CTHIn ForceLegislation

Auditing Standard ASA 240 The Auditor's Responsibilities Relating to Fraud in an Audit of a Financial Report (October 2025)

Auditing Standard ASA 240Auditing Standard ASA 240

Start here

Get a plain-English read of Auditing Standard ASA 240

Turn the raw legal text into a practical explanation grounded in Auditing Standard ASA 240 The Auditor's Responsibilities Relating to Fraud in an Audit of a Financial Report (October 2025).

Ask Zoe about this section View in full context

Auditing Standard ASA 240

The Auditor's Responsibilities Relating to Fraud in an Audit of a Financial Report

Application

Aus 0.1 This Auditing Standard applies to:

(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with the Corporations Act 2001; and

(b) an audit of a financial report, or a complete set of financial statements, for any other purpose.

Aus 0.2 This Auditing Standard also applies, as appropriate, to an audit of other historical financial information.

Operative Date

Aus 0.3 This Auditing Standard is operative for financial reporting periods beginning on or after 15 December 2026.

Introduction

Scope of this Auditing Standard

This Australian Standard on Auditing (ASA) deals with the auditor’s responsibilities relating to fraud in an audit of a financial report and the implications for the auditor’s report. The requirements and guidance in this ASA refer to, or expand on, the application of other relevant ASAs, in particular ASA 200,[1] ASA 220,[2] ASA 315,[3] ASA 330,[4] and ASA 701.[5] Accordingly, this ASA is intended to be applied in conjunction with other relevant ASAs.

Responsibilities of the Auditor, Management and Those Charged with Governance

Responsibilities of the Auditor

The auditor’s responsibilities relating to fraud when conducting an audit in accordance with this ASA, and other relevant ASAs, are to: (Ref: Para. A1)
1. Plan and perform the audit to obtain reasonable assurance about whether the financial report as a whole is free from material misstatement due to fraud. These responsibilities include identifying and assessing risks of material misstatement in the financial report due to fraud and designing and implementing responses to address those assessed risks.
2. Communicate and report about matters related to fraud.

Responsibilities of Management and Those Charged with Governance

The primary responsibility for the prevention and detection of fraud rests with both management and those charged with governance of the entity. It is important that management, with the oversight of those charged with governance, place a strong emphasis on fraud prevention, which may reduce opportunities for fraud to take place, and fraud deterrence, which could persuade individuals not to commit fraud because of the likelihood of detection and punishment. This involves a commitment to creating and maintaining a culture of honesty and ethical behaviour that can be reinforced by active oversight by those charged with governance. Oversight by those charged with governance includes considering the potential for override of controls or other inappropriate influence over the financial reporting process, such as efforts by management to manipulate earnings in order to influence the perceptions of financial report users regarding the entity’s performance.

Part Auditing Standard ASA 240 - Auditing Standard ASA 240 The Auditor's Responsibilities Relating to Fraud in an Audit of a Financial Report (October 2025) - Auditing Standard ASA 240 | Zoe

If the auditor identifies fraud or suspected fraud, the auditor shall obtain an understanding of the matter(s) in order to determine the effect on the audit engagement. In doing so, the auditor shall: (Ref: Para.A158–A162)
1. Make enquiries about the matter(s) with the appropriate level of management and, when appropriate in the circumstances, make enquiries about the matter(s) with those charged with governance;
2. If the entity has a process to investigate the matter(s), evaluate whether it is appropriate in the circumstances; and
3. If the entity has implemented remedial actions to respond to the matter(s), evaluate whether they are appropriate in the circumstances.
Except for fraud or suspected fraud determined by the auditor to be clearly inconsequential based on the procedures performed in paragraph 55, the engagement partner shall: (Ref: Para. A163–A165)
1. Determine whether:
  1. To perform additional risk assessment procedures to provide an appropriate basis for the identification and assessment of the risks of material misstatement due to fraud in accordance with ASA 315;
  2. To design and perform further audit procedures to appropriately respond to the risks of material misstatement due to fraud in accordance with ASA 330; and
  3. There are additional responsibilities for the auditor under law, regulation or relevant ethical requirements about the entity’s non-compliance with laws or regulations in accordance with ASA 250.
2. If applicable, consider the impact on prior period audits.
If the auditor identifies a misstatement due to fraud, the auditor shall: (Ref: Para. A166–A172)
1. Determine whether the identified misstatement is material by considering the nature of the qualitative or quantitative circumstances giving rise to the misstatement;
2. Determine whether control deficiencies exist, including significant deficiencies in internal control related to the prevention or detection of fraud, relating to the identified fraud or suspected fraud;
3. Determine the implications of the misstatement in relation to other aspects of the audit, including when the auditor has reason to believe that management is involved; and
4. Reconsider the reliability of management’s representations and audit evidence previously obtained, including when the circumstances or conditions giving rise to the misstatement indicate possible collusion involving employees, management or third parties.
If the auditor determines that the financial report is materially misstated due to fraud or the auditor is unable to obtain sufficient appropriate audit evidence to enable the auditor to conclude whether the financial report is materially misstated due to fraud, the auditor shall:
1. Determine the implications for the audit and the auditor’s opinion on the financial report in accordance with ASA 705;[31] and
2. If appropriate, obtain advice from legal counsel.

