ASA 250 - Consideration of Laws and Regulations in an Audit of a Financial Report - April 2006

AUDITING STANDARD ASA 250 AUDITING STANDARD ASA 250

(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with Part 2M.3 of the Corporations Act 2001; and

4 The purpose of this Auditing Standard is to establish mandatory requirements and to provide explanatory guidance on the auditor’s responsibility to consider laws and regulations in an audit of a financial report.

5 When designing and performing audit procedures and in evaluating and reporting the results thereof, the auditor shall recognise that non-compliance by the entity with laws and regulations may materially affect the financial report.

6 However, an audit cannot be expected to detect non-compliance with all laws and regulations. Detection of non-compliance, regardless of materiality, requires consideration of the implications for the integrity of management or other employees and the possible effect on other aspects of the audit.

7 The term “non-compliance” as used in this Auditing Standard refers to acts of omission or commission by the entity being audited, either intentional or unintentional, which are contrary to the prevailing laws or regulations. Such acts include transactions entered into by, or in the name of, the entity or on its behalf by its management or employees. For the purpose of this Auditing Standard, non-compliance does not include personal misconduct (unrelated to the business activities of the entity) by the entity’s management or employees.

8 Whether an act constitutes non-compliance is a legal determination that is ordinarily beyond the auditor’s professional competence. The auditor’s training, experience and understanding of the entity and its industry may provide a basis for recognition that some acts coming to the auditor’s attention may constitute non-compliance with laws and regulations. The determination as to whether a particular act constitutes or is likely to constitute non-compliance is generally based on the advice of an informed expert qualified to practice law but ultimately can only be determined by a court of law.

9 Laws and regulations vary considerably in their relation to the financial report. Some laws or regulations determine the form or content of an entity’s financial report or the amounts to be recorded or disclosures to be made in the financial report. Other laws or regulations are to be complied with by management or set the provisions under which the entity is allowed to conduct its business. Some entities operate in heavily regulated industries (such as banks and chemical companies). Others are only subject to the many laws and regulations that generally relate to the operating aspects of the business (such as those relating to occupational health and safety and equal employment opportunity). Non-compliance with laws and regulations could result in financial consequences for the entity such as fines, litigation, etc. Generally, the further removed non-compliance is from the events and transactions ordinarily reflected in the financial report, the less likely the auditor is to become aware of it or to recognise its possible non-compliance.

10 Laws and regulations vary from country to country. National accounting and auditing standards are therefore likely to be more specific as to the relevance of laws and regulations to an audit.

11 This Auditing Standard applies to audits of financial reports and does not apply to other engagements in which the auditor is specifically engaged to test and report separately on compliance with specific laws or regulations.

12 Guidance on the auditor’s responsibility to consider fraud and error in an audit of a financial report is provided in Auditing Standard ASA 240 The Auditor’s Responsibility to Consider Fraud in an Audit of a Financial Report.

13 It is the responsibility of those charged with governance and management to ensure that the entity’s operations are conducted in accordance with all applicable laws and regulations. The responsibility for the prevention and detection of non-compliance rests with those charged with governance and management.

14 The following policies and procedures, among others, may assist management in discharging its responsibilities for the prevention and detection of non-compliance:

• monitoring compliance with the code of conduct and acting appropriately to discipline employees who fail to comply with it;
• maintaining a register of significant laws with which the entity has to comply within its particular industry and a record of complaints.

15 In larger entities, these policies and procedures may be supplemented by assigning appropriate responsibilities to the following:

16 The auditor is not, and cannot be held responsible for preventing non-compliance with laws and regulations. The fact that an annual audit is carried out may, however, act as a deterrent to any non-compliance.

17 An audit is subject to the unavoidable risk that some material misstatements in the financial report will not be detected, even though the audit is properly planned and performed in accordance with Auditing Standards. This risk is higher with regard to material misstatements resulting from non-compliance with laws and regulations due to factors such as the following:

• there are many laws and regulations, relating principally to the operating aspects of the entity, that typically do not have a material effect on the financial report and are not captured by the entity’s information systems relevant to financial reporting;
• the effectiveness of audit procedures is affected by the inherent limitations of internal control and by the use of testing;
• non-compliance may involve conduct designed to conceal it, such as collusion, forgery, deliberate failure to record transactions, senior management override of controls or intentional misrepresentations being made to the auditor.

18 In accordance with ASA 200 Objective and General Principles Governing an Audit of a Financial Report, the auditor shall plan and perform the audit with an attitude of professional scepticism recognising that the audit may reveal conditions or events that would lead to questioning whether an entity is complying with laws and regulations.

19 In accordance with specific statutory requirements, the auditor may be specifically required to report as part of the audit of the financial report whether the entity complies with certain provisions of laws or regulations. In these circumstances, the auditor would plan to test for compliance with these provisions of the laws and regulations.

20 In order to plan the audit, the auditor shall obtain a general understanding of the legal and regulatory framework applicable to the entity and the industry and how the entity is complying with that framework.

21 In obtaining this general understanding, the auditor would particularly recognise that some laws and regulations may give rise to business risks that have a fundamental effect on the operations of the entity. That is, non-compliance with certain laws and regulations may cause the entity to cease operations, or call into question the entity’s continuance as a going concern. For example, non-compliance with the requirements of the entity’s license or other title to perform its operations could have such an impact (for example, for a bank, non-compliance with capital or investment requirements). The categorisation outlined in Appendix 1 to this Auditing Standard provides further guidance to the auditor on understanding the legal and regulatory framework applicable to the entity and its industry.

• enquire of management concerning the entity’s policies and procedures regarding compliance with laws and regulations;
• enquire of management as to the laws or regulations that may be expected to have a fundamental effect on the operations of the entity;
• discuss with management the policies or procedures adopted for identifying, evaluating and accounting for litigation claims and assessments; and
• discuss the legal and regulatory framework with auditors of subsidiaries in other countries (for example, if the subsidiary is required to adhere to the securities regulations of the parent company).

23 After obtaining a general understanding, the auditor shall perform further audit procedures to help identify instances of non-compliance with those laws and regulations where non-compliance ought to have been considered when preparing the financial report, specifically:

24 Further, the auditor shall obtain sufficient appropriate audit evidence about compliance with those laws and regulations generally recognised by the auditor to have an effect on the determination of material amounts and disclosures in the financial report. The auditor shall have a sufficient understanding of these laws and regulations in order to consider them when auditing the assertions related to the determination of the amounts to be recorded and the disclosures to be made.

25 Such laws and regulations would be well established and known to the entity and within the industry; they would be considered on a recurring basis each time a financial report is issued. These laws and regulations, may relate, for example to:

26 Other than as described in paragraphs 23-25, the auditor does not perform other audit procedures on the entity’s compliance with laws and regulations since this would be outside the scope of an audit of a financial report.

27 The auditor shall be alert to the fact that audit procedures applied for the purpose of forming an opinion on the financial report may bring instances of possible non-compliance with laws and regulations to the auditor’s attention.

28 For example, such audit procedures include reading minutes; enquiring of the entity’s management and legal counsel concerning litigation, claims and assessments; and performing substantive tests of details of classes of transactions, account balances, or disclosures.

29 The auditor shall endeavour to obtain written representations that management has disclosed to the auditor all known actual or possible non-compliance with laws and regulations whose effects shall be considered when preparing the financial report.

30 In the absence of audit evidence to the contrary, the auditor is entitled to assume the entity is in compliance with these laws and regulations. In the event management is unable to or refuses to provide a written representation, under ASA 580 Management Representations, the auditor needs to consider the implications of the refusal for the auditor’s report.

31 Appendix 2 to this Auditing Standard sets out examples of the type of information that might come to the auditor’s attention that may indicate non-compliance.

32 When the auditor becomes aware of information concerning a possible instance of non-compliance, the auditor shall obtain an understanding of the nature of the act and the circumstances in which it has occurred, and sufficient other information to evaluate the possible effect on the financial report.

• the potential financial consequences, such as fines, penalties, damages, threat of expropriation of assets, enforced discontinuation of operations and litigation;
• whether the potential financial consequences are so serious as to call into question the true and fair view (fair presentation) given by the financial report.

34 When the auditor believes there may be non-compliance, the auditor shall document the findings and discuss them with management.

35 Documentation of findings would include copies of records and documents and making minutes of conversations, if appropriate.

36 If management does not provide satisfactory information that it is in fact in compliance, the auditor would ordinarily consult with the entity’s lawyers about the application of the laws and regulations to the circumstances and the possible effects on the financial report. When it is not considered appropriate to consult with the entity’s lawyers or when the auditor is not satisfied with the opinion, the auditor would ordinarily consider consulting the auditor’s own lawyers as to whether a violation of a law or regulation is involved, the possible legal consequences and what further action, if any, the auditor would take.

37 When adequate information about the suspected non-compliance cannot be obtained, the auditor shall consider the effect of the lack of sufficient appropriate audit evidence on the auditor’s report.

38 The auditor shall consider the implications of non-compliance in relation to other aspects of the audit, particularly the reliability of management representations.

39 In this regard, under paragraph 38 of this Auditing Standard, the auditor needs to reconsider the risk assessment and the validity of management representations, in case of non-compliance not detected by the entity’s internal controls or not included in management representations. The implications of particular instances of non-compliance discovered by the auditor will depend on the relationship of the perpetration and concealment, if any, of the act to specific control activities and the level of management or employees involved.

