit fraud;
• A perceived opportunity to commit fraud; and
• An attitude or rationalisation that justifies the fraudulent action.

Fraud risk factors reflective of an attitude that permits rationalisation of the fraudulent action may not be susceptible to observation by the auditor. Nevertheless, the auditor may become aware of the existence of such information through, for example, the required understanding of the entity’s control environment.^[42] Although the fraud risk factors described in Appendix 1 cover a broad range of situations that may be faced by auditors, they are only examples and other fraud risk factors may exist.

(Ref: Para. 7, 19–22 and 55–58)

Maintaining professional scepticism throughout the audit involves an ongoing questioning of whether the information and audit evidence obtained suggests that a material misstatement due to fraud may exist. It includes considering the reliability of the information intended to be used as audit evidence and identified controls in the control activities component, if any, over its preparation and maintenance. Due to the characteristics of fraud, the auditor’s professional scepticism is particularly important when considering the risks of material misstatement due to fraud.

The manner in which circumstances that may be indicative of fraud or suspected fraud that affects the entity come to the auditor’s attention throughout the audit may vary.

Remaining alert for circumstances that may be indicative of fraud or suspected fraud throughout the audit is important, including when performing audit procedures near the end of the audit when time pressures to complete the audit engagement may exist. For example, audit evidence may be obtained near the end of the audit that may call into question the reliability of other audit evidence obtained or cast doubt on the integrity of management or those charged with governance. Appendix 3 contains examples of circumstances that may be indicative of fraud or suspected fraud.

As explained in ASA 220,^[43] conditions inherent in some audit engagements can create pressures on the engagement team that may impede the appropriate exercise of professional scepticism when designing and performing audit procedures and evaluating audit evidence. Paragraphs A35–A37 of ASA 220 list examples of impediments to the exercise of professional scepticism at the engagement level, unconscious or conscious biases that may affect the engagement team’s professional judgements, and actions that may be taken to mitigate impediments to the exercise of professional scepticism.

Circumstances may also be encountered which may create threats to compliance with relevant ethical requirements. ASA 220^[44] discusses that relevant ethical requirements, for example the Code, may contain provisions regarding the identification and evaluation of threats and how they are to be dealt with.^[45]

The auditor may also address the threat to compliance with relevant ethical requirements, such as the principle of integrity, by communicating on a timely basis with those charged with governance about the circumstances giving rise to the threat. This communication may include a discussion about any inconsistencies in audit evidence obtained for which a satisfactory explanation has not been provided by management.

Inconsistent Responses

Inconsistent responses to enquiries may include inconsistencies both between the different groups of individuals specified in paragraph 21 (i.e., management, those charged with governance, individuals within the internal audit function, or others within the entity) and among individuals within the same group. For example, the auditor may identify inconsistent responses among different individuals within management.

Conditions That Cause the Auditor to Believe That a Record or Document May Not Be Authentic or That the Terms in a Document Have Been Modified

ASA 500^[46] requires the auditor to consider the reliability of information intended to be used as audit evidence when designing and performing audit procedures. The reliability of information intended to be used as audit evidence deals with the degree to which the auditor may depend on such information. Authenticity is an attribute of the reliability of information that the auditor may consider. In doing so, the auditor may consider whether the source actually generated or provided the information, and was authorised to do so, and the information has not been inappropriately altered.

Audit procedures performed in accordance with ASA 500, this or other ASAs, or information from other sources, may bring to the auditor’s attention conditions that cause the auditor to believe that a record or document may not be authentic or that terms in a document have been modified but not disclosed to the auditor. The auditor is not, however, required to perform procedures that are specifically designed to identify conditions that indicate that a record or document may not be authentic or that terms in a document have been modified. Paragraph 22 applies if the auditor identifies such conditions during the course of the audit.

When conditions are identified that cause the auditor to believe that a record or document may not be authentic or that terms in a document have been modified but not disclosed to the auditor, possible additional audit procedures to investigate further may include:

• Enquiries of management or others within the entity.
• Confirming directly with the third party.
• Using the work of an expert to evaluate the document’s authenticity.
• Using automated tools and techniques, such as document authenticity or integrity technology, to evaluate the authenticity of the record or document.

When the results of the additional audit procedures indicate that a record or document is not authentic or that the terms in a document have been modified, the auditor may determine that the circumstances are indicative of fraud or suspected fraud and, accordingly, performs audit procedures in accordance with paragraphs 55–58.

(Ref: Para. 23)

ASA 220^[47] explains that the engagement partner’s determination of whether additional engagement level resources are required to be assigned to the engagement team is a matter of professional judgement and is influenced by the nature and circumstances of the audit engagement, taking into account any changes that may have arisen during the engagement.

The nature, timing, and extent of the involvement of individuals with specialised skills or knowledge, such as forensic and other experts when determined to be necessary or the involvement of more experienced individuals, may vary based on the nature and circumstances of the audit engagement.

Forensic skills, in the context of an audit of a financial report, may combine accounting, auditing and investigative skills. Such skills may be applied in an investigation and evaluation of an entity’s accounting records to obtain possible evidence of fraudulent financial reporting or misappropriation of assets, or in performing audit procedures. The use of forensic skills may also assist the auditor in evaluating whether there is management override of controls or intentional management bias in financial reporting.

In determining whether the engagement team has the appropriate competence and capabilities, the engagement partner may consider matters such as expertise in IT systems or IT applications used by the entity or automated tools or techniques that are to be used by the engagement team in planning and performing the audit (e.g., when testing a high volume of journal entries and other adjustments when responding to the risks related to management override of controls).

In determining whether the members of the engagement team collectively have the appropriate competence and capabilities to respond to identified risks of material misstatement due to fraud, the engagement partner may consider, for example:

• Assigning additional individuals with specialised skills or knowledge, such as forensic and other experts;
• Changing the composition of the engagement team to include more experienced individuals; or
• Assigning more experienced members of the engagement team to conduct certain audit procedures for those specific audit areas that require significant auditor attention, including to make enquiries of management and, when appropriate in the circumstances, those charged with governance related to those specific audit areas.

(Ref: Para. 24 and 29)

Depending on the nature and circumstances of the audit engagement, the engagement partner’s approach to direction, supervision and review may include increasing the extent and frequency of the engagement team discussions. It may be beneficial to hold additional engagement team discussions based on the occurrence of events or conditions that have impacted the entity, which may identify new, or provide additional information about existing, fraud risk factors (see Appendix 1 for examples of fraud risk factors).

(Ref: Para. 25)

Robust two-way communication between management or those charged with governance and the auditor assists in identifying and assessing the risks of material misstatement due to fraud.

The extent of the auditor’s communications with management and those charged with governance depends on the fraud-related facts and circumstances of the entity, as well as the progress and outcome of the fraud-related audit procedures performed in the audit engagement.

The appropriate timing of the communications may vary depending on the significance and nature of the fraud-related matters and the expected action(s) to be taken by management or those charged with governance.

Assigning Appropriate Member(s) within the Engagement Team with the Responsibility to Communicate with Management and Those Charged with Governance

ASA 220^[49] deals with the engagement partner’s overall responsibility with respect to engagement resources and engagement performance. Due to the nature and sensitivity of fraud, particularly those involving senior management, assigning tasks or actions to appropriately skilled or suitably experienced members of the engagement team and providing appropriate levels of direction, supervision, and review of their work is also important for the required communications in accordance with this ASA. This includes involving appropriately skilled or suitably experienced members of the engagement team when communicating matters related to fraud with management and those charged with governance.

ASA 220^[50] deals with the engagement partner’s responsibility to make members of the engagement team aware of the relevant ethical requirements. For example, the Code requires compliance with the principle of integrity, which involves standing one’s ground when confronted by dilemmas and difficult situations; or challenging others as and when circumstances warrant in a manner appropriate to the circumstances. It is important, especially for those members of the engagement team who will be engaging with management and those charged with governance about matters related to fraud, to consider the content of the communications and the manner in which such communications are to be conducted.

(Ref: Para. 26)

As explained in ASA 315,^[51] obtaining an understanding of the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control is a dynamic and iterative process of gathering, updating and analysing information and continues throughout the audit. Therefore, the auditor’s expectations with respect to risks of material misstatements due to fraud may change as new information is obtained.

Information from Other Sources (Ref: Para. 27)

Information obtained from other sources in accordance with paragraphs 15–16 of ASA 315 may be relevant to the identification of fraud risk factors by providing information and insights about:

• The entity and the industry in which the entity operates and its related business risks, which may create pressures on the organisation to meet targeted financial results.
• Management’s commitment to integrity and ethical values.
• Management’s commitment to remedy known significant deficiencies in internal control on a timely basis.
• Complexity in the application of the applicable financial reporting framework due to the nature and circumstances of the entity that may create opportunities for management to perpetrate and conceal fraudulent financial activity.