Examples: Incentive or pressure to commit fraudulent financial reporting may exist when management is under pressure, from sources outside or inside the entity, to achieve an expected (and perhaps unrealistic) earnings target or financial outcome — particularly when the consequences to management for failing to meet financial goals can be significant. Similarly, individuals may have an incentive to misappropriate assets — for example, because the individuals are living beyond their means. A perceived opportunity to commit fraud may exist when an individual believes controls can be overridden, for example, because the individual is in a position of trust or has knowledge of specific control deficiencies. Individuals may rationalise committing a fraudulent act as they may possess an attitude, character or set of ethical values that allow them to knowingly and intentionally commit a dishonest act. However, even otherwise honest individuals can commit fraud in an environment that imposes sufficient pressure on them.

Examples: Management intentionally takes positions that lead to fraudulent financial reporting by materially misstating the financial report due to pressures to meet market expectations or a desire to maximise compensation based on performance. Management reduces earnings by a material amount to minimise tax. Management inflates earnings to secure bank financing. In the public sector, misreporting of revenues or underreporting of expenditures, especially when such expenditures are subject to statutory limits.

Examples: Embezzling funds (e.g., misappropriating collections of accounts receivable or diverting receipts in respect of written-off accounts to personal bank accounts). Theft of assets (e.g., stealing inventory for personal use, stealing scrap for resale, theft of digital assets by exploiting a private key and in doing so allowing the perpetrator to control the entity’s funds, theft of intellectual property by colluding with a competitor to disclose technological data in return for payment). Causing an entity to pay for goods and services not received (e.g., payments to fictitious suppliers, kickbacks paid by suppliers to the entity’s purchasing agents in return for approving payment for inflated prices, or payments to fictitious employees). Using an entity’s assets for personal use (e.g., using the entity’s assets as collateral for a personal loan or a loan to a related party).

Examples: When obtaining an understanding of the entity’s whistleblower program, the auditor identified a tip submitted to the entity’s fraud reporting hotline which alleged that management had inflated earnings by entering into transactions with related parties which lacked a business purpose. When performing further audit procedures to respond to assessed risks of material misstatement due to fraud at the assertion level for inventory, the auditor obtained audit evidence that indicated the possible misappropriation of products from the entity’s warehouse by employees.