40 The auditor shall, as soon as practicable, either communicate with those charged with governance and management, or obtain audit evidence that they are appropriately informed, regarding non-compliance that comes to the auditor’s attention.

41 However, the auditor need not report matters that are clearly inconsequential or trivial and on which agreement may be reached in advance on the nature of such matters to be communicated.

42 If in the auditor’s judgement the non-compliance is believed to be intentional and material, the auditor shall communicate the finding without delay.

43 If the auditor suspects management is involved in non-compliance, the auditor shall report the matter to the next higher level of authority at the entity, if it exists, such as an audit committee or those charged with governance.

44 Where no higher authority exists, or if the auditor believes that the report may not be acted upon or is unsure as to the person to whom to report, the auditor would ordinarily consider seeking legal advice.

45 If the auditor concludes that the non-compliance has a material effect on the financial report, and has not been properly reflected in the financial report, the auditor shall express a qualified or an adverse opinion.

46 If the auditor is precluded by the entity from obtaining sufficient appropriate audit evidence to evaluate whether non-compliance that may be material to the financial report, has, or is likely to have, occurred, the auditor shall express a qualified opinion or a disclaimer of opinion on the financial report on the basis of a limitation on the scope of the audit.

47 If the auditor is unable to determine whether non-compliance has occurred because of limitations imposed by the circumstances rather than by the entity, the auditor shall consider the effect on the auditor’s report.

48 If, in the case of a company, the auditor is unable to obtain all the information and explanations considered necessary for the conduct of the audit as required by section 307(b) of the Corporations Act 2001 (the Act), the matter would be reported in accordance with subsection 308(3)(b) of the Act. The auditor also needs to consider any other relevant laws and regulations. If the auditor is in doubt as to the proper interpretation of laws or regulations, or whether the non-compliance has in fact occurred, the auditor would ordinarily seek legal advice before rendering an opinion on the financial report.

49 The auditor’s duty of confidentiality would ordinarily preclude reporting non-compliance to a third party without the express permission of the entity's management. This rule is followed unless there are compelling reasons to the contrary, for example:

(b) the auditor believes, on reasonable grounds, that members of the entity's governing body and/or employees have committed a serious criminal offence, and that any prior knowledge of the auditor's intentions enables them to evade the course of justice.

The auditor would ordinarily seek legal advice prior to reporting any matters concerning the entity's affairs to a third party to determine whether the auditor's duty of confidentiality will be overridden.

50 In many cases, the auditor is protected by qualified privilege if reporting matters in good faith and without malice to persons or authorities who have a proper interest in receiving the information. This protection varies according to the legislation under which the audit is performed. The auditor ordinarily assesses whether protection exists under the particular legislation governing the specific audit before claiming qualified privilege, and would ordinarily seek appropriate legal advice if in doubt. Where this protection exists, the auditor needs to have a reasonable belief concerning the occurrence of a fraud or non-compliance and would not ordinarily be held in breach of duty to the entity even if, an investigation or prosecution having occurred, it were found that there had been no offence.

51 Prior to reporting any non-compliance to a third party, the auditor ordinarily performs sufficient modified or additional audit procedures to verify the accuracy of the facts which are to be disclosed.

52 In certain circumstances, the auditor has a statutory responsibility to report non-compliances of which the auditor is aware, for example reporting contraventions of the Corporations Act 2001 to the ASIC under section 311 of that Act, as well as reporting offences under the State and Commonwealth Crime Legislation.[1] Establishing the appropriate authority to which a report would be made in a particular instance will depend on the nature and circumstances of the non-compliance. When in doubt, the auditor would ordinarily seek legal advice.

53 An auditor would ordinarily seek legal advice prior to disclosing any information, if approached by a person with a statutory right to demand the information sought, for example, police, taxation or customs officials, as part of enquiries which may lead to the prosecution of a client or former client. The auditor ordinarily establishes whether there would be a breach of the duty of confidentiality to the entity in making the disclosure. If the disclosure entails a breach of confidence, the auditor ordinarily declines to provide the information unless:

54 Where the auditor becomes aware of a non-compliance which, in the auditor's professional judgement, ought to be reported by the entity to the proper authority, the auditor would ordinarily bring the matter to the attention of the governing body requesting them to report to the proper authority. In the absence of evidence indicating that the governing body has taken appropriate action and there is no specific mandatory requirement to report the non-compliance to a third party, the auditor would ordinarily seek legal advice to determine whether the auditor's duty of confidentiality can be overridden by disclosure of the information to the proper authority.

55 In exceptional circumstances,[2] the auditor may conclude that withdrawal from the engagement (if possible) is necessary when the entity does not take the remedial action that the auditor ordinarily considers necessary in the circumstances, even when the non-compliance is not material to the financial report. Factors that would affect the auditor’s conclusion include the implications of the involvement of the highest authority within the entity which may affect the reliability of management representations, and the effects on the auditor of continuing association with the entity. In reaching such a conclusion, the auditor would ordinarily seek legal advice.

56 When the auditor receives an enquiry from the proposed auditor, pursuant to the relevant ethical requirements relating to the audit engagement, the existing auditor shall advise whether there are any professional reasons why the proposed auditor ought not to accept the appointment.

57 The extent to which an existing auditor can discuss the affairs of a client with a proposed auditor will depend on whether the client’s permission to do so has been obtained and/or the legal or ethical requirements that apply in each country relating to such disclosure. If there are any such reasons or other matters which need to be disclosed, the existing auditor would, taking account of the legal and ethical constraints, including where appropriate permission of the client, give details of the information and discuss freely with the proposed auditor all matters relevant to the appointment.

58 If permission from the client to discuss its affairs with the proposed auditor is denied by the client, that fact shall be disclosed to the proposed auditor.

59 Except as noted below, this Auditing Standard conforms with International Standard on Auditing ISA 250, Consideration of Laws and Regulations in an Audit of Financial Statements issued by the International Auditing and Assurance Standards Board of the International Federation of Accountants. The main differences between this Auditing Standard and ISA 250 are:

• This Auditing Standard provides in Appendix 1 a categorisation of regulatory requirements that may assist the auditor when obtaining an understanding of the legal and regulatory framework applicable to the entity (paragraph 21). ISA 250 does not incorporate comparable guidance.

• This Auditing Standard contains additional explanatory guidance, compared with ISA 250, on matters that the auditor considers when determining whether non-compliance ought to be reported to third parties or regulatory authorities (paragraphs 50-54).

  This Appendix provides an example of the categorisation that may be relevant when obtaining an understanding of the legal and regulatory framework applicable to the entity and the industry. The example incorporates the requirements of this Auditing Standard, but is not intended to provide a standard categorisation for understanding the legal and regulatory framework in all circumstances. The auditor needs to alter the categorisation as necessary for the categorisation of particular entities in particular industries. The following categorisation may be relevant when obtaining an understanding of the legal and regulatory framework applicable to the entity and the industry.

  Certain acts of non-compliance directly affect the form or content of an entity's financial report or contravene requirements with which the governing body must comply in the preparation of the financial report. An example is non-compliance with section 296 of the Corporations Act 2001 (the Law), which requires that a financial report for a financial year comply with Accounting Standards and any further requirements in the Law. The auditor ordinarily performs specific audit procedures designed to detect material misstatements arising as a result of such non-compliance acts.

  Certain acts of non-compliance may be expected to have a fundamental effect on the operations of an entity and thus could have financial consequences that are material to the financial report. Such an act could be a breach of a law or a licence or a similar entitlement to carry on a trade or practice which forms a major part of an entity's activities. The consequence of the breach may result in material liabilities or jeopardises the viability of that major part of the entity or affect the ability of the entity to continue to operate as a going concern. The auditor ordinarily assesses the risk of such acts of non-compliance resulting in a material misstatement in the financial report when planning the audit. The risk of material misstatements arising as a result of this category of non-compliance acts, and the extent to which the auditor needs to design procedures directed at detecting such non-compliance acts, will be affected by the environment in which the entity is operating and the nature of its operations. Certain acts of non-compliance are breaches of the many other laws or regulations by which any entity may be affected. Examples of these might include breaches of legislation governing occupational health and safety, environmental protection and equal employment opportunity. In the absence of a specific requirement of the audit mandate, it is not practical to consider all such legislation when planning and assessing audit risk, and the auditor is not expected to have a detailed knowledge of them beyond that which might be expected of a reasonable person. Where the auditor becomes aware of acts of non-compliance of this nature during the audit, consideration may be given to whether they have a material impact on the financial report, and additional audit procedures performed accordingly. The auditor also ordinarily considers any other implications of the non-compliance act, for example, any statutory reporting responsibilities. Some acts of non-compliance that may be unimportant to some entities, as they involve an immaterial part of their activities, may be very important to others. For example, environmental protection may be classified under “Fundamental Effect of Operations” for some entities such as those involved in the production of chemicals, but under “Other” for others, such as those in the retail trade.

The following are examples of indications that non-compliance may have occurred. While these examples incorporate the requirements of this Auditing Standard, the examples are not intended to be an exhaustive list of the types of information that indicate non-compliance to the auditor.

Examples of the type of information that may come to the auditor’s attention that may indicate that non-compliance with laws or regulations has occurred are listed below:

• sales commissions or agent’s fees that appear excessive in relation to those ordinarily paid by the entity or in its industry or to the services actually received;
• unusual payments in cash, purchases in the form of cashiers’ cheques payable to bearer or transfers to numbered bank accounts;
• existence of an accounting system which fails, whether by design or by accident, to provide an adequate audit trail or sufficient evidence;

Consideration of Laws and Regulations in Consideration of Laws and Regulations in an Audit of a Financial Report

(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with Part 2M.3 of the Corporations Act 2001; and

4 The purpose of this Auditing Standard is to establish mandatory requirements and to provide explanatory guidance on the auditor’s responsibility to consider laws and regulations in an audit of a financial report.