In conducting an initial audit engagement in accordance with ASA 510,^[52] in some circumstances, subject to law, regulation or relevant ethical requirements, the proposed successor auditor may request the predecessor auditor to provide information regarding identified or suspected fraud. Such information may give an indication of the presence of fraud risk factors or may give an indication of fraud or suspected fraud.

Retrospective Review of the Outcome of Previous Accounting Estimates (Ref: Para. 28)

The purpose of performing a retrospective review of management’s judgements and assumptions related to accounting estimates reflected in the financial report of a previous period is to evaluate whether there is an indication of a possible bias on the part of management. It is not intended to call into question the auditor’s judgements about previous period accounting estimates that were appropriate based on information available at the time they were made.

Engagement Team Discussion (Ref: Para. 29)

As explained in ASA 220,^[53] the engagement partner is responsible for creating an environment that emphasises the importance of open and robust communication within the engagement team. The engagement team discussion enables the engagement team members to share insights in a timely manner based on their skills, knowledge and experience about how and where the financial report may be susceptible to material misstatement due to fraud.

Individuals who have specialised skills or knowledge, such as forensic and other experts, may be invited to attend the engagement team discussion to provide deeper insights about the susceptibility of the entity’s financial report to material misstatement due to fraud. The involvement and contributions of individuals with specialised skills or knowledge may elevate the quality of the discussion taking place.

The exchange of ideas may serve to inform the auditor’s initial perspective about the tone at the top. The conversation may include a discussion about the actions and behaviours of management and those charged with governance, including whether there are clear and consistent actions and communications about integrity and ethical behaviour at all levels within the entity.

The following approaches may be useful to facilitate the exchange of ideas:

• ‘What-if’ scenarios – these may be helpful when discussing whether certain events or conditions create an environment at the entity where one or more individuals among management, those charged with governance, or employees have the incentive or pressure to commit fraud, a perceived opportunity to do so and some rationalisation of the act, and if so, how the fraud may occur.
• Automated tools and techniques – these may be used to support the discussion about the susceptibility of the entity’s financial report to material misstatement due to fraud. For example, automated tools and techniques may be used to support the identification of fraud risk factors, including techniques that further the understanding of incentives and pressures, such as industry or sector financial ratio benchmarking. Unusual relationships within the entity’s current period data (e.g., financial and operating data) may indicate adverse ratios or trends compared to competitors or the entity’s past performance.

The exchange of ideas may include, among other matters, whether:

• The interactions, as observed by the engagement team, among management (e.g., between the chief executive officer and the chief financial officer) or between management and those charged with governance may indicate a lack of cooperation or mutual respect among the parties. This circumstance in turn may be indicative of an environment that is conducive to the existence of fraud.
• Any unusual or unexplained changes in behaviour or lifestyle of management or employees that have come to the attention of the engagement team may indicate the possibility of fraudulent activity.
• Known information (e.g., obtained through reading trade journals, or accessing reports issued by regulatory bodies), about frauds impacting other entities that resulted in the misstatement of the financial report of those entities, such as entities in the same industry or geographical region, may be indicative of risks of material misstatement due to fraud for the entity being audited.
• Disclosures, or lack thereof, may be used by management to obscure a proper understanding of the entity’s financial report (e.g., by including too much immaterial information, by using unclear or ambiguous language, or by a lack of disclosures such as those disclosures relating to off-balance sheet financing arrangements or leasing arrangements).
• Events or conditions exist that may cast significant doubt on the entity’s ability to continue as a going concern (e.g., a drug patent of an entity in the pharmaceutical industry expired leading to a decline in revenue). In such circumstances, there may be incentives or pressures for management to commit fraud in order to conceal a material uncertainty about the entity’s ability to continue as a going concern.
• The entity has significant related party relationships and transactions (e.g., the entity has a complex organisational structure that includes several special-purpose entities controlled by management). These circumstances may provide the opportunity for management to perpetrate fraud; for example, by inflating earnings, or concealing debt.
• The entity has other third-party relationships that give rise to a fraud risk factor, or a risk of third-party fraud.

The engagement team may consider other ways in which management may override controls beyond the use of journal entries and other adjustments, significant estimates or transactions outside the normal course of business.

The engagement partner and other key engagement team members participating in the engagement team discussion may also, as applicable, use this as an opportunity to:

• Emphasise the importance of maintaining a questioning mind throughout the audit regarding the potential for material misstatement due to fraud.
• Remind engagement team members of their role in serving the public interest by performing quality audit engagements and the importance of engagement team members remaining objective in order to better facilitate the critical assessment of audit evidence obtained from persons within or outside the financial reporting or accounting functions, or outside the entity.
• Consider the audit procedures that may be selected to respond appropriately to the susceptibility of the entity’s financial report to material misstatement due to fraud, including whether certain types of audit procedures may be more effective than others and how to incorporate an element of unpredictability into the nature, timing and extent of audit procedures to be performed. Appendix 2 contains examples of procedures that incorporate an element of unpredictability.

Analytical Procedures Performed and Unusual or Unexpected Relationships Identified (Ref: Para. 30)

The auditor may identify fluctuations or relationships when performing analytical procedures in accordance with ASA 315^[54] that are inconsistent with other relevant information or that differ from expected values significantly.

The Entity and Its Environment (Ref: Para. 31)

The Entity’s Organisational Structure and Ownership, Governance, Objectives and Strategy, and Geographic Dispersion

Understanding the entity’s organisational structure and ownership assists the auditor in identifying fraud risk factors. An overly complex organisational structure involving unusual legal entities or unnecessarily complex or unusual organisational structures compared to other entities in the same industry may indicate that a fraud risk factor is present.

Understanding the nature of the entity’s governance arrangements assists the auditor in identifying fraud risk factors. For example, poor governance or accountability arrangements may weaken oversight and increase the opportunity for fraud (see also paragraphs A71–A82). However, some entities may have assigned the responsibility for overseeing the processes for identifying and responding to fraud in the entity to a senior member of management or to someone with designated responsibility.

Understanding the entity’s objectives and strategy assists the auditor in identifying fraud risk factors. Objectives and strategy impact expectations, internally and externally, and may create pressures on the entity to achieve financial performance targets.

Understanding the entity’s geographic dispersion assists the auditor in identifying fraud risk factors. The entity may have operations in locations that may be susceptible to fraud, or other illegal or unethical acts that may be carried out to facilitate or conceal fraud. The auditor may obtain information about these locations from a variety of internal and external sources, including searches of relevant databases.

Industry and Regulatory Environment

Understanding the industry and the regulatory environment in which the entity operates assists the auditor in identifying fraud risk factors. The entity may operate in an industry that may be susceptible to fraud, or other illegal or unethical acts that may be carried out to facilitate or conceal fraud. The auditor may obtain an understanding about whether the entity operates in:

• An industry where there are greater opportunities to commit fraud (e.g., in the construction industry the revenue recognition policies may be complex and subject to significant judgement which may create an opportunity to commit fraud).
• An industry that is under pressure (e.g., a high degree of competition or market saturation, accompanied by declining margins in that sector). Such characteristics may create an incentive to commit fraud as it may be harder to achieve the financial performance targets.
• An industry that is susceptible to acts of money laundering (e.g., the banking, or gaming and gambling industries may be particularly vulnerable to money laundering, which could facilitate fraud).
• A regulatory environment that may create incentives or pressures to commit fraud (e.g., government aid programs may include thresholds to be met to obtain the aid).

Performance Measures Used, Whether Internal or External

Performance measures, whether internal or external, may create pressures on the entity. These pressures, in turn, may motivate management or employees to take action to inappropriately improve the business performance or to misstate the financial report. Internal performance measures may include employee performance measures and incentive compensation policies. External performance measures may include expectations from shareholders, analysts, or other users.

The auditor may consider listening to the entity’s earnings calls with analysts or reading analysts’ research reports. This may provide the auditor with information about whether analysts have aggressive or unrealistic expectations about an entity’s financial performance. Auditors may also learn about management’s attitudes regarding those expectations based on how management interacts with analysts. Aggressive expectations by analysts that are met by commitments by management to meet those expectations may be indicative of pressures and rationalisations for management to manipulate key performance metrics.

Other matters that the auditor may consider include:

• Management’s compensation packages. When a significant portion of management’s compensation packages are contingent on achieving financial targets, management may have an incentive to manipulate financial results.
• Negative media attention, short-selling reports, or negative analyst reports. When management is under pressure or intense scrutiny to respond to these matters, management may have an incentive to manipulate financial results.

Considerations specific to public sector entities

In the case of a public sector entity, legislators and regulators are often the primary users of its financial report and may therefore have expectations in relation to external performance measures. The auditor may also consider the nature and extent of external scrutiny from other parties or citizens as management of the public sector entity may have an incentive to manipulate financial results when they are under pressure or intense scrutiny.