Audit procedures performed to comply with other ASAs may also bring instances of fraud or suspected fraud to the auditor’s attention including, for example, those performed in accordance with ASA 600[36] when responding to assessed risks of material misstatement due to fraud arising from the consolidation process.
The auditor may use automated tools and techniques to perform audit procedures related to identifying and assessing the risks of material misstatement due to fraud or when responding to assessed risks of material misstatement due to fraud. This may allow the auditor to evaluate large amounts of data more easily to, for example, provide deeper insights or identify unusual trends, which enhances the ability of the auditor to exercise professional scepticism and more effectively challenge management’s assertions. The auditor may also use automated tools and techniques to perform audit procedures related to journal entry testing in a more efficient and effective manner. However, the use of automated tools and techniques does not replace the need to maintain professional scepticism and to exercise professional judgement throughout the audit.
For the purpose of this ASA, allegations of fraud by another party involving the entity are treated by the auditor as suspected fraud once the allegations have come to the auditor’s attention (e.g., identified as a result of enquiries made by the auditor of management, or when obtaining an understanding of the entity’s whistleblower program (or other program to report fraud)). The party making the allegations may be internal or external to the entity. Accordingly, the auditor performs audit procedures in accordance with paragraphs 55–58 to address the suspected fraud.
Even when an identified misstatement due to fraud is not quantitatively material, it may be qualitatively material depending on:
1. Who instigated or perpetrated the fraud – an otherwise insignificant fraud perpetrated by senior management, or a public official is ordinarily considered qualitatively material irrespective of the amount involved. This may in turn give rise to concerns about the integrity of management responsible for the entity’s system of internal control.
2. Why the fraud was perpetrated – misstatements that are not material quantitatively, either individually or in the aggregate, may have been made intentionally by management to “manage” key performance indicators in order to, for example, meet market expectations, maximise compensation based on performance, or comply with the terms of debt covenants. In the public sector, misstatements may have been made intentionally by management to achieve a surplus when a deficit is prohibited by legislation or to misreport expenses incurred to avoid breaching statutory limits.

Example: When obtaining an understanding of the entity’s general IT controls, the auditor was informed of a cybersecurity breach involving unauthorised access by a third party to the entity’s confidential customer files, including related banking information. After obtaining an understanding of the suspected fraud, the engagement partner determined that the cybersecurity breach likely violated local data protection laws.

Example: When performing tests of details on a bank’s loan portfolio, the auditor identified a series of loans to newly formed entities connected to senior management that lacked appropriate documentation. The auditor determined the circumstances were indicative of fraudulent approvals of loans by senior management to related parties. After obtaining an understanding of the suspected fraud in accordance with paragraph 55, the auditor concluded the understanding was also sufficient to meet the requirement in paragraph 19(a) of ASA 250. The auditor evaluated the possible effect on the financial report of the fine for the entity’s suspected violation of banking regulations regarding related-party lending in accordance with paragraph 19(b) of ASA 250.

Examples: Corruption involving fraud – Management colluded with other competing parties to raise prices or lower the quality of goods or services for purchasers who wish to acquire products or services through a bidding process (i.e., bid rigging). The bid rigging included monetary payments by the designated winning bidder to colluding parties using fraudulent consulting contracts for which no actual work took place. Bribery to conceal fraud – Management offered inducements to employees for concealing the misappropriation of assets by management. Money laundering to facilitate fraud – An employee laundered money, to an offshore bank account, that was illegally obtained from embezzling payments for fictitious purchases of inventory through the creation of false purchase orders, supplier shipping documents, and supplier invoices.

Examples:Possible sources that may provide information about circumstances that may be indicative of fraud or suspected fraud that affects the entity include: The auditor (e.g., when performing audit procedures in accordance with ASA 550, the auditor becomes aware of the existence of a related party relationship that management intentionally did not disclose to the auditor). Those charged with governance (e.g., when members of the audit committee conduct an independent investigation of unusual journal entries and other adjustments). Management (e.g., when evaluating the results of the entity’s risk assessment process). Individuals within the internal audit function (e.g., when individuals conduct the annual compliance procedures related to the entity’s system of internal control). An employee (e.g., by filing a tip using the entity’s whistleblower program). A former employee (e.g., by sending a complaint via electronic mail to the internal audit function).

Examples: A lack of cooperation and undue time pressures imposed by management negatively affected the engagement team’s ability to resolve a complex and contentious issue. These circumstances were, based on the engagement partner’s professional judgement, indicative of possible efforts by management to conceal fraud. The engagement partner involved more experienced members of the engagement team to deal with members of management who were difficult to interact with and communicated with those charged with governance as to the nature of the challenging circumstances, including the possible effect on the audit. Impediments imposed by management created difficulties for the engagement team in obtaining access to records, facilities, certain employees, customers, suppliers, and others. These circumstances were, based on the engagement partner’s professional judgement, indicative of possible efforts by management to conceal fraud. The engagement partner reminded the engagement team not to be satisfied with audit evidence that was less than persuasive when responding to assessed risks of material misstatement due to fraud and communicated with those charged with governance as to the nature of the challenging circumstances, including the possible effect on the audit.