5 When designing and performing audit procedures and in evaluating and reporting the results thereof, the auditor shall recognise that non-compliance by the entity with laws and regulations may materially affect the financial report.

6 However, an audit cannot be expected to detect non-compliance with all laws and regulations. Detection of non-compliance, regardless of materiality, requires consideration of the implications for the integrity of management or other employees and the possible effect on other aspects of the audit.

7 The term “non-compliance” as used in this Auditing Standard refers to acts of omission or commission by the entity being audited, either intentional or unintentional, which are contrary to the prevailing laws or regulations. Such acts include transactions entered into by, or in the name of, the entity or on its behalf by its management or employees. For the purpose of this Auditing Standard, non-compliance does not include personal misconduct (unrelated to the business activities of the entity) by the entity’s management or employees.

8 Whether an act constitutes non-compliance is a legal determination that is ordinarily beyond the auditor’s professional competence. The auditor’s training, experience and understanding of the entity and its industry may provide a basis for recognition that some acts coming to the auditor’s attention may constitute non-compliance with laws and regulations. The determination as to whether a particular act constitutes or is likely to constitute non-compliance is generally based on the advice of an informed expert qualified to practice law but ultimately can only be determined by a court of law.

9 Laws and regulations vary considerably in their relation to the financial report. Some laws or regulations determine the form or content of an entity’s financial report or the amounts to be recorded or disclosures to be made in the financial report. Other laws or regulations are to be complied with by management or set the provisions under which the entity is allowed to conduct its business. Some entities operate in heavily regulated industries (such as banks and chemical companies). Others are only subject to the many laws and regulations that generally relate to the operating aspects of the business (such as those relating to occupational health and safety and equal employment opportunity). Non-compliance with laws and regulations could result in financial consequences for the entity such as fines, litigation, etc. Generally, the further removed non-compliance is from the events and transactions ordinarily reflected in the financial report, the less likely the auditor is to become aware of it or to recognise its possible non-compliance.

10 Laws and regulations vary from country to country. National accounting and auditing standards are therefore likely to be more specific as to the relevance of laws and regulations to an audit.

11 This Auditing Standard applies to audits of financial reports and does not apply to other engagements in which the auditor is specifically engaged to test and report separately on compliance with specific laws or regulations.

12 Guidance on the auditor’s responsibility to consider fraud and error in an audit of a financial report is provided in Auditing Standard ASA 240 The Auditor’s Responsibility to Consider Fraud in an Audit of a Financial Report.

13 It is the responsibility of those charged with governance and management to ensure that the entity’s operations are conducted in accordance with all applicable laws and regulations. The responsibility for the prevention and detection of non-compliance rests with those charged with governance and management.

14 The following policies and procedures, among others, may assist management in discharging its responsibilities for the prevention and detection of non-compliance:

• monitoring compliance with the code of conduct and acting appropriately to discipline employees who fail to comply with it;
• maintaining a register of significant laws with which the entity has to comply within its particular industry and a record of complaints.

15 In larger entities, these policies and procedures may be supplemented by assigning appropriate responsibilities to the following:

16 The auditor is not, and cannot be held responsible for preventing non-compliance with laws and regulations. The fact that an annual audit is carried out may, however, act as a deterrent to any non-compliance.

17 An audit is subject to the unavoidable risk that some material misstatements in the financial report will not be detected, even though the audit is properly planned and performed in accordance with Auditing Standards. This risk is higher with regard to material misstatements resulting from non-compliance with laws and regulations due to factors such as the following:

• there are many laws and regulations, relating principally to the operating aspects of the entity, that typically do not have a material effect on the financial report and are not captured by the entity’s information systems relevant to financial reporting;
• the effectiveness of audit procedures is affected by the inherent limitations of internal control and by the use of testing;
• non-compliance may involve conduct designed to conceal it, such as collusion, forgery, deliberate failure to record transactions, senior management override of controls or intentional misrepresentations being made to the auditor.

18 In accordance with ASA 200 Objective and General Principles Governing an Audit of a Financial Report, the auditor shall plan and perform the audit with an attitude of professional scepticism recognising that the audit may reveal conditions or events that would lead to questioning whether an entity is complying with laws and regulations.

19 In accordance with specific statutory requirements, the auditor may be specifically required to report as part of the audit of the financial report whether the entity complies with certain provisions of laws or regulations. In these circumstances, the auditor would plan to test for compliance with these provisions of the laws and regulations.

20 In order to plan the audit, the auditor shall obtain a general understanding of the legal and regulatory framework applicable to the entity and the industry and how the entity is complying with that framework.

21 In obtaining this general understanding, the auditor would particularly recognise that some laws and regulations may give rise to business risks that have a fundamental effect on the operations of the entity. That is, non-compliance with certain laws and regulations may cause the entity to cease operations, or call into question the entity’s continuance as a going concern. For example, non-compliance with the requirements of the entity’s license or other title to perform its operations could have such an impact (for example, for a bank, non-compliance with capital or investment requirements). The categorisation outlined in Appendix 1 to this Auditing Standard provides further guidance to the auditor on understanding the legal and regulatory framework applicable to the entity and its industry.

• enquire of management concerning the entity’s policies and procedures regarding compliance with laws and regulations;
• enquire of management as to the laws or regulations that may be expected to have a fundamental effect on the operations of the entity;
• discuss with management the policies or procedures adopted for identifying, evaluating and accounting for litigation claims and assessments; and
• discuss the legal and regulatory framework with auditors of subsidiaries in other countries (for example, if the subsidiary is required to adhere to the securities regulations of the parent company).

23 After obtaining a general understanding, the auditor shall perform further audit procedures to help identify instances of non-compliance with those laws and regulations where non-compliance ought to have been considered when preparing the financial report, specifically:

24 Further, the auditor shall obtain sufficient appropriate audit evidence about compliance with those laws and regulations generally recognised by the auditor to have an effect on the determination of material amounts and disclosures in the financial report. The auditor shall have a sufficient understanding of these laws and regulations in order to consider them when auditing the assertions related to the determination of the amounts to be recorded and the disclosures to be made.

25 Such laws and regulations would be well established and known to the entity and within the industry; they would be considered on a recurring basis each time a financial report is issued. These laws and regulations, may relate, for example to:

26 Other than as described in paragraphs 23-25, the auditor does not perform other audit procedures on the entity’s compliance with laws and regulations since this would be outside the scope of an audit of a financial report.

27 The auditor shall be alert to the fact that audit procedures applied for the purpose of forming an opinion on the financial report may bring instances of possible non-compliance with laws and regulations to the auditor’s attention.

28 For example, such audit procedures include reading minutes; enquiring of the entity’s management and legal counsel concerning litigation, claims and assessments; and performing substantive tests of details of classes of transactions, account balances, or disclosures.

29 The auditor shall endeavour to obtain written representations that management has disclosed to the auditor all known actual or possible non-compliance with laws and regulations whose effects shall be considered when preparing the financial report.

30 In the absence of audit evidence to the contrary, the auditor is entitled to assume the entity is in compliance with these laws and regulations. In the event management is unable to or refuses to provide a written representation, under ASA 580 Management Representations, the auditor needs to consider the implications of the refusal for the auditor’s report.

31 Appendix 2 to this Auditing Standard sets out examples of the type of information that might come to the auditor’s attention that may indicate non-compliance.

32 When the auditor becomes aware of information concerning a possible instance of non-compliance, the auditor shall obtain an understanding of the nature of the act and the circumstances in which it has occurred, and sufficient other information to evaluate the possible effect on the financial report.

• the potential financial consequences, such as fines, penalties, damages, threat of expropriation of assets, enforced discontinuation of operations and litigation;
• whether the potential financial consequences are so serious as to call into question the true and fair view (fair presentation) given by the financial report.

34 When the auditor believes there may be non-compliance, the auditor shall document the findings and discuss them with management.

35 Documentation of findings would include copies of records and documents and making minutes of conversations, if appropriate.

36 If management does not provide satisfactory information that it is in fact in compliance, the auditor would ordinarily consult with the entity’s lawyers about the application of the laws and regulations to the circumstances and the possible effects on the financial report. When it is not considered appropriate to consult with the entity’s lawyers or when the auditor is not satisfied with the opinion, the auditor would ordinarily consider consulting the auditor’s own lawyers as to whether a violation of a law or regulation is involved, the possible legal consequences and what further action, if any, the auditor would take.

37 When adequate information about the suspected non-compliance cannot be obtained, the auditor shall consider the effect of the lack of sufficient appropriate audit evidence on the auditor’s report.

38 The auditor shall consider the implications of non-compliance in relation to other aspects of the audit, particularly the reliability of management representations.

39 In this regard, under paragraph 38 of this Auditing Standard, the auditor needs to reconsider the risk assessment and the validity of management representations, in case of non-compliance not detected by the entity’s internal controls or not included in management representations. The implications of particular instances of non-compliance discovered by the auditor will depend on the relationship of the perpetration and concealment, if any, of the act to specific control activities and the level of management or employees involved.