Understanding the Applicable Financial Reporting Framework and the Entity’s Accounting Policies (Ref: Para. 31)

Matters related to the applicable financial reporting framework that the auditor may consider when obtaining an understanding of where there may be an increased susceptibility to misstatement due to management bias or other fraud risk factors, include:

• Areas in the applicable financial reporting framework that require:
  • A measurement basis that results in the need for a complex method relating to an accounting estimate.
  • Management to make significant judgements, such as accounting estimates with high estimation uncertainty or where an accounting treatment has not yet been established for new and emerging financial products (e.g., types of digital assets).
  • Expertise in a field other than accounting, such as actuarial calculations, valuations, or engineering data. Particularly where management can influence, and direct work performed, and conclusions reached by management’s experts.
• Changes in the applicable financial reporting framework. For example, management may intentionally misapply new accounting requirements relating to amounts, classification, manner of presentation, or disclosures.
• The selection of and application of accounting policies by management. For example, management’s choice of accounting policy is not consistent with similar entities in the same industry.
• The amount of an accounting estimate selected by management for recognition or disclosure in the financial report.

Understanding the Components of the Entity’s System of Internal Control 

Control Environment 

Entity’s culture and management’s commitment to integrity and ethical values (Ref: Para. 32(a)(i))

Understanding aspects of the entity’s control environment that address the entity’s culture and understanding management’s commitment to integrity and ethical values assists the auditor in determining management’s attitude and tone at the top with regards to the prevention and detection of fraud.

In considering the extent to which management demonstrates a commitment to ethical behaviour, the auditor may obtain an understanding through enquiries of management and employees, and through considering information from external sources, about:

• Management’s commitment to integrity and ethical values through their actions. This is important as employees may be more likely to behave ethically when management is committed to integrity and ethical behaviours.
• The entity’s communications with respect to integrity and ethical values. For example, the entity may have a mission statement, a code of ethics, or a fraud policy that sets out the expectations of entity personnel in respect to their commitment to integrity and ethical values regarding managing fraud risk. In larger or more complex entities, management may also have set up a process that requires employees to annually confirm that they have complied with the entity’s code of ethics.
• Whether the entity has developed fraud awareness training. For example, the entity may require employees to undertake ethics and code of conduct training as part of an ongoing or induction program. In a larger or more complex entity, specific training may be required for those with a role in the prevention and detection of fraud (e.g., the internal audit function).
• Management’s response to fraudulent activity. For example, where minor unethical practices are overlooked (e.g., petty theft, expenses frauds), this may indicate that more significant frauds committed by key employees may be treated in a similar lenient fashion.

The entity’s whistleblower program (or other program to report fraud) (Ref: Para. 32(a)(ii))

Often frauds are discovered through tips or complaints submitted through an entity’s whistleblower program. Whistleblower programs, which some entities may refer to by other names including, for example fraud reporting hotline, are designed to gather, among other things, information from employees, customers, and other stakeholders about allegations of fraud impacting the entity. A whistleblower program is often an essential component of an entity’s fraud risk management.

The design of a whistleblower program will vary depending on the nature and complexity of the entity, including the entity’s exposure to fraud risks. For example, more formalised whistleblower programs may include a dedicated email, website or telephone reporting mechanism, formal training for all employees, periodic reporting to management and those charged with governance for matters reported through the program, or management of the program by a third party. Alternatively, whistleblower programs may consist of less formal processes, which may include verbal communication of the program or communication via the entity’s website where tips or complaints can be received, along with monitoring performed by the entity’s human resource personnel or by an independent party, such as external counsel.

When obtaining an understanding of the entity’s whistleblower program, the auditor may:

• Obtain an understanding of how the entity receives tips or complaints, the objectivity and competence of the individuals involved in administering the program, the appropriateness of the entity’s processes for addressing the matters raised, including its investigation and remediation processes and protections afforded to whistleblowers. In a larger or more complex entity, the lack of a whistleblower program, or an ineffective one, may be indicative of deficiencies in the entity’s control environment.
• Inspect the whistleblower program files for any tips or complaints that may allege fraud that are not under investigation by the entity, or for information that may raise questions about management’s commitment to creating and maintaining a culture of honesty and ethical behaviour.
• Perform additional procedures related to allegations of fraud that are under investigation by the entity in accordance with the requirements in paragraphs 55-58.

Oversight exercised by those charged with governance (Ref: Para. 32(a)(iii))

In many jurisdictions, corporate governance practices are well developed and those charged with governance play an active role in oversight of the entity’s assessment of risks, including risks of fraud and the controls that address such risks. Since the responsibilities of those charged with governance and management may vary by entity and by jurisdiction, it is important that the auditor understands their respective responsibilities to enable the auditor to obtain an understanding of the oversight exercised by the appropriate individuals with respect to the prevention and detection of fraud.^[55]

An understanding of the oversight exercised by those charged with governance may provide insights regarding the susceptibility of the entity to management fraud, the adequacy of controls that prevent or detect fraud, and the competency and integrity of management. The auditor may obtain this understanding in several ways, such as by attending meetings where such discussions take place, reading the minutes from such meetings, or making enquiries of those charged with governance.

The effectiveness of oversight by those charged with governance is influenced by their objectivity and familiarity with the processes and controls management has put in place to prevent or detect fraud. For example, the oversight by those charged with governance of the effectiveness of controls to prevent or detect fraud is an important aspect of their oversight role and the objectivity of such evaluation is influenced by their independence from management.

Scalability (Ref: Para. 32(a)(iii))

In some cases, all of those charged with governance are involved in managing the entity. This may be the case in a smaller or less complex entity where a single owner manages the entity and no one else has a governance role. In these cases, there is ordinarily no action on the part of the auditor because there is no oversight separate from management.

Enquiries of those charged with governance (Ref: Para. 32(c))

The auditor may also enquire of those charged with governance about how the entity assesses the risk of fraud, and the entity’s controls to prevent or detect fraud, the entity’s culture and management’s commitment to integrity and ethical values.

Specific enquiries on areas that are susceptible to misstatement due to management bias or management fraud may relate to both inherent risk and control risk. Specific enquiries may include management judgement when accounting for complex accounting estimates or unusual or complex transactions, including those in controversial or emerging areas, which may be susceptible to fraudulent financial reporting.

Enquiries on whether those charged with governance are aware of any control deficiencies related to the prevention and detection of fraud may inform the auditor’s evaluation of the components of the entity’s system of internal control. Such enquiries may highlight conditions within the entity’s system of internal control that provide opportunity to commit fraud or that may affect management’s attitude or ability to rationalise fraudulent actions. For example, understanding incentives or pressures on management that may result in intentional or unintentional management bias may inform the auditor’s understanding of the entity’s risk assessment process and understanding of business risks. Such information may affect the auditor’s consideration of the effect on the reasonableness of significant assumptions made by, or the expectations of, management.

The Entity’s Risk Assessment Process 

The entity’s process for identifying, assessing, and addressing fraud risks (Ref: Para. 33(a))

Management may place a strong emphasis on fraud prevention by implementing a fraud risk management program. The design of the fraud risk management program may be impacted by the nature and complexity of the entity and may include the following elements:

• Establishing fraud risk governance policies.
• Performing a fraud risk assessment.
• Designing and deploying fraud preventive and detective control activities.
• Conducting investigations.
• Monitoring and evaluating the total fraud risk management program.

Identifying fraud risks (Ref: Para. 33(a)(i))

The entity’s risk assessment process may include an assessment of the incentives, pressures, and opportunities to commit fraud, or how the entity may be susceptible to third-party fraud. An entity’s risk assessment process may also consider the potential override of controls by management as well as areas where there are control deficiencies, including a lack of segregation of duties.

Where legal or regulatory requirements apply, management may consider risks relating to misappropriation of assets or fraudulent financial reporting in relation to the entity’s compliance with laws or regulations. For example, a fraud risk may include the preparation of inaccurate information for a regulatory filing in order to improve the appearance of an entity’s performance and thereby avoid inspection by regulatory authorities or penalties.

Considerations specific to public sector entities

In the public sector, management may need to consider risks related to political pressures to achieve specific outcomes, and pressures to meet or stay within the approved budget, including expenditures subject to statutory limits.

Assessing the significance of the identified fraud risks and addressing the assessed fraud risks (Ref: Para. 33(a)(ii)–(iii))

There are several approaches management may use to assess fraud risks, and the approach may vary depending on the nature and circumstances of the entity. The entity may assess fraud risks using different forms, such as a complex matrix of risk ratings or a simple narrative.

When determining the likelihood of fraud, management may consider both probability and frequency (i.e., the number of fraud incidents that can be expected). Other factors that management may consider in determining the likelihood may include the volume of transactions or the quantitative benefit to the perpetrator.

Management may address the likelihood of a fraud risk by taking action within the other components of the entity’s system of internal control or by making changes to certain aspects of the entity or its environment. To address fraud risks, an entity may choose to cease doing business in certain locations, reallocate authority among key personnel, or make changes to aspects of the entity’s business model.