Examples:Conditions that, if identified, may cause the auditor to believe that a record or document is not authentic or that terms in a document have been modified but not disclosed to the auditor include: Unexplained alterations to documents received from external sources. Serial numbers used out of sequence or duplicated. Addresses and logos not as expected. Document style different to others of the same type from the same source (e.g., changes in fonts and formatting). Information that would be expected to be included is absent. Invoice references or descriptors that differ from other invoices received from the entity. Unusual terms of trade, such as unusual prices, interest rates, guarantees and repayment terms (e.g., purchase costs that appear unreasonable for the goods or services being charged for). Information that appears implausible or inconsistent with the auditor’s understanding and knowledge. A change from authorised signatory. Electronic documents with a last edited date that is after the date they were represented as finalised.

Examples: The entity is investigating fraud or suspected fraud that may have a material effect on the financial report (e.g., when it involves senior management). An individual with forensic skills may assist in planning and performing audit procedures as it relates to the specific audit area where the fraud or suspected fraud was identified. The entity is undergoing an investigation by an authority outside the entity for fraud or suspected fraud, or for instances of non-compliance or suspected non-compliance with laws and regulations (e.g., materially misstated tax provision related to tax evasion and materially misstated revenues due to such revenues being generated from illegal activities facilitated through money laundering). Tax and anti-money laundering experts may assist with identifying those fraudulent aspects of the non-compliance or suspected non-compliance that may have a financial report impact. The complexity of the entity’s organisational structure and related party relationships, including the creation or existence of special purpose entities, may present an opportunity for management to misrepresent the financial position or financial performance of the entity. For example, an expert in taxation law may assist in understanding the business purpose and activities or business units within complex organisations, including how its structure for tax purposes may be different from its operating structure. The complexity of the industry or regulatory environment in which the entity operates may present an opportunity or pressure for management to engage in fraudulent financial reporting. For example, an individual specialising in fraud schemes in specific emerging markets may assist in identifying fraud risk factors or where the financial report may be susceptible to risks of material misstatement due to fraud. The use of complex financial instruments or other complex financing arrangements may present an opportunity to inadequately disclose the risks and nature of complex structured products. For example, a valuation expert may assist in understanding the product’s structure, purpose, underlying assets, and market conditions, which may highlight fraud risk factors such as discrepancies between market conditions and the valuation of the structured product.

Examples:Forensic skills may include specialised skills or knowledge in: Identifying and evaluating fraud risk factors. Identifying and assessing the risks of material misstatement due to fraud. Evaluating the effectiveness of controls implemented by management to prevent or detect fraud. Assessing the authenticity of information intended to be used as audit evidence. Gathering, analysing, and evaluating information or data using automated tools and techniques to identify links, patterns, or trends that may be indicative of fraud or suspected fraud. Applying knowledge in fraud schemes, and techniques for interviews, information gathering and data analytics, in the detection of fraud. Interviewing techniques used in discussing sensitive matters with management and those charged with governance. Analysing financial and non-financial information by using automated tools and techniques to look for inconsistencies, unusual patterns, or anomalies that may indicate intentional management bias or that may be the result of management override of controls.

Examples: Sudden changes in business activity or performance (e.g., decrease in operating cashflows of an entity arising from economic conditions resulting in increased pressure internally by management to meet publicly disclosed earnings targets). Unexpected changes in the senior management of the entity (e.g., the chief financial officer resigns, with no explanation given for the sudden departure, providing an opportunity for other employees in the treasury department to commit fraud given the lack of senior management oversight).

Examples: Making the required enquiries of management and those charged with governance about matters referred to in paragraphs 32(b)–32(c) and 33(b) as early as possible in the audit engagement, for example, as part of the auditor’s communications regarding planning matters. When ASA 701 applies, the auditor may communicate preliminary views about key audit matters related to fraud when discussing the planned scope and timing of the audit. Having specific discussions with management and those charged with governance as relevant audit evidence is obtained relating to the auditor’s evaluation of each of the components of the entity’s system of internal control and assessment of the risks of material misstatement due to fraud. These discussions may form part of the auditor’s communications on significant findings from the audit. Communicating, on a timely basis in accordance with ASA 265,[48] significant deficiencies in internal control (including those that are relevant to the prevention or detection of fraud) with the appropriate level(s) of management and those charged with governance may allow them to take necessary and timely remedial actions.