40 The auditor shall, as soon as practicable, either communicate with those charged with governance and management, or obtain audit evidence that they are appropriately informed, regarding non-compliance that comes to the auditor’s attention.

41 However, the auditor need not report matters that are clearly inconsequential or trivial and on which agreement may be reached in advance on the nature of such matters to be communicated.

42 If in the auditor’s judgement the non-compliance is believed to be intentional and material, the auditor shall communicate the finding without delay.

43 If the auditor suspects management is involved in non-compliance, the auditor shall report the matter to the next higher level of authority at the entity, if it exists, such as an audit committee or those charged with governance.

44 Where no higher authority exists, or if the auditor believes that the report may not be acted upon or is unsure as to the person to whom to report, the auditor would ordinarily consider seeking legal advice.

45 If the auditor concludes that the non-compliance has a material effect on the financial report, and has not been properly reflected in the financial report, the auditor shall express a qualified or an adverse opinion.

46 If the auditor is precluded by the entity from obtaining sufficient appropriate audit evidence to evaluate whether non-compliance that may be material to the financial report, has, or is likely to have, occurred, the auditor shall express a qualified opinion or a disclaimer of opinion on the financial report on the basis of a limitation on the scope of the audit.

47 If the auditor is unable to determine whether non-compliance has occurred because of limitations imposed by the circumstances rather than by the entity, the auditor shall consider the effect on the auditor’s report.

48 If, in the case of a company, the auditor is unable to obtain all the information and explanations considered necessary for the conduct of the audit as required by section 307(b) of the Corporations Act 2001 (the Act), the matter would be reported in accordance with subsection 308(3)(b) of the Act. The auditor also needs to consider any other relevant laws and regulations. If the auditor is in doubt as to the proper interpretation of laws or regulations, or whether the non-compliance has in fact occurred, the auditor would ordinarily seek legal advice before rendering an opinion on the financial report.

49 The auditor’s duty of confidentiality would ordinarily preclude reporting non-compliance to a third party without the express permission of the entity's management. This rule is followed unless there are compelling reasons to the contrary, for example:

(b) the auditor believes, on reasonable grounds, that members of the entity's governing body and/or employees have committed a serious criminal offence, and that any prior knowledge of the auditor's intentions enables them to evade the course of justice.

The auditor would ordinarily seek legal advice prior to reporting any matters concerning the entity's affairs to a third party to determine whether the auditor's duty of confidentiality will be overridden.

50 In many cases, the auditor is protected by qualified privilege if reporting matters in good faith and without malice to persons or authorities who have a proper interest in receiving the information. This protection varies according to the legislation under which the audit is performed. The auditor ordinarily assesses whether protection exists under the particular legislation governing the specific audit before claiming qualified privilege, and would ordinarily seek appropriate legal advice if in doubt. Where this protection exists, the auditor needs to have a reasonable belief concerning the occurrence of a fraud or non-compliance and would not ordinarily be held in breach of duty to the entity even if, an investigation or prosecution having occurred, it were found that there had been no offence.

51 Prior to reporting any non-compliance to a third party, the auditor ordinarily performs sufficient modified or additional audit procedures to verify the accuracy of the facts which are to be disclosed.

52 In certain circumstances, the auditor has a statutory responsibility to report non-compliances of which the auditor is aware, for example reporting contraventions of the Corporations Act 2001 to the ASIC under section 311 of that Act, as well as reporting offences under the State and Commonwealth Crime Legislation.[1] Establishing the appropriate authority to which a report would be made in a particular instance will depend on the nature and circumstances of the non-compliance. When in doubt, the auditor would ordinarily seek legal advice.

53 An auditor would ordinarily seek legal advice prior to disclosing any information, if approached by a person with a statutory right to demand the information sought, for example, police, taxation or customs officials, as part of enquiries which may lead to the prosecution of a client or former client. The auditor ordinarily establishes whether there would be a breach of the duty of confidentiality to the entity in making the disclosure. If the disclosure entails a breach of confidence, the auditor ordinarily declines to provide the information unless:

54 Where the auditor becomes aware of a non-compliance which, in the auditor's professional judgement, ought to be reported by the entity to the proper authority, the auditor would ordinarily bring the matter to the attention of the governing body requesting them to report to the proper authority. In the absence of evidence indicating that the governing body has taken appropriate action and there is no specific mandatory requirement to report the non-compliance to a third party, the auditor would ordinarily seek legal advice to determine whether the auditor's duty of confidentiality can be overridden by disclosure of the information to the proper authority.

55 In exceptional circumstances,[2] the auditor may conclude that withdrawal from the engagement (if possible) is necessary when the entity does not take the remedial action that the auditor ordinarily considers necessary in the circumstances, even when the non-compliance is not material to the financial report. Factors that would affect the auditor’s conclusion include the implications of the involvement of the highest authority within the entity which may affect the reliability of management representations, and the effects on the auditor of continuing association with the entity. In reaching such a conclusion, the auditor would ordinarily seek legal advice.

56 When the auditor receives an enquiry from the proposed auditor, pursuant to the relevant ethical requirements relating to the audit engagement, the existing auditor shall advise whether there are any professional reasons why the proposed auditor ought not to accept the appointment.

57 The extent to which an existing auditor can discuss the affairs of a client with a proposed auditor will depend on whether the client’s permission to do so has been obtained and/or the legal or ethical requirements that apply in each country relating to such disclosure. If there are any such reasons or other matters which need to be disclosed, the existing auditor would, taking account of the legal and ethical constraints, including where appropriate permission of the client, give details of the information and discuss freely with the proposed auditor all matters relevant to the appointment.

58 If permission from the client to discuss its affairs with the proposed auditor is denied by the client, that fact shall be disclosed to the proposed auditor.

59 Except as noted below, this Auditing Standard conforms with International Standard on Auditing ISA 250, Consideration of Laws and Regulations in an Audit of Financial Statements issued by the International Auditing and Assurance Standards Board of the International Federation of Accountants. The main differences between this Auditing Standard and ISA 250 are:

• This Auditing Standard provides in Appendix 1 a categorisation of regulatory requirements that may assist the auditor when obtaining an understanding of the legal and regulatory framework applicable to the entity (paragraph 21). ISA 250 does not incorporate comparable guidance.

• This Auditing Standard contains additional explanatory guidance, compared with ISA 250, on matters that the auditor considers when determining whether non-compliance ought to be reported to third parties or regulatory authorities (paragraphs 50-54).

  This Appendix provides an example of the categorisation that may be relevant when obtaining an understanding of the legal and regulatory framework applicable to the entity and the industry. The example incorporates the requirements of this Auditing Standard, but is not intended to provide a standard categorisation for understanding the legal and regulatory framework in all circumstances. The auditor needs to alter the categorisation as necessary for the categorisation of particular entities in particular industries. The following categorisation may be relevant when obtaining an understanding of the legal and regulatory framework applicable to the entity and the industry.

  Certain acts of non-compliance directly affect the form or content of an entity's financial report or contravene requirements with which the governing body must comply in the preparation of the financial report. An example is non-compliance with section 296 of the Corporations Act 2001 (the Law), which requires that a financial report for a financial year comply with Accounting Standards and any further requirements in the Law. The auditor ordinarily performs specific audit procedures designed to detect material misstatements arising as a result of such non-compliance acts.

  Certain acts of non-compliance may be expected to have a fundamental effect on the operations of an entity and thus could have financial consequences that are material to the financial report. Such an act could be a breach of a law or a licence or a similar entitlement to carry on a trade or practice which forms a major part of an entity's activities. The consequence of the breach may result in material liabilities or jeopardises the viability of that major part of the entity or affect the ability of the entity to continue to operate as a going concern. The auditor ordinarily assesses the risk of such acts of non-compliance resulting in a material misstatement in the financial report when planning the audit. The risk of material misstatements arising as a result of this category of non-compliance acts, and the extent to which the auditor needs to design procedures directed at detecting such non-compliance acts, will be affected by the environment in which the entity is operating and the nature of its operations. Certain acts of non-compliance are breaches of the many other laws or regulations by which any entity may be affected. Examples of these might include breaches of legislation governing occupational health and safety, environmental protection and equal employment opportunity. In the absence of a specific requirement of the audit mandate, it is not practical to consider all such legislation when planning and assessing audit risk, and the auditor is not expected to have a detailed knowledge of them beyond that which might be expected of a reasonable person. Where the auditor becomes aware of acts of non-compliance of this nature during the audit, consideration may be given to whether they have a material impact on the financial report, and additional audit procedures performed accordingly. The auditor also ordinarily considers any other implications of the non-compliance act, for example, any statutory reporting responsibilities. Some acts of non-compliance that may be unimportant to some entities, as they involve an immaterial part of their activities, may be very important to others. For example, environmental protection may be classified under “Fundamental Effect of Operations” for some entities such as those involved in the production of chemicals, but under “Other” for others, such as those in the retail trade.

The following are examples of indications that non-compliance may have occurred. While these examples incorporate the requirements of this Auditing Standard, the examples are not intended to be an exhaustive list of the types of information that indicate non-compliance to the auditor.

Examples of the type of information that may come to the auditor’s attention that may indicate that non-compliance with laws or regulations has occurred are listed below:

• sales commissions or agent’s fees that appear excessive in relation to those ordinarily paid by the entity or in its industry or to the services actually received;
• unusual payments in cash, purchases in the form of cashiers’ cheques payable to bearer or transfers to numbered bank accounts;
• existence of an accounting system which fails, whether by design or by accident, to provide an adequate audit trail or sufficient evidence;

Application Application

(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with Part 2M.3 of the Corporations Act 2001; and

Operative Date Operative Date

Introduction Introduction

4 The purpose of this Auditing Standard is to establish mandatory requirements and to provide explanatory guidance on the auditor’s responsibility to consider laws and regulations in an audit of a financial report.

