CTHRepealedLegislation
//
© 2026 Zoe. All rights reserved.
Zoe is a legal information platform. Always consult the Federal Register of Legislation for authoritative text.
ASA 240 - The Auditor’s Responsibility to Consider Fraud in an Audit of a Financial Report - April 2006
Start here
Turn the raw legal text into a practical explanation grounded in ASA 240 - The Auditor’s Responsibility to Consider Fraud in an Audit of a Financial Report - April 2006.
Risk Assessment Procedures
37 Under ASA 315, to obtain an understanding of the entity and its environment, including its internal control, the auditor needs to perform risk assessment procedures. Ordinarily, as part of this work the auditor performs the following procedures to obtain information that is used to identify the risks of material misstatement due to fraud:
Makes enquiries of management, of those charged with governance, and of others within the entity as appropriate and obtains an understanding of how those charged with governance exercise oversight of management’s processes for identifying and responding to the risks of fraud and the internal control that management has established to mitigate these risks.
Considers whether one or more fraud risk factors are present.
Considers any unusual or unexpected relationships that have been identified in performing analytical procedures.
Considers other information that may be helpful in identifying the risks of material misstatement due to fraud.
Enquiries and Obtaining an Understanding of Oversight Exercised by Those Charged With Governance
38 When obtaining an understanding of the entity and its environment, including its internal control, the auditor shall make enquiries of management regarding:
(a) management’s assessment of the risk that the financial report may be materially misstated due to fraud;
(b) management’s process for identifying and responding to the risks of fraud in the entity, including any specific risks of fraud that management has identified or account balances, classes of transactions or disclosures for which a risk of fraud is likely to exist;
(c) management’s communication, if any, to those charged with governance regarding its processes for identifying and responding to the risks of fraud in the entity; and
(d) management’s communication, if any, to employees regarding its views on business practices and ethical behaviour.
39 As management is responsible for the entity’s internal control and for the preparation of the financial report, it is appropriate for the auditor to make enquiries of management regarding management’s own assessment of the risk of fraud and the controls in place to prevent and detect it. The nature, extent and frequency of management’s assessment of such risk and controls vary from entity to entity. In some entities, management may make detailed assessments on an annual basis or as part of continuous monitoring. In other entities, management’s assessment may be less formal and less frequent. In some entities, particularly smaller entities, the focus of the assessment may be on the risks of employee fraud or misappropriation of assets. The nature, extent and frequency of management’s assessment are relevant to the auditor’s understanding of the entity’s control environment. For example, the fact that management has not made an assessment of the risk of fraud may in some circumstances be indicative of the lack of importance that management places on internal control.
40 In a small owner managed entity, the owner-manager may be able to exercise more effective oversight than in a larger entity, thereby compensating for the generally more limited opportunities for segregation of duties. On the other hand, the owner-manager may be more able to override controls because of the informal system of internal control. This is ordinarily taken into account by the auditor when identifying the risks of material misstatement due to fraud.
41 When making enquiries as part of obtaining an understanding of management’s process for identifying and responding to the risks of fraud in the entity, under paragraph 38 of this Auditing Standard the auditor needs to enquire about the process of responding to internal or external allegations of fraud affecting the entity. For entities with multiple locations, the auditor ordinarily enquires about the nature and extent of monitoring of operating locations or business segments and whether there are particular operating locations or business segments for which a risk of fraud may be more likely to exist.
42 The auditor shall make enquiries of management, internal audit, and others within the entity as appropriate, to determine whether they have knowledge of any actual, suspected or alleged fraud affecting the entity.
43 Although the auditor’s enquiries of management may provide useful information concerning the risks of material misstatements in the financial report resulting from employee fraud, such enquiries are unlikely to provide useful information regarding the risks of material misstatement in the financial report resulting from management fraud. Making enquiries of others within the entity, in addition to management, may be useful in providing the auditor with a perspective that is different from management and those responsible for the financial reporting process. Such enquiries may provide individuals with an opportunity to convey information to the auditor that may not otherwise be communicated. The auditor uses professional judgement in determining those others within the entity to whom enquiries are directed and the extent of such enquiries. In making this determination the auditor ordinarily considers whether others within the entity may be able to provide information that will be helpful to the auditor in identifying the risks of material misstatement due to fraud.
44 In accordance with paragraph 42 of this Auditing Standard, the auditor is required to make enquiries of internal audit personnel, for those entities that have an internal audit function. The enquiries address the views of the internal auditors regarding the risks of fraud, whether during the year the internal auditors have performed any procedures to detect fraud, whether management has satisfactorily responded to any findings resulting from these procedures, and whether the internal auditors have knowledge of any actual, suspected or alleged fraud.
45 Examples of others within the entity to whom the auditor may direct enquiries about the existence or suspicion of fraud include:
46 When evaluating management’s responses to enquiries, the auditor maintains an attitude of professional scepticism recognising that management is often in the best position to perpetrate fraud. Therefore, the auditor uses professional judgement in deciding when it is necessary to corroborate responses to enquiries with other information. When responses to enquiries are inconsistent, the auditor ordinarily seeks to resolve the inconsistencies.
47 The auditor shall obtain an understanding of how those charged with governance exercise oversight of management’s processes for identifying and responding to the risks of fraud in the entity and the internal control that management has established to mitigate these risks.
48 Those charged with governance of an entity have oversight responsibility for systems for monitoring risk, financial control and compliance with the law. Those charged with governance play an active role in oversight of the entity’s assessment of the risks of fraud and of the internal control the entity has established to mitigate specific risks of fraud that the entity has identified. Since the responsibilities of those charged with governance and management may vary by entity, under ASA 260 Communication of Audit Matters with Those Charged with Governance, the auditor needs to understand their respective responsibilities to enable the auditor to obtain an understanding of the oversight exercised by the appropriate individuals.[2] Those charged with governance include management when management performs such functions, such as may be the case in smaller entities.