Examples: Based on the auditor’s understanding of the entity’s information processing activities, the auditor identified a fraud risk factor (i.e., opportunity to commit fraud) resulting from management’s lack of oversight over significant business processes outsourced to a third-party service provider. Based on the auditor’s understanding of the entity’s physical access controls, the auditor identified a fraud risk factor (i.e., opportunity to commit fraud) resulting from the entity’s lack of sufficient security at locations with a material amount of small, lightweight, high-value assets. Based on the auditor’s understanding of revenue contracts, the auditor became aware that the entity is using consignment agreements, where third parties sell the entity’s inventory on its behalf, and the entity earns revenue from these sales. The auditor identified a fraud risk factor (i.e., incentive to commit fraud) resulting from the third party’s incentive to underreport to the entity consigned sales in order for the third party to meet its own sales targets.

<table cellspacing="0" cellpadding="0" style="margin-left:26.5pt; border:0.75pt solid #000000; border-collapse:collapse"><tbody><tr><td style="width:415.75pt; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p class="ParaPlain"><span style="font-weight:bold">Example:</span></p><table cellspacing="0" cellpadding="0" style="border:0.75pt solid #000000; border-collapse:collapse"><tbody><tr><td style="width:196.8pt; border-right:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p id="navPoint_275" class="ListBullet" style="margin-top:6pt; margin-left:0pt; text-indent:0pt; text-align:center"><span style="font-weight:bold">Analytical Procedure</span></p></td><td style="width:196.85pt; border-left:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p id="navPoint_276" class="ListBullet" style="margin-top:6pt; margin-left:0pt; text-indent:0pt; text-align:center"><span style="font-weight:bold">Unexpected or Inconsistent Result of the Analytical Procedure</span></p></td></tr><tr><td style="width:196.8pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p id="navPoint_277" class="ListBullet" style="margin-top:6pt; margin-left:0pt; text-indent:0pt"><span>A comparison of the entity’s recorded sales volume to the entity’s production capacity.</span></p></td><td style="width:196.85pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p id="navPoint_278" class="ListBullet" style="margin-top:6pt; margin-left:0pt; text-indent:0pt"><span>An excess of sales volume over production capacity may be indicative of fictitious sales or sales recorded before revenue recognition criteria have been met.</span></p></td></tr><tr><td style="width:196.8pt; border-top:0.75pt solid #000000; border-right:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p id="navPoint_279" class="ListBullet" style="margin-top:6pt; margin-left:0pt; text-indent:0pt"><span>A trend analysis of revenues by month compared to sales returns by month, including during and shortly after the reporting period.</span></p></td><td style="width:196.85pt; border-top:0.75pt solid #000000; border-left:0.75pt solid #000000; padding-right:5.03pt; padding-left:5.03pt; vertical-align:top"><p id="navPoint_280" class="ListBullet" style="margin-top:6pt; margin-left:0pt; text-indent:0pt"><span>An increase in sales returns shortly after the reporting period relative to sales returns during the month may indicate the existence of undisclosed side agreements with customers involving the return of goods, which, if known, would preclude revenue recognition.</span></p></td></tr></tbody></table><p id="navPoint_281" class="ListBullet" style="margin-left:0pt; text-indent:0pt"><span></span></p></td></tr></tbody></table>

Example:If the entity is undergoing significant digital transformation activities, poor governance arrangements over newly implemented technologies impacting the entity’s information system relevant to the preparation of the financial report may increase the opportunity for fraud.

Examples: Weak legal and regulatory frameworks that create a permissive environment for fraudulent financial reporting without significant consequences. Offshore financial centres that have less restrictive regulations and tax incentives that may facilitate fraud through money laundering. Cultural norms in which bribery is an accepted practice of doing business, which could lead to bribery being used to facilitate or conceal fraud.

Example:Automated tools and techniques, such as analysis of disaggregated data, for example by business segment or product line, may be used by the auditor to identify inconsistencies or anomalies in the data used in performance measures.