5 When designing and performing audit procedures and in evaluating and reporting the results thereof, the auditor shall recognise that non-compliance by the entity with laws and regulations may materially affect the financial report.

6 However, an audit cannot be expected to detect non-compliance with all laws and regulations. Detection of non-compliance, regardless of materiality, requires consideration of the implications for the integrity of management or other employees and the possible effect on other aspects of the audit.

7 The term “non-compliance” as used in this Auditing Standard refers to acts of omission or commission by the entity being audited, either intentional or unintentional, which are contrary to the prevailing laws or regulations. Such acts include transactions entered into by, or in the name of, the entity or on its behalf by its management or employees. For the purpose of this Auditing Standard, non-compliance does not include personal misconduct (unrelated to the business activities of the entity) by the entity’s management or employees.

8 Whether an act constitutes non-compliance is a legal determination that is ordinarily beyond the auditor’s professional competence. The auditor’s training, experience and understanding of the entity and its industry may provide a basis for recognition that some acts coming to the auditor’s attention may constitute non-compliance with laws and regulations. The determination as to whether a particular act constitutes or is likely to constitute non-compliance is generally based on the advice of an informed expert qualified to practice law but ultimately can only be determined by a court of law.

9 Laws and regulations vary considerably in their relation to the financial report. Some laws or regulations determine the form or content of an entity’s financial report or the amounts to be recorded or disclosures to be made in the financial report. Other laws or regulations are to be complied with by management or set the provisions under which the entity is allowed to conduct its business. Some entities operate in heavily regulated industries (such as banks and chemical companies). Others are only subject to the many laws and regulations that generally relate to the operating aspects of the business (such as those relating to occupational health and safety and equal employment opportunity). Non-compliance with laws and regulations could result in financial consequences for the entity such as fines, litigation, etc. Generally, the further removed non-compliance is from the events and transactions ordinarily reflected in the financial report, the less likely the auditor is to become aware of it or to recognise its possible non-compliance.

10 Laws and regulations vary from country to country. National accounting and auditing standards are therefore likely to be more specific as to the relevance of laws and regulations to an audit.

11 This Auditing Standard applies to audits of financial reports and does not apply to other engagements in which the auditor is specifically engaged to test and report separately on compliance with specific laws or regulations.

12 Guidance on the auditor’s responsibility to consider fraud and error in an audit of a financial report is provided in Auditing Standard ASA 240 The Auditor’s Responsibility to Consider Fraud in an Audit of a Financial Report.

Responsibility of Management for the Com Responsibility of Management for the Compliance with Laws and Regulations

13 It is the responsibility of those charged with governance and management to ensure that the entity’s operations are conducted in accordance with all applicable laws and regulations. The responsibility for the prevention and detection of non-compliance rests with those charged with governance and management.

14 The following policies and procedures, among others, may assist management in discharging its responsibilities for the prevention and detection of non-compliance:

• monitoring compliance with the code of conduct and acting appropriately to discipline employees who fail to comply with it;
• maintaining a register of significant laws with which the entity has to comply within its particular industry and a record of complaints.

15 In larger entities, these policies and procedures may be supplemented by assigning appropriate responsibilities to the following:

The Auditor’s Consideration of Complianc The Auditor’s Consideration of Compliance with Laws and Regulations

16 The auditor is not, and cannot be held responsible for preventing non-compliance with laws and regulations. The fact that an annual audit is carried out may, however, act as a deterrent to any non-compliance.

17 An audit is subject to the unavoidable risk that some material misstatements in the financial report will not be detected, even though the audit is properly planned and performed in accordance with Auditing Standards. This risk is higher with regard to material misstatements resulting from non-compliance with laws and regulations due to factors such as the following:

• there are many laws and regulations, relating principally to the operating aspects of the entity, that typically do not have a material effect on the financial report and are not captured by the entity’s information systems relevant to financial reporting;
• the effectiveness of audit procedures is affected by the inherent limitations of internal control and by the use of testing;
• non-compliance may involve conduct designed to conceal it, such as collusion, forgery, deliberate failure to record transactions, senior management override of controls or intentional misrepresentations being made to the auditor.

18 In accordance with ASA 200 Objective and General Principles Governing an Audit of a Financial Report, the auditor shall plan and perform the audit with an attitude of professional scepticism recognising that the audit may reveal conditions or events that would lead to questioning whether an entity is complying with laws and regulations.

19 In accordance with specific statutory requirements, the auditor may be specifically required to report as part of the audit of the financial report whether the entity complies with certain provisions of laws or regulations. In these circumstances, the auditor would plan to test for compliance with these provisions of the laws and regulations.

20 In order to plan the audit, the auditor shall obtain a general understanding of the legal and regulatory framework applicable to the entity and the industry and how the entity is complying with that framework.

21 In obtaining this general understanding, the auditor would particularly recognise that some laws and regulations may give rise to business risks that have a fundamental effect on the operations of the entity. That is, non-compliance with certain laws and regulations may cause the entity to cease operations, or call into question the entity’s continuance as a going concern. For example, non-compliance with the requirements of the entity’s license or other title to perform its operations could have such an impact (for example, for a bank, non-compliance with capital or investment requirements). The categorisation outlined in Appendix 1 to this Auditing Standard provides further guidance to the auditor on understanding the legal and regulatory framework applicable to the entity and its industry.

• enquire of management concerning the entity’s policies and procedures regarding compliance with laws and regulations;
• enquire of management as to the laws or regulations that may be expected to have a fundamental effect on the operations of the entity;
• discuss with management the policies or procedures adopted for identifying, evaluating and accounting for litigation claims and assessments; and
• discuss the legal and regulatory framework with auditors of subsidiaries in other countries (for example, if the subsidiary is required to adhere to the securities regulations of the parent company).

23 After obtaining a general understanding, the auditor shall perform further audit procedures to help identify instances of non-compliance with those laws and regulations where non-compliance ought to have been considered when preparing the financial report, specifically:

24 Further, the auditor shall obtain sufficient appropriate audit evidence about compliance with those laws and regulations generally recognised by the auditor to have an effect on the determination of material amounts and disclosures in the financial report. The auditor shall have a sufficient understanding of these laws and regulations in order to consider them when auditing the assertions related to the determination of the amounts to be recorded and the disclosures to be made.

25 Such laws and regulations would be well established and known to the entity and within the industry; they would be considered on a recurring basis each time a financial report is issued. These laws and regulations, may relate, for example to:

26 Other than as described in paragraphs 23-25, the auditor does not perform other audit procedures on the entity’s compliance with laws and regulations since this would be outside the scope of an audit of a financial report.

27 The auditor shall be alert to the fact that audit procedures applied for the purpose of forming an opinion on the financial report may bring instances of possible non-compliance with laws and regulations to the auditor’s attention.

28 For example, such audit procedures include reading minutes; enquiring of the entity’s management and legal counsel concerning litigation, claims and assessments; and performing substantive tests of details of classes of transactions, account balances, or disclosures.

29 The auditor shall endeavour to obtain written representations that management has disclosed to the auditor all known actual or possible non-compliance with laws and regulations whose effects shall be considered when preparing the financial report.

30 In the absence of audit evidence to the contrary, the auditor is entitled to assume the entity is in compliance with these laws and regulations. In the event management is unable to or refuses to provide a written representation, under ASA 580 Management Representations, the auditor needs to consider the implications of the refusal for the auditor’s report.

31 Appendix 2 to this Auditing Standard sets out examples of the type of information that might come to the auditor’s attention that may indicate non-compliance.

32 When the auditor becomes aware of information concerning a possible instance of non-compliance, the auditor shall obtain an understanding of the nature of the act and the circumstances in which it has occurred, and sufficient other information to evaluate the possible effect on the financial report.

• the potential financial consequences, such as fines, penalties, damages, threat of expropriation of assets, enforced discontinuation of operations and litigation;
• whether the potential financial consequences are so serious as to call into question the true and fair view (fair presentation) given by the financial report.

34 When the auditor believes there may be non-compliance, the auditor shall document the findings and discuss them with management.

35 Documentation of findings would include copies of records and documents and making minutes of conversations, if appropriate.

36 If management does not provide satisfactory information that it is in fact in compliance, the auditor would ordinarily consult with the entity’s lawyers about the application of the laws and regulations to the circumstances and the possible effects on the financial report. When it is not considered appropriate to consult with the entity’s lawyers or when the auditor is not satisfied with the opinion, the auditor would ordinarily consider consulting the auditor’s own lawyers as to whether a violation of a law or regulation is involved, the possible legal consequences and what further action, if any, the auditor would take.

37 When adequate information about the suspected non-compliance cannot be obtained, the auditor shall consider the effect of the lack of sufficient appropriate audit evidence on the auditor’s report.

38 The auditor shall consider the implications of non-compliance in relation to other aspects of the audit, particularly the reliability of management representations.

39 In this regard, under paragraph 38 of this Auditing Standard, the auditor needs to reconsider the risk assessment and the validity of management representations, in case of non-compliance not detected by the entity’s internal controls or not included in management representations. The implications of particular instances of non-compliance discovered by the auditor will depend on the relationship of the perpetration and concealment, if any, of the act to specific control activities and the level of management or employees involved.