If the auditor identifies risks of material misstatement due to fraud that management failed to identify, the auditor is required to determine whether any such risks are of a kind that the auditor expects would have been identified by the entity’s risk assessment process and, if so, obtain an understanding of why the entity’s risk assessment process failed to identify such risks of material misstatement.^[56]

Scalability (Ref: Para. 33(a))

In smaller and less complex entities, and in particular owner-managed entities, the way the entity’s risk assessment process is designed, implemented, and maintained may vary with the entity’s size and complexity. When there are no formalised processes or documented policies or procedures, the auditor is still required to obtain an understanding of how management, or where appropriate, those charged with governance identify fraud risks related to the misappropriation of assets and fraudulent financial reporting, assesses the significance of the identified fraud risks and addresses the assessed risks.

Enquiries of management and others within the entity (Ref: Para. 33(b))

Management accepts responsibility for the entity’s system of internal control and for the preparation of the entity’s financial report. Accordingly, it is appropriate for the auditor to make enquiries of management regarding management’s own process for identifying and responding to the entity’s fraud risks. The nature, extent and frequency of management’s risk assessment process may vary from entity to entity. In some entities, management’s process may occur on an annual basis or as part of ongoing monitoring. In other entities, management’s process may be less structured and less frequent. The nature, extent and frequency of management’s risk assessment process is relevant to the auditor’s understanding of the entity’s control environment. For example, the fact that management does not have a risk assessment process or when the entity’s risk assessment process does not address the identified fraud risks may be indicative of the lack of importance that management places on internal control.

Enquiries of management may provide useful information concerning the risks of material misstatements resulting from employee fraud. However, such enquiries are unlikely to provide useful information regarding the risks of material misstatement resulting from management fraud. Enquiries of others within the entity may provide additional insight into fraud prevention controls, tone at the top, and culture of the organisation. The responses from these enquiries may also serve to corroborate responses received from management or provide information regarding the possibility of management override of controls.

Management is often in the best position to perpetrate fraud. Accordingly, when evaluating management’s responses to enquiries with an attitude of professional scepticism, the auditor may judge it necessary to corroborate responses to enquiries with information from other sources.

Enquiries of management and others within the entity may be most effective when they involve a discussion and when conducted by senior members of the engagement team. This allows for a two- way dialogue with the interviewees and provides the opportunity for the auditor to ask probing and clarifying questions.

The Entity’s Process to Monitor the System of Internal Control 

Ongoing and separate evaluations for monitoring the effectiveness of controls to prevent or detect fraud (Ref: Para. 34(a))

Matters that may be relevant for the auditor to consider when understanding those aspects of the entity’s process that addresses the ongoing and separate evaluations for monitoring the effectiveness of controls to prevent or detect fraud, and the identification and remediation of related control deficiencies may include:

• Whether management has identified particular operating locations, or business segments for which the risk of fraud may be more likely to exist and whether management has introduced different approaches to monitor these operating locations or business segments.
• How the entity monitors controls that address fraud risks in each component of the entity’s system of internal control, including the operating effectiveness of anti-fraud controls, and the remediation of control deficiencies as necessary.

Enquiries of internal audit (Ref: Para. 34(b))

The internal audit function of an entity may perform assurance and advisory activities designed to evaluate and improve the effectiveness of the entity’s governance, risk management and internal control processes. In that capacity, the internal audit function may identify frauds or be involved throughout a fraud investigation process. Enquiries of appropriate individuals within the internal audit function may therefore provide the auditor with useful information about instances of fraud, suspected fraud, or allegations of fraud, and the risk of fraud.

ASA 315 and ASA 610 establish requirements and provide guidance relevant to audits of those entities that have an internal audit function.^[57]

The Information System and Communication (Ref: Para. 35 and 49)

Obtaining an understanding of the entity’s information system and communication relevant to the preparation of the financial report includes the manner in which an entity incorporates information from transaction processing into the general ledger. This ordinarily involves the use of journal entries, whether standard or non-standard, or automated or manual. This understanding enables the auditor to identify the population of journal entries and other adjustments that is required to be tested in accordance with paragraph 49(b). Obtaining an understanding of the population may provide the auditor with insights about journal entries and other adjustments that may be susceptible to unauthorised or inappropriate intervention or manipulation. This may assist the auditor in designing and performing audit procedures over journal entries and other adjustments in accordance with paragraphs 49(c) and 49(d).

Appendix 4 includes additional considerations when selecting journal entries and other adjustments for testing, including matters that the required understanding provides the auditor knowledge about.

When performing risk assessment procedures, the auditor may consider changes in the entity’s IT environment because of the introduction of new IT applications or enhancements to the IT infrastructure, which may impact the susceptibility of the entity to fraud or create vulnerabilities in the IT environment (e.g., changes to the databases involved in processing or storing transactions). There may also be an increased susceptibility to misstatement due to management bias or other fraud risk factors when there are complex IT applications used to initiate or process transactions or information, such as the use of artificial intelligence or machine learning algorithms to calculate and initiate accounting entries. In such circumstances, the auditor may assign individuals with specialised skills and knowledge, such as forensic and IT experts, or more experienced individuals to the engagement.

Control Activities (Ref: Para. 33 and 36)

Management may make judgements on the nature and extent of the controls it chooses to implement and the nature and extent of the risks it chooses to accept given the nature and circumstances of the entity. In determining which controls to implement to prevent or detect fraud, management considers the risks that the financial report may be materially misstated due to fraud.

Controls designed to prevent or detect fraud are generally classified as either preventive (designed to prevent a fraudulent event or transaction from occurring) or detective (designed to discover a fraudulent event or transaction after the fraud has occurred). Addressing fraud risks may involve a combination of manual and automated fraud prevention and detection controls that enable the entity to monitor for indicators of fraud within the scope of its risk tolerance.

ASA 315^[58] requires the auditor to obtain an understanding of controls over journal entries as well as to evaluate their design and determine whether they have been implemented as part of understanding the entity’s system of internal control. This understanding focuses on the controls over journal entries that address risks of material misstatement at the assertion level, whether due to fraud or error. Paragraphs 48–49 of this ASA require the auditor to design and perform audit procedures to test the appropriateness of journal entries and are specifically focused on the risks of material misstatement due to fraud (see Appendix 4 for additional considerations when testing journal entries).

Information from understanding controls over journal entries, designed to prevent or detect fraud, or the absence of such controls, may also be useful in identifying fraud risk factors that may affect the auditor’s assessment of the risks of material misstatement due to fraud.

The following are examples of general IT controls that may address the risks arising from the use of IT and may also be relevant to the prevention or detection of fraud.

Scalability

For some entities whose nature and circumstances are more complex, such as those operating in the insurance or banking industries, there may be more complex preventative and detective controls in place. These controls may also affect the extent to which specialised skills are needed to assist the auditor in obtaining an understanding of the entity’s risk assessment process.

Control Deficiencies Within the Entity’s System of Internal Control (Ref: Para. 37)

In performing the evaluations of each of the components of the entity’s system of internal control, the auditor may determine that certain of the entity’s policies in a component are not appropriate to the nature and circumstances of the entity. Such a determination may be an indicator, which assists the auditor in identifying deficiencies in internal control that are relevant to the prevention and detection of fraud. If the auditor has identified one or more control deficiencies relevant to the prevention or detection of fraud, the auditor may consider the effect of those control deficiencies on the design of further audit procedures in accordance with ASA 330.

Paragraph 60(c) of this ASA and ASA 265^[59] establish other requirements on identified deficiencies in internal control.

(Ref: Para. 38)

The significance of fraud risk factors varies widely. Some of these factors will be present in entities where the specific conditions do not present risks of material misstatement. Accordingly, the determination as to whether fraud risk factors, individually or in combination, indicate that there are risks of material misstatement due to fraud is a matter of professional judgement.

The size, complexity, and ownership characteristics of the entity have a significant influence on the consideration of fraud risk factors. For example, depending on the nature and circumstances of the entity, there may be factors that generally constrain improper conduct by management, such as:

• Effective oversight by those charged with governance.
• An effective internal audit function.
• The existence and enforcement of a written code of conduct.
• The existence of an effective whistleblower program (or other program to report fraud).

Furthermore, fraud risk factors considered at a business segment operating level may provide different insights when compared with those obtained when considered at an entity-wide level.

Scalability

In the case of a smaller or less complex entity, some or all of these considerations may not be applicable or less relevant. For example, a smaller or less complex entity may not have a written code of conduct but, instead, may have developed a culture that emphasises the importance of integrity and ethical behaviour through oral communication and by management example. Domination of management by a single individual in a smaller or less complex entity does not generally, in and of itself, indicate a failure by management to display and communicate an appropriate attitude regarding internal control and the financial reporting process. In some entities, the need for management authorisation can compensate for otherwise deficient controls and reduce the risk of employee fraud. However, domination of management by a single individual creates a conducive environment for management override of controls.