Examples: Management may consistently trend toward one end of a range of possible outcomes that provide a more favourable financial reporting outcome for management. Management may use a model that applies a method that is not established or commonly used in a particular industry or environment.

Example:During the entity’s risk assessment process relating to third-party fraud, management identified an unusual level of disbursements to recently added vendors to the entity’s approved-vendor database. Upon investigating the matter, management determined that purchasing and procurement personnel had colluded with the vendors when it added those vendors to the database. Management designed and implemented controls to prevent and detect the reoccurrence of vendor-related fraud.

Examples:Others within the entity to whom the auditor may direct enquiries about the existence or suspicion of fraud include: Operating personnel not directly involved in the financial reporting process. Employees with different levels of authority. Employees involved in initiating, processing, or recording complex or unusual transactions and those who supervise or monitor such employees. In-house legal counsel. Chief ethics officer, chief compliance officer or equivalent person. The person or persons charged with dealing with allegations of fraud

Examples:In applying ASA 315 and ASA 610 in the context of fraud, the auditor may, for example, enquire about: How the entity’s risk assessment process addresses the risk of fraud. The entity’s processes and controls to prevent or detect fraud. The entity’s culture and management’s commitment to integrity and ethical values. Whether the internal audit function is aware of any instances of management override of controls. The procedures performed, if any, by the internal audit function during the year related to fraud and whether management and those charged with governance have satisfactorily responded to any findings resulting from those procedures. The procedures performed, if any, by the internal audit function in investigating frauds and suspected violations of the entity’s code of ethics and values, and whether management and those charged with governance have satisfactorily responded to any findings resulting from those procedures. The fraud-related reports, if any, or communications prepared by the internal audit function and whether management and those charged with governance have satisfactorily responded to any findings resulting from those reports. Control deficiencies identified by the internal audit function that are relevant to the prevention and detection of fraud and whether management and those charged with governance have satisfactorily responded to any findings resulting from those deficiencies.

Obtaining an understanding of the entity’s information system and communication relevant to the preparation of the financial report includes the manner in which an entity incorporates information from transaction processing into the general ledger. This ordinarily involves the use of journal entries, whether standard or non-standard, or automated or manual. This understanding enables the auditor to identify the population of journal entries and other adjustments that is required to be tested in accordance with paragraph 49(b). Obtaining an understanding of the population may provide the auditor with insights about journal entries and other adjustments that may be susceptible to unauthorised or inappropriate intervention or manipulation. This may assist the auditor in designing and performing audit procedures over journal entries and other adjustments in accordance with paragraphs 49(c) and 49(d).
Appendix 4 includes additional considerations when selecting journal entries and other adjustments for testing, including matters that the required understanding provides the auditor knowledge about.
When performing risk assessment procedures, the auditor may consider changes in the entity’s IT environment because of the introduction of new IT applications or enhancements to the IT infrastructure, which may impact the susceptibility of the entity to fraud or create vulnerabilities in the IT environment (e.g., changes to the databases involved in processing or storing transactions). There may also be an increased susceptibility to misstatement due to management bias or other fraud risk factors when there are complex IT applications used to initiate or process transactions or information, such as the use of artificial intelligence or machine learning algorithms to calculate and initiate accounting entries. In such circumstances, the auditor may assign individuals with specialised skills and knowledge, such as forensic and IT experts, or more experienced individuals to the engagement.

Examples:Preventive controls Clearly defined and documented decision makers using delegations, authorisations, and other instructions. Access controls, including those that address physical security of assets against unauthorised access, acquisition, use or disposal and those that prevent unauthorised access to the entity’s IT environment and information, such as authentication technology. Controls over the process to design, program, test and migrate changes to the IT system. Entry level checks, probationary periods, suitability assessments or security vetting in order to assess the integrity of new employees, contractors or third parties. Sensitive or confidential information cannot leave the entity's IT environment without authority or detection.Detective controls Exception reports to identify activities that are unusual or not in the ordinary course of business for further investigation. Mechanisms for employees of the entity and third parties to make anonymous or confidential communications to appropriate persons within the entity about identified or suspected fraud. Fraud detection software programs incorporated into the IT infrastructure that automatically analyse transactions data or enable data monitoring and analysis to detect what is different from what is standard, normal, or expected and may therefore indicate fraud.