Reporting of Non-compliance Reporting of Non-compliance

40 The auditor shall, as soon as practicable, either communicate with those charged with governance and management, or obtain audit evidence that they are appropriately informed, regarding non-compliance that comes to the auditor’s attention.

41 However, the auditor need not report matters that are clearly inconsequential or trivial and on which agreement may be reached in advance on the nature of such matters to be communicated.

42 If in the auditor’s judgement the non-compliance is believed to be intentional and material, the auditor shall communicate the finding without delay.

43 If the auditor suspects management is involved in non-compliance, the auditor shall report the matter to the next higher level of authority at the entity, if it exists, such as an audit committee or those charged with governance.

44 Where no higher authority exists, or if the auditor believes that the report may not be acted upon or is unsure as to the person to whom to report, the auditor would ordinarily consider seeking legal advice.

45 If the auditor concludes that the non-compliance has a material effect on the financial report, and has not been properly reflected in the financial report, the auditor shall express a qualified or an adverse opinion.

46 If the auditor is precluded by the entity from obtaining sufficient appropriate audit evidence to evaluate whether non-compliance that may be material to the financial report, has, or is likely to have, occurred, the auditor shall express a qualified opinion or a disclaimer of opinion on the financial report on the basis of a limitation on the scope of the audit.

47 If the auditor is unable to determine whether non-compliance has occurred because of limitations imposed by the circumstances rather than by the entity, the auditor shall consider the effect on the auditor’s report.

48 If, in the case of a company, the auditor is unable to obtain all the information and explanations considered necessary for the conduct of the audit as required by section 307(b) of the Corporations Act 2001 (the Act), the matter would be reported in accordance with subsection 308(3)(b) of the Act. The auditor also needs to consider any other relevant laws and regulations. If the auditor is in doubt as to the proper interpretation of laws or regulations, or whether the non-compliance has in fact occurred, the auditor would ordinarily seek legal advice before rendering an opinion on the financial report.

49 The auditor’s duty of confidentiality would ordinarily preclude reporting non-compliance to a third party without the express permission of the entity's management. This rule is followed unless there are compelling reasons to the contrary, for example:

(b) the auditor believes, on reasonable grounds, that members of the entity's governing body and/or employees have committed a serious criminal offence, and that any prior knowledge of the auditor's intentions enables them to evade the course of justice.

The auditor would ordinarily seek legal advice prior to reporting any matters concerning the entity's affairs to a third party to determine whether the auditor's duty of confidentiality will be overridden.

50 In many cases, the auditor is protected by qualified privilege if reporting matters in good faith and without malice to persons or authorities who have a proper interest in receiving the information. This protection varies according to the legislation under which the audit is performed. The auditor ordinarily assesses whether protection exists under the particular legislation governing the specific audit before claiming qualified privilege, and would ordinarily seek appropriate legal advice if in doubt. Where this protection exists, the auditor needs to have a reasonable belief concerning the occurrence of a fraud or non-compliance and would not ordinarily be held in breach of duty to the entity even if, an investigation or prosecution having occurred, it were found that there had been no offence.

51 Prior to reporting any non-compliance to a third party, the auditor ordinarily performs sufficient modified or additional audit procedures to verify the accuracy of the facts which are to be disclosed.

Statutory Reporting Responsibilities Statutory Reporting Responsibilities

52 In certain circumstances, the auditor has a statutory responsibility to report non-compliances of which the auditor is aware, for example reporting contraventions of the Corporations Act 2001 to the ASIC under section 311 of that Act, as well as reporting offences under the State and Commonwealth Crime Legislation.[1] Establishing the appropriate authority to which a report would be made in a particular instance will depend on the nature and circumstances of the non-compliance. When in doubt, the auditor would ordinarily seek legal advice.

53 An auditor would ordinarily seek legal advice prior to disclosing any information, if approached by a person with a statutory right to demand the information sought, for example, police, taxation or customs officials, as part of enquiries which may lead to the prosecution of a client or former client. The auditor ordinarily establishes whether there would be a breach of the duty of confidentiality to the entity in making the disclosure. If the disclosure entails a breach of confidence, the auditor ordinarily declines to provide the information unless:

Other Reporting Responsibilities Other Reporting Responsibilities

54 Where the auditor becomes aware of a non-compliance which, in the auditor's professional judgement, ought to be reported by the entity to the proper authority, the auditor would ordinarily bring the matter to the attention of the governing body requesting them to report to the proper authority. In the absence of evidence indicating that the governing body has taken appropriate action and there is no specific mandatory requirement to report the non-compliance to a third party, the auditor would ordinarily seek legal advice to determine whether the auditor's duty of confidentiality can be overridden by disclosure of the information to the proper authority.

Auditor Unable to Complete the Engagemen Auditor Unable to Complete the Engagement

55 In exceptional circumstances,[2] the auditor may conclude that withdrawal from the engagement (if possible) is necessary when the entity does not take the remedial action that the auditor ordinarily considers necessary in the circumstances, even when the non-compliance is not material to the financial report. Factors that would affect the auditor’s conclusion include the implications of the involvement of the highest authority within the entity which may affect the reliability of management representations, and the effects on the auditor of continuing association with the entity. In reaching such a conclusion, the auditor would ordinarily seek legal advice.

56 When the auditor receives an enquiry from the proposed auditor, pursuant to the relevant ethical requirements relating to the audit engagement, the existing auditor shall advise whether there are any professional reasons why the proposed auditor ought not to accept the appointment.

57 The extent to which an existing auditor can discuss the affairs of a client with a proposed auditor will depend on whether the client’s permission to do so has been obtained and/or the legal or ethical requirements that apply in each country relating to such disclosure. If there are any such reasons or other matters which need to be disclosed, the existing auditor would, taking account of the legal and ethical constraints, including where appropriate permission of the client, give details of the information and discuss freely with the proposed auditor all matters relevant to the appointment.

58 If permission from the client to discuss its affairs with the proposed auditor is denied by the client, that fact shall be disclosed to the proposed auditor.

Conformity with International Standards Conformity with International Standards on Auditing

59 Except as noted below, this Auditing Standard conforms with International Standard on Auditing ISA 250, Consideration of Laws and Regulations in an Audit of Financial Statements issued by the International Auditing and Assurance Standards Board of the International Federation of Accountants. The main differences between this Auditing Standard and ISA 250 are:

• This Auditing Standard provides in Appendix 1 a categorisation of regulatory requirements that may assist the auditor when obtaining an understanding of the legal and regulatory framework applicable to the entity (paragraph 21). ISA 250 does not incorporate comparable guidance.
• This Auditing Standard contains additional explanatory guidance, compared with ISA 250, on matters that the auditor considers when determining whether non-compliance ought to be reported to third parties or regulatory authorities (paragraphs 50-54).

APPENDIX 1 APPENDIX 1

(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with Part 2M.3 of the Corporations Act 2001; and

4 The purpose of this Auditing Standard is to establish mandatory requirements and to provide explanatory guidance on the auditor’s responsibility to consider laws and regulations in an audit of a financial report.

5 When designing and performing audit procedures and in evaluating and reporting the results thereof, the auditor shall recognise that non-compliance by the entity with laws and regulations may materially affect the financial report.

6 However, an audit cannot be expected to detect non-compliance with all laws and regulations. Detection of non-compliance, regardless of materiality, requires consideration of the implications for the integrity of management or other employees and the possible effect on other aspects of the audit.

7 The term “non-compliance” as used in this Auditing Standard refers to acts of omission or commission by the entity being audited, either intentional or unintentional, which are contrary to the prevailing laws or regulations. Such acts include transactions entered into by, or in the name of, the entity or on its behalf by its management or employees. For the purpose of this Auditing Standard, non-compliance does not include personal misconduct (unrelated to the business activities of the entity) by the entity’s management or employees.

8 Whether an act constitutes non-compliance is a legal determination that is ordinarily beyond the auditor’s professional competence. The auditor’s training, experience and understanding of the entity and its industry may provide a basis for recognition that some acts coming to the auditor’s attention may constitute non-compliance with laws and regulations. The determination as to whether a particular act constitutes or is likely to constitute non-compliance is generally based on the advice of an informed expert qualified to practice law but ultimately can only be determined by a court of law.

9 Laws and regulations vary considerably in their relation to the financial report. Some laws or regulations determine the form or content of an entity’s financial report or the amounts to be recorded or disclosures to be made in the financial report. Other laws or regulations are to be complied with by management or set the provisions under which the entity is allowed to conduct its business. Some entities operate in heavily regulated industries (such as banks and chemical companies). Others are only subject to the many laws and regulations that generally relate to the operating aspects of the business (such as those relating to occupational health and safety and equal employment opportunity). Non-compliance with laws and regulations could result in financial consequences for the entity such as fines, litigation, etc. Generally, the further removed non-compliance is from the events and transactions ordinarily reflected in the financial report, the less likely the auditor is to become aware of it or to recognise its possible non-compliance.

10 Laws and regulations vary from country to country. National accounting and auditing standards are therefore likely to be more specific as to the relevance of laws and regulations to an audit.

11 This Auditing Standard applies to audits of financial reports and does not apply to other engagements in which the auditor is specifically engaged to test and report separately on compliance with specific laws or regulations.

12 Guidance on the auditor’s responsibility to consider fraud and error in an audit of a financial report is provided in Auditing Standard ASA 240 The Auditor’s Responsibility to Consider Fraud in an Audit of a Financial Report.