(Ref: Para. 39)

In determining whether fraud risk factors, individually or in combination, indicate that there are risks of material misstatement due to fraud, the auditor may consider:

• The likelihood and magnitude of fraud resulting from fraud risk factors. Fraud risk factors influence the auditor’s assessment of the likelihood and magnitude of a potential misstatement for the identified risks of misstatement due to fraud. Considering the degree to which fraud risk factors affect the susceptibility of an assertion to misstatement assists the auditor in appropriately assessing risks of material misstatement at the assertion level due to fraud.
• The number of fraud risk factors that relate to the same class of transactions, account balance or disclosure. When several fraud risk factors relate to the same class of transactions, account balance or disclosure, it may indicate that there is a risk of material misstatement due to fraud at the assertion level.

Determining whether the risks of material misstatement due to fraud exist at the financial report level, or the assertion level for classes of transactions, account balances and disclosures, may assist the auditor in determining appropriate responses to address the assessed risks of material misstatement due to fraud.

Evaluating the design of controls that address significant risks, or support the operation of other controls that address significant risks, involves the auditor’s consideration of whether the control, individually or in combination with other controls, is capable of effectively preventing, or detecting and correcting material misstatements due to fraud (i.e., the control objective). The auditor determines whether identified controls have been implemented by establishing that the control exists, and that the entity is using it. The controls in the control environment, the entity’s risk assessment process and the entity’s process to monitor the system of internal control are primarily indirect controls. For example, a whistleblower program (or other program to report fraud) may be an indirect control within the control environment. Indirect controls may not be sufficiently precise to prevent, detect or correct misstatements due to fraud at the assertion level but support other controls and may therefore have an indirect effect on the likelihood that a misstatement due to fraud will be prevented or detected on a timely basis. However, some controls within these components may also be direct controls.

Considerations Specific to Public Sector Entities

In the public sector, misappropriation of assets (including the misuse of public money for private benefit) may be a more common type of fraud compared to fraudulent financial reporting. In addition, there may be more opportunities for third parties to commit fraud through grant programs, contracts and social welfare or benefit programs.

Risks of Material Misstatement Due to Fraud Related to Management Override of Controls (Ref: Para. 40)

Management is in a unique position to perpetrate fraud because of management’s ability to manipulate accounting records and prepare fraudulent financial report by overriding controls that otherwise appear to be operating effectively. Although the level of risks of management override of controls will vary from entity to entity, the risk is nevertheless present in all entities. See also paragraphs 47–52.

In certain circumstances, the auditor may determine that the risks of material misstatement due to fraud related to management override of controls affect individual assertions and related significant classes of transactions, account balances and disclosures. In such cases, in addition to the requirements in paragraphs 48–52, the auditor identifies these risks at the assertion level and designs and performs further audit procedures to address the assessed risks of material misstatement due to fraud at the assertion level in accordance with paragraph 46.

Risks of Material Misstatement Due to Fraud in Revenue Recognition (Ref: Para. 41)

Material misstatement due to fraudulent financial reporting in revenue recognition often results from an overstatement of revenues through, for example, premature revenue recognition or recording fictitious revenues. It may also result from an understatement of revenues through, for example, improperly deferring revenues to a later period.

The risks of material misstatement due to fraud in revenue recognition may be greater in some entities than others. For example, there may be pressures or incentives on management to commit fraudulent financial reporting through inappropriate revenue recognition in the case of publicly traded entities when, for example, performance is measured in terms of year over year revenue growth or profit. Similarly, for example, there may be greater risks of material misstatement due to fraud in revenue recognition in the case of entities that generate a substantial portion of revenues through cash sales that present an opportunity for theft, or that have complex revenue recognition arrangements (e.g., licenses of intellectual property or percentage of completion) that are susceptible to management bias when determining percentage of completion for revenue recognition.

Understanding the entity’s business and its environment, the applicable financial reporting framework and the entity’s system of internal control helps the auditor understand the nature of the revenue transactions, the applicable revenue recognition criteria and the appropriate industry practice related to revenue. This understanding may assist the auditor in identifying events or conditions (see examples below) relating to the types of revenue, revenue transactions, or relevant assertions, that could give rise to fraud risk factors.

If fraud risk factors related to revenue recognition are present, determining whether such fraud risk factors indicate a risk of material misstatement due to fraud is a matter of professional judgement. The significance of fraud risk factors (see paragraphs A110–A112) related to revenue recognition, individually or in combination, ordinarily makes it inappropriate for the auditor to rebut the presumption that there are risks of material misstatement due to fraud in revenue recognition.

There may be limited circumstances where it may be appropriate to rebut the presumption that there are risks of material misstatement due to fraud in revenue recognition. The auditor may conclude that there are no risks of material misstatement due to fraud relating to revenue recognition in the case where fraud risk factors are not significant.

Paragraph 68(d) specifies the documentation required when the auditor concludes that the presumption is not applicable in the circumstances of the engagement and, accordingly, has not identified revenue recognition as a risk of material misstatement due to fraud.

Considerations Specific to Public Sector Entities

In public sector entities, there may be fewer incentives or pressures to engage in fraudulent financial reporting by intentionally overstating or understating revenue but there may be fraud risks related to expenditures, especially when such expenditures are subject to statutory limits.

Unpredictability in the Selection of Audit Procedures (Ref: Para. 43)

Incorporating an element of unpredictability in the selection of the nature, timing, and extent of audit procedures to be performed is essential, particularly where individuals within the entity who are familiar with the audit procedures normally performed on engagements may be better positioned to conceal fraudulent financial reporting and misappropriation of assets. It is therefore important that the auditor maintains an open mind to new ideas or different perspectives when selecting the audit procedures to be performed to address the risks of material misstatement due to fraud.

The extent to which the auditor chooses to incorporate an element of unpredictability in the selection of the nature, timing, and extent of audit procedures is a matter of professional judgement. The auditor may, when incorporating an element of unpredictability in the selection of the nature, timing, and extent of audit procedures, refer to Appendix 2 of this ASA for examples of possible audit procedures to use when addressing the assessed risks of material misstatement due to fraud.

Overall Responses (Ref: Para. 44)

In accordance with paragraph 39(b), assessed risks of material misstatement due to fraud at the financial report level are also treated as significant risks. This has a significant bearing on the auditor’s general approach and thereby the auditor’s overall responses to such risks.

Audit Procedures Responsive to the Assessed Risks of Material Misstatement Due to Fraud at the Assertion Level (Ref: Para. 46)

In accordance with paragraph 39(b), assessed risks of material misstatement due to fraud are treated as significant risks. ASA 330 requires the auditor to obtain more persuasive evidence the higher the auditor’s assessment of risk. When obtaining more persuasive audit evidence to respond to assessed risks of material misstatement due to fraud, the auditor may increase the quantity of the evidence, or obtain evidence that is more relevant and reliable, for example, by placing more emphasis on obtaining third party evidence or by obtaining audit evidence from a number of independent sources.

External Confirmation Procedures

In applying ASA 330,^[60] external confirmation procedures may be considered useful when seeking audit evidence that is not biased towards corroborating or contradicting a relevant assertion in the financial report, especially in instances where risks of material misstatement due to fraud have been identified related to the class of transactions, account balance or disclosure.

ASA 505^[61] requires the auditor to maintain control over the external confirmation requests and to evaluate the implications of management’s refusal to allow the auditor to send a confirmation request. If the auditor is unable to maintain control over the confirmation process or obtains an unsatisfactory response as to why management refuses to allow the auditor to send a confirmation request, as applicable, then this may be an indication of a fraud risk factor.

The use of external confirmation procedures may be more effective or provide more persuasive audit evidence over the terms and conditions of a contractual agreement.

ASA 505^[62] includes factors that may indicate doubts about the reliability of a response to an external confirmation request, since all responses carry some risk of interception, alteration, or fraud. This may be the case when the response to a confirmation request:

• Is sent from an e-mail address that is not recognised.
• Does not include the original electronic mail chain or any other information indicating that the confirming party is responding to the auditor’s confirmation request.
• Contains unusual restrictions or disclaimers.

ASA 505^[63] includes guidance for the auditor when a response to a confirmation request indicates a difference between information requested to be confirmed, or contained in the entity’s records, and information provided by the confirming party.

Examples of Other Further Audit Procedures

Examples of possible audit procedures to address the assessed risks of material misstatement due to fraud are presented in Appendix 2. The Appendix includes examples of responses to the auditor’s assessment of the risks of material misstatement resulting from both fraudulent financial reporting, including fraudulent financial reporting resulting from revenue recognition, and misappropriation of assets.