49 Obtaining an understanding of how those charged with governance exercise oversight of management’s processes for identifying and responding to the risks of fraud in the entity, and the internal control that management has established to mitigate these risks, may provide insights regarding the susceptibility of the entity to management fraud, the adequacy of such internal control and the competence and integrity of management. The auditor may obtain this understanding by performing procedures such as attending meetings where such discussions take place, reading the minutes from such meetings or by making enquiries of those charged with governance.
50 The auditor shall make enquiries of those charged with governance to determine whether they have knowledge of any actual, suspected or alleged fraud affecting the entity.
51 Ordinarily, the auditor makes enquiries of those charged with governance in part to corroborate the responses to the enquiries from management. When responses to these enquiries are inconsistent, the auditor ordinarily obtains additional audit evidence to resolve the inconsistencies. Enquiries of those charged with governance may also assist the auditor in identifying risks of material misstatement due to fraud.
Consideration of Fraud Risk Factors
52 When obtaining an understanding of the entity and its environment, including its internal control, the auditor shall consider whether the information obtained indicates that one or more fraud risk factors are present.
53 The fact that fraud is usually concealed can make it very difficult to detect. Nevertheless, when obtaining an understanding of the entity and its environment, including its internal control, the auditor may identify events or conditions that indicate an incentive or pressure to commit fraud or provide an opportunity to commit fraud. Such events or conditions are referred to as “fraud risk factors.” For example:
54 Fraud risk factors cannot easily be ranked in order of importance. The significance of fraud risk factors varies widely. Some of these factors will be present in entities where the specific conditions do not present risks of material misstatement. Accordingly, the auditor exercises professional judgement in determining whether a fraud risk factor is present and whether it is to be considered in assessing the risks of material misstatement of the financial report due to fraud.
55 Examples of fraud risk factors related to fraudulent financial reporting and misappropriation of assets are presented in Appendix 1 to this Auditing Standard. These illustrative risk factors are classified based on the three conditions that are generally present when fraud exists: an incentive or pressure to commit fraud; a perceived opportunity to commit fraud; and an ability to rationalise the fraudulent action. Risk factors reflective of an attitude that permits rationalisation of the fraudulent action may not be susceptible to observation by the auditor. Nevertheless, the auditor may become aware of the existence of such information. Although the fraud risk factors described in Appendix 1 cover a broad range of situations that may be faced by auditors, they are only examples and other risk factors may exist. Ordinarily, the auditor also has to be alert for risk factors specific to the entity that are not included in Appendix 1. Not all of the examples in Appendix 1 are relevant in all circumstances, and some may be of greater or lesser significance in entities of different size, with different ownership characteristics, in different industries, or because of other differing characteristics or circumstances.
56 The size, complexity, and ownership characteristics of the entity have a significant influence on the consideration of relevant fraud risk factors. For example, in the case of a large entity, the auditor ordinarily considers factors that generally constrain improper conduct by management, such as the effectiveness of those charged with governance and of the internal audit function and the existence and enforcement of a formal code of conduct. Furthermore, fraud risk factors considered at a business segment operating level may provide different insights than the consideration thereof at an entity-wide level. In the case of a small entity, some or all of these considerations may be inapplicable or less important. For example, a smaller entity may not have a written code of conduct but, instead, may have developed a culture that emphasises the importance of integrity and ethical behaviour through oral communication and by management example. Domination of management by a single individual in a small entity does not generally, in and of itself, indicate a failure by management to display and communicate an appropriate attitude regarding internal control and the financial reporting process. In some entities, the need for management authorisation can compensate for otherwise weak controls and reduce the risk of employee fraud. However, domination of management by a single individual can be a potential weakness since there is an opportunity for management override of controls.
Consideration of Unusual or Unexpected Relationships
57 When performing analytical procedures to obtain an understanding of the entity and its environment, including its internal control, the auditor shall consider unusual or unexpected relationships that may indicate risks of material misstatement due to fraud.
58 Analytical procedures may be helpful in identifying the existence of unusual transactions or events, and amounts, ratios, and trends that might indicate matters that have financial report and audit implications. In performing analytical procedures the auditor ordinarily develops expectations about plausible relationships that are reasonably expected to exist based on the auditor’s understanding of the entity and its environment, including its internal control. When a comparison of those expectations with recorded amounts, or with ratios developed from recorded amounts, yields unusual or unexpected relationships, under paragraph 57 of this Auditing Standard, the auditor needs to consider those results in identifying risks of material misstatement due to fraud. Analytical procedures include procedures related to revenue accounts with the objective of identifying unusual or unexpected relationships that may indicate risks of material misstatement due to fraudulent financial reporting, such as, for example, fictitious sales or significant returns from customers that might indicate undisclosed side agreements.
Consideration of Other Information
59 When obtaining an understanding of the entity and its environment, including its internal control, the auditor shall consider whether other information obtained indicates risks of material misstatement due to fraud.
60 In addition to information obtained from applying analytical procedures, the auditor ordinarily considers other information obtained about the entity and its environment that may be helpful in identifying the risks of material misstatement due to fraud. The discussion among team members described in paragraphs 30-36 may provide information that is helpful in identifying such risks. In addition, information obtained from the auditor’s client acceptance and retention processes, and experience gained on other engagements performed for the entity, for example engagements to review interim financial information, may be relevant in the identification of the risks of material misstatement due to fraud.