13 It is the responsibility of those charged with governance and management to ensure that the entity’s operations are conducted in accordance with all applicable laws and regulations. The responsibility for the prevention and detection of non-compliance rests with those charged with governance and management.

14 The following policies and procedures, among others, may assist management in discharging its responsibilities for the prevention and detection of non-compliance:

• monitoring compliance with the code of conduct and acting appropriately to discipline employees who fail to comply with it;
• maintaining a register of significant laws with which the entity has to comply within its particular industry and a record of complaints.

15 In larger entities, these policies and procedures may be supplemented by assigning appropriate responsibilities to the following:

16 The auditor is not, and cannot be held responsible for preventing non-compliance with laws and regulations. The fact that an annual audit is carried out may, however, act as a deterrent to any non-compliance.

17 An audit is subject to the unavoidable risk that some material misstatements in the financial report will not be detected, even though the audit is properly planned and performed in accordance with Auditing Standards. This risk is higher with regard to material misstatements resulting from non-compliance with laws and regulations due to factors such as the following:

• there are many laws and regulations, relating principally to the operating aspects of the entity, that typically do not have a material effect on the financial report and are not captured by the entity’s information systems relevant to financial reporting;
• the effectiveness of audit procedures is affected by the inherent limitations of internal control and by the use of testing;
• non-compliance may involve conduct designed to conceal it, such as collusion, forgery, deliberate failure to record transactions, senior management override of controls or intentional misrepresentations being made to the auditor.

18 In accordance with ASA 200 Objective and General Principles Governing an Audit of a Financial Report, the auditor shall plan and perform the audit with an attitude of professional scepticism recognising that the audit may reveal conditions or events that would lead to questioning whether an entity is complying with laws and regulations.

19 In accordance with specific statutory requirements, the auditor may be specifically required to report as part of the audit of the financial report whether the entity complies with certain provisions of laws or regulations. In these circumstances, the auditor would plan to test for compliance with these provisions of the laws and regulations.

20 In order to plan the audit, the auditor shall obtain a general understanding of the legal and regulatory framework applicable to the entity and the industry and how the entity is complying with that framework.

21 In obtaining this general understanding, the auditor would particularly recognise that some laws and regulations may give rise to business risks that have a fundamental effect on the operations of the entity. That is, non-compliance with certain laws and regulations may cause the entity to cease operations, or call into question the entity’s continuance as a going concern. For example, non-compliance with the requirements of the entity’s license or other title to perform its operations could have such an impact (for example, for a bank, non-compliance with capital or investment requirements). The categorisation outlined in Appendix 1 to this Auditing Standard provides further guidance to the auditor on understanding the legal and regulatory framework applicable to the entity and its industry.

• enquire of management concerning the entity’s policies and procedures regarding compliance with laws and regulations;
• enquire of management as to the laws or regulations that may be expected to have a fundamental effect on the operations of the entity;
• discuss with management the policies or procedures adopted for identifying, evaluating and accounting for litigation claims and assessments; and
• discuss the legal and regulatory framework with auditors of subsidiaries in other countries (for example, if the subsidiary is required to adhere to the securities regulations of the parent company).

23 After obtaining a general understanding, the auditor shall perform further audit procedures to help identify instances of non-compliance with those laws and regulations where non-compliance ought to have been considered when preparing the financial report, specifically:

24 Further, the auditor shall obtain sufficient appropriate audit evidence about compliance with those laws and regulations generally recognised by the auditor to have an effect on the determination of material amounts and disclosures in the financial report. The auditor shall have a sufficient understanding of these laws and regulations in order to consider them when auditing the assertions related to the determination of the amounts to be recorded and the disclosures to be made.

25 Such laws and regulations would be well established and known to the entity and within the industry; they would be considered on a recurring basis each time a financial report is issued. These laws and regulations, may relate, for example to:

26 Other than as described in paragraphs 23-25, the auditor does not perform other audit procedures on the entity’s compliance with laws and regulations since this would be outside the scope of an audit of a financial report.

27 The auditor shall be alert to the fact that audit procedures applied for the purpose of forming an opinion on the financial report may bring instances of possible non-compliance with laws and regulations to the auditor’s attention.

28 For example, such audit procedures include reading minutes; enquiring of the entity’s management and legal counsel concerning litigation, claims and assessments; and performing substantive tests of details of classes of transactions, account balances, or disclosures.

29 The auditor shall endeavour to obtain written representations that management has disclosed to the auditor all known actual or possible non-compliance with laws and regulations whose effects shall be considered when preparing the financial report.

30 In the absence of audit evidence to the contrary, the auditor is entitled to assume the entity is in compliance with these laws and regulations. In the event management is unable to or refuses to provide a written representation, under ASA 580 Management Representations, the auditor needs to consider the implications of the refusal for the auditor’s report.

31 Appendix 2 to this Auditing Standard sets out examples of the type of information that might come to the auditor’s attention that may indicate non-compliance.

32 When the auditor becomes aware of information concerning a possible instance of non-compliance, the auditor shall obtain an understanding of the nature of the act and the circumstances in which it has occurred, and sufficient other information to evaluate the possible effect on the financial report.

• the potential financial consequences, such as fines, penalties, damages, threat of expropriation of assets, enforced discontinuation of operations and litigation;
• whether the potential financial consequences are so serious as to call into question the true and fair view (fair presentation) given by the financial report.

34 When the auditor believes there may be non-compliance, the auditor shall document the findings and discuss them with management.

35 Documentation of findings would include copies of records and documents and making minutes of conversations, if appropriate.

36 If management does not provide satisfactory information that it is in fact in compliance, the auditor would ordinarily consult with the entity’s lawyers about the application of the laws and regulations to the circumstances and the possible effects on the financial report. When it is not considered appropriate to consult with the entity’s lawyers or when the auditor is not satisfied with the opinion, the auditor would ordinarily consider consulting the auditor’s own lawyers as to whether a violation of a law or regulation is involved, the possible legal consequences and what further action, if any, the auditor would take.

37 When adequate information about the suspected non-compliance cannot be obtained, the auditor shall consider the effect of the lack of sufficient appropriate audit evidence on the auditor’s report.

38 The auditor shall consider the implications of non-compliance in relation to other aspects of the audit, particularly the reliability of management representations.

39 In this regard, under paragraph 38 of this Auditing Standard, the auditor needs to reconsider the risk assessment and the validity of management representations, in case of non-compliance not detected by the entity’s internal controls or not included in management representations. The implications of particular instances of non-compliance discovered by the auditor will depend on the relationship of the perpetration and concealment, if any, of the act to specific control activities and the level of management or employees involved.

40 The auditor shall, as soon as practicable, either communicate with those charged with governance and management, or obtain audit evidence that they are appropriately informed, regarding non-compliance that comes to the auditor’s attention.

41 However, the auditor need not report matters that are clearly inconsequential or trivial and on which agreement may be reached in advance on the nature of such matters to be communicated.

42 If in the auditor’s judgement the non-compliance is believed to be intentional and material, the auditor shall communicate the finding without delay.

43 If the auditor suspects management is involved in non-compliance, the auditor shall report the matter to the next higher level of authority at the entity, if it exists, such as an audit committee or those charged with governance.

44 Where no higher authority exists, or if the auditor believes that the report may not be acted upon or is unsure as to the person to whom to report, the auditor would ordinarily consider seeking legal advice.

45 If the auditor concludes that the non-compliance has a material effect on the financial report, and has not been properly reflected in the financial report, the auditor shall express a qualified or an adverse opinion.

46 If the auditor is precluded by the entity from obtaining sufficient appropriate audit evidence to evaluate whether non-compliance that may be material to the financial report, has, or is likely to have, occurred, the auditor shall express a qualified opinion or a disclaimer of opinion on the financial report on the basis of a limitation on the scope of the audit.

47 If the auditor is unable to determine whether non-compliance has occurred because of limitations imposed by the circumstances rather than by the entity, the auditor shall consider the effect on the auditor’s report.

48 If, in the case of a company, the auditor is unable to obtain all the information and explanations considered necessary for the conduct of the audit as required by section 307(b) of the Corporations Act 2001 (the Act), the matter would be reported in accordance with subsection 308(3)(b) of the Act. The auditor also needs to consider any other relevant laws and regulations. If the auditor is in doubt as to the proper interpretation of laws or regulations, or whether the non-compliance has in fact occurred, the auditor would ordinarily seek legal advice before rendering an opinion on the financial report.

49 The auditor’s duty of confidentiality would ordinarily preclude reporting non-compliance to a third party without the express permission of the entity's management. This rule is followed unless there are compelling reasons to the contrary, for example:

(b) the auditor believes, on reasonable grounds, that members of the entity's governing body and/or employees have committed a serious criminal offence, and that any prior knowledge of the auditor's intentions enables them to evade the course of justice.

The auditor would ordinarily seek legal advice prior to reporting any matters concerning the entity's affairs to a third party to determine whether the auditor's duty of confidentiality will be overridden.

50 In many cases, the auditor is protected by qualified privilege if reporting matters in good faith and without malice to persons or authorities who have a proper interest in receiving the information. This protection varies according to the legislation under which the audit is performed. The auditor ordinarily assesses whether protection exists under the particular legislation governing the specific audit before claiming qualified privilege, and would ordinarily seek appropriate legal advice if in doubt. Where this protection exists, the auditor needs to have a reasonable belief concerning the occurrence of a fraud or non-compliance and would not ordinarily be held in breach of duty to the entity even if, an investigation or prosecution having occurred, it were found that there had been no offence.