Audit Procedures Responsive to Risks of Material Misstatement Due to Fraud Related to Management Override of Controls 

Journal Entries and Other Adjustments (Ref: Para. 48–49) 

Why the testing of journal entries and other adjustments is performed

Material misstatements of the financial report due to fraud often involve the manipulation of the financial reporting process by recording inappropriate or unauthorised journal entries in the general ledger and other adjustments. This may occur throughout the year or at period end, or by management making adjustments to amounts reported in the financial report that are not reflected in journal entries, such as through consolidation adjustments and reclassifications.

Testing the appropriateness of journal entries recorded in the general ledger and other adjustments (e.g., entries made directly to the financial report such as eliminating adjustments for transactions, unrealised profits and intra-group account balances at the group level) may assist the auditor in identifying fraudulent journal entries and other adjustments.

The auditor’s consideration of the risks of material misstatement associated with management override of controls over journal entries^[64] is important because automated processes and controls may reduce the risk of inadvertent error but do not overcome the risk that management may inappropriately override such automated processes and controls, for example, by changing the amounts being automatically posted in the general ledger or to the financial reporting system. Further, where IT is used to transfer information automatically, there may be little or no visible evidence of such intervention in the information systems.

In planning the audit,^[65] drawing on the experience and insight of the engagement partner or other key members of the engagement team may be helpful in designing audit procedures to test the appropriateness of journal entries and other adjustments (e.g., to address the risks of management override of controls), including planning for the appropriate resources, and determining the nature, timing and extent of the related direction, supervision, and review of the work being performed.

Obtaining audit evidence about the completeness of the population of journal entries and other adjustments (Ref: Para. 49(b))

The population of journal entries may include manual adjustments, or other “top-side” adjustments that are made directly to the amounts reported in the financial report. Failing to obtain audit evidence about the completeness of the population may limit the effectiveness of the audit procedures in responding to the risks of management override of controls associated with fraudulent journal entries and other adjustments.

Selecting journal entries and other adjustments (Ref: Para. 49(c) and 49(d))

Prior to selecting items to test, the auditor may need to consider whether the integrity of the population of journal entries and other adjustments has been maintained throughout all stages of information processing based on the auditor’s understanding and evaluation of the entity’s information system and control activities (e.g., general IT controls that safeguard and maintain the integrity of financial information) in accordance with the requirements of ASA 315.^[66]

The auditor’s understanding of the entity and its environment, the applicable financial reporting framework, and the entity’s system of internal control may assist the auditor in selecting journal entries and other adjustments for testing.

Appendix 4 provides additional considerations that may be used by the auditor when selecting journal entries and other adjustments for testing.

Timing of testing journal entries and other adjustments (Ref: Para. 49(c) and 49(d))

Fraudulent journal entries and other adjustments are often made at the end of a reporting period; consequently, paragraph 49(c) requires the auditor to select journal entries and other adjustments made at that time.

Paragraph 49(d) requires the auditor to determine whether there is also a need to test journal entries and other adjustments throughout the period because material misstatements due to fraud can occur throughout the period and may involve extensive efforts to conceal how the fraud is accomplished.

Examining the underlying support for journal entries and other adjustments selected (Ref: Para. 49(c) and 49(d))

When testing the appropriateness of journal entries and other adjustments, the auditor may need to obtain and examine supporting documentation to determine the business rationale for recording them, including whether the recording of the journal entry reflects the substance of the transaction and complies with the applicable financial reporting framework.

Considering the use of automated tools and techniques when testing journal entries and other adjustments (Ref: Para. 49(b) and 49(c))

The auditor may consider the use of automated tools and techniques when testing journal entries and other adjustments (e.g., determining the completeness of the population or selecting items to test). Such consideration may be impacted by the entity’s use of technology in processing journal entries and other adjustments.

Accounting Estimates (Ref: Para. 50–51) 

Why the review of accounting estimates for management bias is performed

The preparation of the financial report requires management to make a number of judgements or assumptions that affect accounting estimates and to monitor the reasonableness of such estimates on an ongoing basis. Fraudulent financial reporting is often accomplished through intentional misstatement of accounting estimates. For example, this may be achieved by understating or overstating provisions or reserves so as to be designed either to smooth earnings over two or more accounting periods, or to achieve a designated earnings level in order to deceive financial report users by influencing their perceptions as to the entity’s performance and profitability.

ASA 315 provides guidance that management bias is often associated with certain conditions that have the potential to give rise to management not maintaining neutrality in exercising judgement (i.e., indicators of potential management bias), which could lead to a material misstatement of the information that would be fraudulent if intentional.^[67]

Indicators of possible management bias

ASA 540^[68] includes a requirement and related application material addressing indicators of possible management bias.

The auditor may use automated tools and techniques to review accounting estimates for management bias.

If there are indicators of possible management bias that may be intentional, the auditor may consider it appropriate to involve individuals with forensic skills in performing the review of accounting estimates for management bias in accordance with paragraphs 50–51. Applying forensic skills through analysing accounting records, conducting interviews, reviewing internal and external communications, investigating related party transactions, or reviewing internal controls may also assist the auditor in evaluating whether the indicators of possible management bias represent a material misstatement due to fraud.

Significant Transactions Outside the Normal Course of Business or Otherwise Appear Unusual (Ref: Para. 52)

Indicators that may suggest that significant transactions that are outside the normal course of business for the entity, or that otherwise appear to be unusual, may have been entered into to engage in fraudulent financial reporting or to conceal misappropriation of assets include:

• The form of such transactions appears overly complex (e.g., the transaction involves multiple entities within a consolidated group or multiple unrelated third parties).
• Management has not discussed the nature of and accounting for such transactions with those charged with governance of the entity, and there is inadequate documentation.
• Management is placing more emphasis on the need for a particular accounting treatment than on the underlying economics of the transaction.
• Transactions that involve non-consolidated related parties, including special purpose entities, have not been properly reviewed or approved by those charged with governance of the entity.
• Unusual activities with no logical business rationale.
• The transactions involve previously unidentified related parties or parties that do not have the substance or the financial strength to support the transaction without assistance from the entity under audit.

Analytical Procedures Performed Near the End of the Audit in Forming an Overall Conclusion (Ref: Para. 53)

ASA 520 explains that the analytical procedures performed near the end of the audit are intended to corroborate conclusions formed during the audit of individual components or elements of the financial report.^[69] However, the auditor may perform the analytical procedures at a more granular level for certain higher risk classes of transactions, account balances, and disclosures to determine whether certain trends or relationships may indicate a previously unidentified risk of material misstatement due to fraud. Determining which particular trends and relationships may indicate a risk of material misstatement due to fraud requires professional judgement. Unusual relationships involving year-end revenue and income are particularly relevant.

The auditor may use automated tools and techniques to identify unusual or inconsistent transaction posting patterns in order to determine if there is a previously unrecognised risk of material misstatement due to fraud.

(Ref: Para. 55–58)

If the auditor identifies fraud or suspected fraud, the firm’s policies or procedures may include actions for the engagement partner to take, depending on the facts and circumstances of the audit engagement and the nature of the fraud.

In accordance with ASA 220,^[70] the engagement partner is required to take responsibility for making the engagement team aware of the firm’s policies or procedures related to relevant ethical requirements. This includes the responsibilities of members of the engagement team when they become aware of an instance of non-compliance with laws and regulations by the entity, which includes instances of fraud.

Obtaining an Understanding of the Fraud or Suspected Fraud

The determination of which level of management is the appropriate one is a matter of professional judgement and is affected by such factors as the likelihood of collusion and the nature and magnitude of the suspected fraud. Ordinarily, the appropriate level of management is at least one level above the persons who appear to be involved with the fraud or suspected fraud.

When obtaining an understanding of the fraud or suspected fraud, the auditor may do one or more of the following depending on the facts and circumstances of the audit engagement and the nature of the fraud:

• Involve an auditor’s expert, such as an individual with forensic skills.
• Inspect the entity’s whistleblower program files for additional information.
• Make further enquiries of:
  • The entity’s in-house counsel or external legal counsel.
  • Individuals within the internal audit function (if the function exists).

Evaluating the Entity’s Process to Investigate and Remediate the Fraud or Suspected Fraud

The nature and extent of the entity’s process to investigate the fraud or suspected fraud undertaken by management or those charged with governance may vary based on the circumstances, and may be influenced by the entity’s assessment of the significance of fraud risks relevant to the entity’s financial reporting objectives. For example, an entity’s whistleblower program (or other program to report fraud) may set out policies or procedures to be followed in relation to investigation and remediation of matters, including the establishment of thresholds for taking further action.