51 Prior to reporting any non-compliance to a third party, the auditor ordinarily performs sufficient modified or additional audit procedures to verify the accuracy of the facts which are to be disclosed.

52 In certain circumstances, the auditor has a statutory responsibility to report non-compliances of which the auditor is aware, for example reporting contraventions of the Corporations Act 2001 to the ASIC under section 311 of that Act, as well as reporting offences under the State and Commonwealth Crime Legislation.[1] Establishing the appropriate authority to which a report would be made in a particular instance will depend on the nature and circumstances of the non-compliance. When in doubt, the auditor would ordinarily seek legal advice.

53 An auditor would ordinarily seek legal advice prior to disclosing any information, if approached by a person with a statutory right to demand the information sought, for example, police, taxation or customs officials, as part of enquiries which may lead to the prosecution of a client or former client. The auditor ordinarily establishes whether there would be a breach of the duty of confidentiality to the entity in making the disclosure. If the disclosure entails a breach of confidence, the auditor ordinarily declines to provide the information unless:

54 Where the auditor becomes aware of a non-compliance which, in the auditor's professional judgement, ought to be reported by the entity to the proper authority, the auditor would ordinarily bring the matter to the attention of the governing body requesting them to report to the proper authority. In the absence of evidence indicating that the governing body has taken appropriate action and there is no specific mandatory requirement to report the non-compliance to a third party, the auditor would ordinarily seek legal advice to determine whether the auditor's duty of confidentiality can be overridden by disclosure of the information to the proper authority.

55 In exceptional circumstances,[2] the auditor may conclude that withdrawal from the engagement (if possible) is necessary when the entity does not take the remedial action that the auditor ordinarily considers necessary in the circumstances, even when the non-compliance is not material to the financial report. Factors that would affect the auditor’s conclusion include the implications of the involvement of the highest authority within the entity which may affect the reliability of management representations, and the effects on the auditor of continuing association with the entity. In reaching such a conclusion, the auditor would ordinarily seek legal advice.

56 When the auditor receives an enquiry from the proposed auditor, pursuant to the relevant ethical requirements relating to the audit engagement, the existing auditor shall advise whether there are any professional reasons why the proposed auditor ought not to accept the appointment.

57 The extent to which an existing auditor can discuss the affairs of a client with a proposed auditor will depend on whether the client’s permission to do so has been obtained and/or the legal or ethical requirements that apply in each country relating to such disclosure. If there are any such reasons or other matters which need to be disclosed, the existing auditor would, taking account of the legal and ethical constraints, including where appropriate permission of the client, give details of the information and discuss freely with the proposed auditor all matters relevant to the appointment.

58 If permission from the client to discuss its affairs with the proposed auditor is denied by the client, that fact shall be disclosed to the proposed auditor.

59 Except as noted below, this Auditing Standard conforms with International Standard on Auditing ISA 250, Consideration of Laws and Regulations in an Audit of Financial Statements issued by the International Auditing and Assurance Standards Board of the International Federation of Accountants. The main differences between this Auditing Standard and ISA 250 are:

• This Auditing Standard provides in Appendix 1 a categorisation of regulatory requirements that may assist the auditor when obtaining an understanding of the legal and regulatory framework applicable to the entity (paragraph 21). ISA 250 does not incorporate comparable guidance.

• This Auditing Standard contains additional explanatory guidance, compared with ISA 250, on matters that the auditor considers when determining whether non-compliance ought to be reported to third parties or regulatory authorities (paragraphs 50-54).

  This Appendix provides an example of the categorisation that may be relevant when obtaining an understanding of the legal and regulatory framework applicable to the entity and the industry. The example incorporates the requirements of this Auditing Standard, but is not intended to provide a standard categorisation for understanding the legal and regulatory framework in all circumstances. The auditor needs to alter the categorisation as necessary for the categorisation of particular entities in particular industries. The following categorisation may be relevant when obtaining an understanding of the legal and regulatory framework applicable to the entity and the industry.

  Certain acts of non-compliance directly affect the form or content of an entity's financial report or contravene requirements with which the governing body must comply in the preparation of the financial report. An example is non-compliance with section 296 of the Corporations Act 2001 (the Law), which requires that a financial report for a financial year comply with Accounting Standards and any further requirements in the Law. The auditor ordinarily performs specific audit procedures designed to detect material misstatements arising as a result of such non-compliance acts.

  Certain acts of non-compliance may be expected to have a fundamental effect on the operations of an entity and thus could have financial consequences that are material to the financial report. Such an act could be a breach of a law or a licence or a similar entitlement to carry on a trade or practice which forms a major part of an entity's activities. The consequence of the breach may result in material liabilities or jeopardises the viability of that major part of the entity or affect the ability of the entity to continue to operate as a going concern. The auditor ordinarily assesses the risk of such acts of non-compliance resulting in a material misstatement in the financial report when planning the audit. The risk of material misstatements arising as a result of this category of non-compliance acts, and the extent to which the auditor needs to design procedures directed at detecting such non-compliance acts, will be affected by the environment in which the entity is operating and the nature of its operations. Certain acts of non-compliance are breaches of the many other laws or regulations by which any entity may be affected. Examples of these might include breaches of legislation governing occupational health and safety, environmental protection and equal employment opportunity. In the absence of a specific requirement of the audit mandate, it is not practical to consider all such legislation when planning and assessing audit risk, and the auditor is not expected to have a detailed knowledge of them beyond that which might be expected of a reasonable person. Where the auditor becomes aware of acts of non-compliance of this nature during the audit, consideration may be given to whether they have a material impact on the financial report, and additional audit procedures performed accordingly. The auditor also ordinarily considers any other implications of the non-compliance act, for example, any statutory reporting responsibilities. Some acts of non-compliance that may be unimportant to some entities, as they involve an immaterial part of their activities, may be very important to others. For example, environmental protection may be classified under “Fundamental Effect of Operations” for some entities such as those involved in the production of chemicals, but under “Other” for others, such as those in the retail trade.

The following are examples of indications that non-compliance may have occurred. While these examples incorporate the requirements of this Auditing Standard, the examples are not intended to be an exhaustive list of the types of information that indicate non-compliance to the auditor.

Examples of the type of information that may come to the auditor’s attention that may indicate that non-compliance with laws or regulations has occurred are listed below:

• sales commissions or agent’s fees that appear excessive in relation to those ordinarily paid by the entity or in its industry or to the services actually received;
• unusual payments in cash, purchases in the form of cashiers’ cheques payable to bearer or transfers to numbered bank accounts;
• existence of an accounting system which fails, whether by design or by accident, to provide an adequate audit trail or sufficient evidence;

UNDERSTANDING THE LEGAL AND REGULATORY F UNDERSTANDING THE LEGAL AND REGULATORY FRAMEWORK APPLICABLE TO THE ENTITY AND THE INDUSTRY

This Appendix provides an example of the categorisation that may be relevant when obtaining an understanding of the legal and regulatory framework applicable to the entity and the industry. The example incorporates the requirements of this Auditing Standard, but is not intended to provide a standard categorisation for understanding the legal and regulatory framework in all circumstances. The auditor needs to alter the categorisation as necessary for the categorisation of particular entities in particular industries.
The following categorisation may be relevant when obtaining an understanding of the legal and regulatory framework applicable to the entity and the industry.

Certain acts of non-compliance directly affect the form or content of an entity's financial report or contravene requirements with which the governing body must comply in the preparation of the financial report. An example is non-compliance with section 296 of the Corporations Act 2001 (the Law), which requires that a financial report for a financial year comply with Accounting Standards and any further requirements in the Law.
The auditor ordinarily performs specific audit procedures designed to detect material misstatements arising as a result of such non-compliance acts.

Certain acts of non-compliance may be expected to have a fundamental effect on the operations of an entity and thus could have financial consequences that are material to the financial report. Such an act could be a breach of a law or a licence or a similar entitlement to carry on a trade or practice which forms a major part of an entity's activities. The consequence of the breach may result in material liabilities or jeopardises the viability of that major part of the entity or affect the ability of the entity to continue to operate as a going concern.
The auditor ordinarily assesses the risk of such acts of non-compliance resulting in a material misstatement in the financial report when planning the audit. The risk of material misstatements arising as a result of this category of non-compliance acts, and the extent to which the auditor needs to design procedures directed at detecting such non-compliance acts, will be affected by the environment in which the entity is operating and the nature of its operations.
Certain acts of non-compliance are breaches of the many other laws or regulations by which any entity may be affected. Examples of these might include breaches of legislation governing occupational health and safety, environmental protection and equal employment opportunity. In the absence of a specific requirement of the audit mandate, it is not practical to consider all such legislation when planning and assessing audit risk, and the auditor is not expected to have a detailed knowledge of them beyond that which might be expected of a reasonable person. Where the auditor becomes aware of acts of non-compliance of this nature during the audit, consideration may be given to whether they have a material impact on the financial report, and additional audit procedures performed accordingly. The auditor also ordinarily considers any other implications of the non-compliance act, for example, any statutory reporting responsibilities.
Some acts of non-compliance that may be unimportant to some entities, as they involve an immaterial part of their activities, may be very important to others. For example, environmental protection may be classified under “Fundamental Effect of Operations” for some entities such as those involved in the production of chemicals, but under “Other” for others, such as those in the retail trade.