When evaluating the appropriateness of the entity’s investigation process and remedial actions implemented to respond to the fraud or suspected fraud in accordance with paragraphs 55(b) and 55(c), the auditor may consider:

• In relation to the entity’s process to investigate the fraud or suspected fraud:
  • The objectivity and competence of individuals involved in the entity’s process to investigate the fraud or suspected fraud.
  • The nature, timing and extent of procedures to investigate the fraud or suspected fraud, including identification of root causes, if applicable.
• In relation to the entity’s actions to remediate the fraud or suspected fraud:
  • Whether the remedial actions address the root cause(s).
  • Whether the remedial actions are proportionate to the severity and pervasiveness of the identified fraud or suspected fraud and the urgency with which the matter needs to be addressed, including how management:
    • Responded to any misstatements that were identified (e.g., the timeliness of when the identified misstatements were corrected by management).
    • Responded to the fraud (e.g., disciplinary, or legal sanctions imposed on the individuals involved in perpetrating the fraud).
    • Addressed the control deficiencies regarding the prevention or detection of the fraud.

The auditor may use information obtained from their understanding of the entity’s whistleblower program in accordance with paragraph 32(a)(ii), including the entity’s process for investigating and remediating allegations of fraud that came through the entity’s whistleblower program, to determine whether a fraud or suspected fraud is clearly inconsequential.

Impact on the Overall Audit Strategy

The understanding obtained about the fraud or suspected fraud impacts the engagement partner’s determination of whether and how to adjust the overall audit strategy, including determining whether there is a need to perform additional risk assessment procedures or further audit procedures, especially in circumstances when information comes to the engagement partner’s attention that differs significantly from the information available when the overall audit strategy was originally established.^[71]

As described in ASA 220,^[72] in fulfilling the requirement in paragraph 56, the engagement partner may obtain information from other members of the engagement team (e.g., component auditors).

Based on the understanding obtained about the fraud or suspected fraud and the impact on the overall audit strategy, the engagement partner may determine that it is necessary to discuss an extension of the audit reporting deadlines with management and those charged with governance, where an extension is possible under applicable law or regulation. If an extension is not possible, ASA 705 deals with the implications for the auditor’s opinion on the financial report.

The Auditor Identifies a Misstatement Due to Fraud

ASA 450^[73] and ASA 700^[74] establish requirements and provide guidance on the evaluation of misstatements and the effect on the auditor’s opinion in the auditor’s report.

The following are examples of qualitative or quantitative circumstances that may be relevant when determining whether the misstatement due to fraud is material:

The implications of an identified misstatement due to fraud on the reliability of information intended to be used as audit evidence depends on the circumstances. For example, an otherwise insignificant fraud may be significant if it involves senior management. In such circumstances, the reliability of information previously obtained and intended to be used as audit evidence may be called into question as there may be doubts about the completeness and truthfulness of representations made and about the authenticity of accounting records and documentation.

Since fraud involves incentive or pressure to commit fraud, a perceived opportunity to do so or some rationalisation of the act, an instance of fraud is unlikely to be an isolated occurrence. Misstatements, such as numerous misstatements at a business unit or geographical location even though the cumulative effect is not material, may also be indicative of a risk of material misstatement due to fraud.

Considerations Specific to Public Sector Entities

For public sector entities, an example of both qualitative and quantitative circumstance includes whether a misstatement affects the determination of the surplus or deficit reported for the period, or whether or not the public sector entity has met or exceeded its approved budget, including where relevant, whether its expenses are within statutory limits.

Determining if Control Deficiencies Exist

ASA 265^[75] provides requirements and guidance about the auditor’s communication of significant deficiencies in internal control identified during the audit to those charged with governance. Examples of matters that the auditor considers in determining whether a deficiency or combination of deficiencies in internal control constitutes a significant deficiency include:

• The susceptibility to loss due to fraud of the related asset or liability.
• The importance of the controls to the financial reporting process (e.g., controls over the prevention and detection of fraud).

Indicators of significant deficiencies in internal control include, for example:

• Evidence of ineffective aspects of the control environment, such as the identification of management fraud, whether or not material, that was not prevented by the entity’s system of internal control.
• The lack of a process to investigate the fraud or suspected fraud or a process to investigate the fraud or suspected fraud that is not appropriate in the circumstances.
• The lack of, or ineffective, remediation measures implemented by management to prevent or detect the reoccurrence of the fraud or suspected fraud.

(Ref: Para. 59)

Examples of exceptional circumstances that may arise and that may bring into question the auditor’s ability to continue performing the audit include:

• The entity does not take the appropriate action regarding fraud that the auditor considers necessary in the circumstances, even where the fraud is not material to the financial report;
• The auditor’s consideration of the risks of material misstatement due to fraud or the results of audit procedures performed indicate a material and pervasive fraud; or
• The auditor has significant concern about the competence or integrity of management or those charged with governance.

Because of the variety of circumstances that may arise, it is not possible to describe definitively when withdrawal from an engagement is appropriate. Factors that affect the auditor’s conclusion include the implications of the involvement of a member of management or of those charged with governance (which may affect the reliability of management representations) and the effects on the auditor of a continuing association with the entity.

The auditor has professional and legal responsibilities in such circumstances and these responsibilities may vary by jurisdiction. In some countries, for example, the auditor may be entitled to, or required to, make a statement or report to the person or persons who made the audit appointment or, in some cases, to regulatory authorities. Given the exceptional nature of the circumstances and the need to consider the legal requirements, the auditor may consider it appropriate to seek legal advice when deciding whether to withdraw from an engagement and in determining an appropriate course of action, including the possibility of reporting to shareholders, regulators or others.^[76]

For an audit engagement under the Corporations Act 2001 (the Act), the possibility of withdrawing from the engagement or resigning from the appointment as an auditor can only be made in accordance with the provisions of the Act, including in certain circumstances, obtaining consent to resign from the Australian Securities and Investments Commission (ASIC).

Considerations Specific to Public Sector Entities

In many cases in the public sector, the option of withdrawing from the engagement may not be available to the auditor due to the nature of their legal mandate, based on public interest considerations.

(Ref: Para. 60–62)

Determining Key Audit Matters Related to Fraud

Users of the financial report are interested in matters related to fraud about which the auditor had a robust dialogue with those charged with governance. The considerations in paragraph 60 focus on the nature of matters communicated with those charged with governance that are intended to reflect matters related to fraud that may be of particular interest to intended users.

In addition to matters that relate to the specific required considerations in paragraph 60, there may be other matters related to fraud communicated with those charged with governance that required significant auditor attention and that therefore may be determined to be key audit matters in accordance with paragraph 61.

Matters related to fraud are often matters that require significant auditor attention. For example, the identification of fraud or suspected fraud may require significant changes to the auditor’s risk assessment and re-evaluation of the planned audit procedures (i.e., a significant change in the audit approach).

The determination of key audit matters involves making a judgement about the relative importance of matters that required significant auditor attention. Therefore, it may be rare that the auditor of a complete set of general-purpose financial report of a publicly traded entity would not determine at least one key audit matter related to fraud. However, in certain limited circumstances, the auditor may determine that there are no matters related to fraud that are key audit matters in accordance with paragraph 61.

Accounting estimates are often the most complex areas of the financial report because they may be dependent on significant management judgement. Significant auditor attention may be required in accordance with paragraph 60(a) to respond to assessed risks of material misstatement due to fraud associated with an accounting estimate that involves significant management judgement. Significant management judgement is often involved when an accounting estimate is subject to a high degree of estimation uncertainty and subjectivity.

ASA 265 requires the auditor to communicate a significant deficiency in internal control to those charged with governance that is relevant to the prevention and detection of fraud. Significant deficiencies may exist even though the auditor has not identified misstatements during the audit. For example, the lack of a whistleblower program (or other program to report fraud) may be indicative of deficiencies in the entity’s control environment, but it may not directly relate to a risk of material misstatement due to fraud. The auditor may also communicate these deficiencies to management.

This ASA requires management override of controls to be a risk of material misstatement due to fraud (see paragraph 40) and presumes that there are risks of material misstatement due to fraud in revenue recognition (see paragraph 41). The auditor may determine these matters to be key audit matters related to fraud because risks of material misstatement due to fraud are often matters that both require significant auditor attention and are of most significance in the audit. However, this may not be the case for all these matters. The auditor may determine that certain risks of material misstatement due to fraud did not require significant auditor attention and, therefore, these risks would not be considered in the auditor’s determination of key audit matters in accordance with paragraph 60.

As described in ASA 701,^[77] the auditor’s decision-making process in determining key audit matters is based on the auditor’s professional judgement about which matters were of most significance in the audit of the financial report of the current period. Significance can be considered in the context of quantitative and qualitative factors, such as relative magnitude, the nature and effect on the subject matter and the expressed interests of intended users or recipients.^[78]

One of the considerations that may be relevant in determining the relative significance of a matter that required significant auditor attention, and whether such a matter is a key audit matter, is the importance of the matter to intended users’ understanding of the financial report as a whole.^[79] As users of the financial report are interested in matters related to fraud, one or more of the matters related to fraud that required significant auditor attention in performing the audit, determined in accordance with paragraph 60, would ordinarily be of most significance in the audit of the financial report of the current period and therefore are key audit matters.

ASA 701^[80] includes other considerations that may be relevant to determining which matters related to fraud that required significant auditor attention, were of most significance in the current period and therefore are key audit matters.

Communicating Key Audit Matters Related to Fraud

If a matter related to fraud is determined to be a key audit matter and there are a number of separate, but related, considerations that were of most significance in the audit, the auditor may communicate the matters together in the auditor’s report. For example, long-term contracts may involve significant auditor attention with respect to revenue recognition and revenue recognition may also be identified as a risk of material misstatement due to fraud. In such circumstances, the auditor may include in the auditor’s report one key audit matter related to revenue recognition with an appropriate subheading that clearly describes the matter, including that it relates to fraud.

Relating a matter directly to the specific circumstances of the entity may help to minimise the potential that such descriptions become overly standardised and less useful over time. In describing why the auditor considered the matter to be one of most significance in the audit, the auditor may highlight aspects specific to the entity (e.g., circumstances that affected the underlying judgements made in the financial report of the current period) so as to make the description more relevant for intended users. This may be particularly important in describing a key audit matter that recurs over multiple periods. Similarly, in describing how the key audit matter related to fraud was addressed in the audit, the auditor may highlight matters directly related to the specific circumstances of the entity, while avoiding generic or standardised language.

ASA 701^[81] includes considerations and guidance on original information (information about the entity that has not otherwise been made publicly available by the entity) that may be particularly relevant in the context of communicating key audit matters related to fraud.

ASA 701^[82] describes that management or those charged with governance may decide to include new or enhanced disclosures in the financial report or elsewhere in the annual report relating to a key audit matter in light of the fact that the matter will be communicated in the auditor’s report. Such new or enhanced disclosures, for example, may be included to provide more robust information about identified fraud or suspected fraud or identified deficiencies in internal control that are relevant to the prevention and detection of fraud.

Circumstances in Which a Matter Determined to Be a Key Audit Matter Is Not Communicated in the Auditor’s Report

ASA 701, paragraph 14(b), indicates that it will be extremely rare for a matter determined to be a key audit matter not to be communicated in the auditor’s report and includes guidance on circumstances in which such a matter determined to be a key audit matter is not communicated in the auditor’s report. For example:

• Law or regulation may preclude public disclosure by either management or the auditor about a specific matter determined to be a key audit matter.
• There is presumed to be a public interest benefit in providing greater transparency about the audit for intended users. Accordingly, the judgement not to communicate a key audit matter is appropriate only in cases when the adverse consequences to the entity or the public as a result of such communication are viewed as so significant that they would reasonably be expected to outweigh the public interest benefits of communicating about the matter.^[83]

It may also be necessary for the auditor to consider the implications of communicating about a matter determined to be a key audit matter in light of relevant ethical requirements.^[84] In addition, the auditor may be required by law or regulation to communicate with applicable regulatory, enforcement or supervisory authorities in relation to the matter, regardless of whether the matter is communicated in the auditor’s report.

(Ref: Para. 63)

ASA 580^[85] establishes requirements and provides guidance on obtaining appropriate representations from management and, where appropriate, those charged with governance in the audit. Although written representations are an important source of audit evidence, they do not provide sufficient appropriate audit evidence on their own about any of the matters with which they deal. In addition, since management are in a unique position to perpetrate fraud, it is important for the auditor to consider all audit evidence obtained, including audit evidence that is consistent or inconsistent with other audit evidence in drawing the conclusion required in accordance with ASA 330.^[86]

ASA 580^[87] also addresses circumstances when the auditor has doubt as to the reliability of written representations, including if written representations are inconsistent with other audit evidence. Doubts about the reliability of information from management may indicate a risk of material misstatement due to fraud.

(Ref: Para. 64–66)

In some jurisdictions, law or regulation may restrict the auditor’s communication of certain matters with management and those charged with governance. Law or regulation may specifically prohibit a communication, or other action, that might prejudice an investigation by an appropriate authority into an actual, or suspected, illegal act, including alerting the entity, for example, when the auditor is required to report the fraud to an appropriate authority pursuant to anti-money laundering legislation. In these circumstances, the issues considered by the auditor may be complex and the auditor may consider it appropriate to obtain legal advice.

Legislation may require the auditor or a member of the audit team to maintain the confidentiality of information disclosed to the auditor, or a member of the audit team, by a person regarding contraventions or possible contraventions of the law.^[*] In such circumstances, the auditor or a member of the audit team may be prevented from communicating that information to management or those charged with governance in order to protect the identity of the person who has disclosed confidential information that alleges a breach of the law. In such circumstances, the auditor may consider obtaining legal advice to assist in determining the appropriate course of action and may need to consider the implications for the audit engagement.

Communication with Management (Ref: Para. 64)

If the auditor identifies fraud or suspected fraud, it is important that the matter be brought to the attention of the appropriate level of management as soon as practicable, even if the matter may be considered clearly inconsequential (e.g., a minor misappropriation of funds by an employee at a low level in the entity’s organisation).

Communication with Those Charged with Governance (Ref: Para. 65)

The auditor’s communication with those charged with governance may be made orally or in writing. ASA 260 identifies factors the auditor considers in determining whether to communicate orally or in writing.^[88] Due to the nature and sensitivity of fraud involving senior management, or fraud that results in a material misstatement in the financial report, the auditor reports such matters on a timely basis and may consider it necessary to also report such matters in writing.

In some cases, the auditor may consider it appropriate to communicate with those charged with governance fraud or suspected fraud involving others that the auditor determined to be clearly inconsequential. Similarly, those charged with governance may wish to be informed of such circumstances. The communication process is assisted if the auditor and those charged with governance agree at an early stage in the audit about the nature and extent of the auditor’s communications in this regard.

In the exceptional circumstances where the auditor has doubts about the integrity or honesty of management or those charged with governance, the auditor may consider it appropriate to obtain legal advice to assist in determining the appropriate course of action.

Other Matters Related to Fraud (Ref: Para. 66)

Other matters related to fraud to be discussed with those charged with governance of the entity may include, for example:

• Concerns about the nature, extent, and frequency of management’s assessments of the controls in place to prevent or detect fraud and of the risk that the financial report may be misstated.
• A failure by management to appropriately address identified significant deficiencies in internal control, or to appropriately respond to an identified fraud.
• The auditor’s evaluation of the entity’s control environment, including questions regarding the competence and integrity of management.
• Actions by management that may be indicative of fraudulent financial reporting, such as management’s selection and application of accounting policies that may be indicative of management’s effort to manage earnings in order to deceive financial report users by influencing their perceptions as to the entity’s performance and profitability.
• Concerns about the adequacy and completeness of the authorisation of transactions that appear to be outside the normal course of business.

(Ref: Para. 67)

The reporting may be to applicable regulatory, enforcement, supervisory or other appropriate authority outside the entity.

ASA 250^[89] provides further guidance with respect to the auditor’s determination of whether reporting identified or suspected non-compliance with laws or regulations to an appropriate authority outside the entity is required or appropriate in the circumstances, including consideration of the auditor’s duty of confidentiality.^[90]

An auditor is required by the Corporations Act 2001 to notify the Australian Securities and Investments Commission (ASIC) if the auditor is aware of certain circumstances.^[*]

Factors the auditor may consider in determining whether it is appropriate to report the matter to an appropriate authority outside the entity, when not prohibited by law, regulation, or relevant ethical requirements, may include:

• Any views expressed by regulatory, enforcement, supervisory or other appropriate authority outside of the entity.
• Whether reporting the matter would be acting in the public interest.

Reporting fraud matters to an appropriate authority outside the entity may involve complex considerations and professional judgements. In those circumstances, the auditor may consider consulting internally (e.g., within the firm or a network firm) or on a confidential basis with a regulator or professional body (unless doing so is prohibited by law or regulation or would breach the duty of confidentiality). The auditor may also consider obtaining legal advice to understand the auditor’s options and the professional or legal implications of taking any particular course of action.

Considerations Specific to Public Sector Entities

In the public sector, requirements for reporting fraud, whether or not discovered through the audit process, may be subject to specific provisions of the audit mandate or related law, regulation, or other authority.

(Ref: Para. 68)

ASA 230^[91] addresses circumstances when the auditor identifies information that is inconsistent with the auditor’s final conclusion regarding a significant matter and requires the auditor to document how the auditor addressed the inconsistency.

Examples of Fraud Risk Factors

See Appendix 1

Examples of Possible Audit Procedures to Address the Assessed Risks of Material Misstatement Due to Fraud

See Appendix 2

Examples of Circumstances that May Be Indicative of Fraud or Suspected Fraud

See Appendix 3

Additional Considerations that May Inform the Auditor When Selecting Journal Entries and Other Adjustments for Testing

See Appendix 4

Other ASAs Addressing Specific Topics that Reference Fraud or Suspected Fraud

See Appendix 5