Examples: Controls that segregate access to make changes to a production (i.e., end user) environment. Access controls to manage:o Privileged access – such as controls over administrative or powerful users’ access.o Provisioning – such as controls to authorise modifications to existing users’ access privileges, including non-personal or generic accounts that are not tied to specific individuals within the entity Review of system logs that track access to the information system, enabling user activity to be monitored and security violations to be reported to management.

Examples:Relevant assertions and the related classes of transactions, account balances or disclosures that may be susceptible to material misstatement due to fraud include: Accuracy or valuation of revenue from contracts with customers — revenue from contracts with customers may be susceptible to inappropriate estimates of the amount of consideration to which an entity expects to be entitled in exchange for transferring promised goods or services to a customer. Occurrence or classification of expenses — expenses may be susceptible to inclusion of fictitious or personal expenses to minimise tax or other statutory obligations. Existence of cash balances — cash balances may be susceptible to the creation of falsified or altered external confirmations or bank statements. Valuation of account balances involving complex accounting estimates — account balances involving complex accounting estimates such as goodwill and other intangible assets, impairment of inventories, expected credit losses, insurance contract liabilities, employee retirement benefits liabilities, environmental liabilities or environmental remediation provisions may be susceptible to high estimation uncertainty, significant subjectivity and management bias in making judgements about future events or conditions. Classification — certain income or expenses may be susceptible to misclassification within the statement of comprehensive income, for example, to manipulate key performance measures. Presentation of disclosures — disclosures may be susceptible to omission, or incomplete or inaccurate presentation, for example, disclosures relating to contingent liabilities, off-balance sheet arrangements, financial guarantees or debt covenant requirements.

Example: Fraud risk factors may be present when an individual with a significant role in a public sector entity has the sole authority to commit the public sector entity to sensitive expenditure, including travel, accommodation, or entertainment, and that sensitive expenditure provides personal benefits to the individual.

Examples: Based on the risk assessment procedures performed, the auditor identified an aggressive employee performance measure in management’s incentive program related to the entities’ profit and loss statement. Therefore, the auditor determined that risks of management override of controls also exist at the assertion level and identified a risk of material misstatement due to fraud related to management override of controls at the assertion level. The auditor determined that the risk relates to the completeness of expenses, as the calculation of the performance measure may be susceptible to manipulation from management via adjustments made to the expense accounts. In addition to the procedures performed as described in paragraphs 48–52, the auditor designed and performed further audit procedures to address this significant risk. Based on the risk assessment procedures performed, the auditor identified a pressure on management to meet the financial ratios for the entity’s loan covenants to avoid insolvency. Therefore, the auditor identified a risk of material misstatement due to fraud related to management override of controls at the assertion level. The auditor determined that the risk relates to the valuation of inventory and completeness of liabilities, as the valuation methods may be susceptible to inappropriate adjustment by management or records may be manipulated to understate net liabilities. In addition to the procedures performed as described in paragraphs 48–52, the auditor designed and performed further audit procedures to address this significant risk.

Examples: When there are changes in the financial reporting framework relating to revenue recognition, which may present an opportunity for management to commit fraudulent financial reporting or bring to light the lack of (or significant deficiency in) controls for managing changes in the financial reporting framework. When an entity’s accounting principles for revenue recognition are more aggressive than, or inconsistent with, its industry peers. When the entity operates in emerging industries. When revenue recognition involves complex accounting estimates. When revenue recognition is based on complex contractual arrangements with a high degree of estimation uncertainty, for example, construction-type or production-type contracts (e.g., tolling arrangements) and multiple-element arrangements. When contradictory evidence is obtained from performing risk assessment procedures. When the entity has a history of significant adjustments for the improper recognition of revenue (e.g., premature recognition of revenue). When circumstances indicate the recording of fictitious revenues. When circumstances indicate the omission of required disclosures or presentation of incomplete or inaccurate disclosures regarding revenue, for example, to manipulate the entity’s financial performance due to pressures to meet investor / market expectations, or due to the incentive for management to maximise compensation linked to the entity’s financial performance. When the entity is part of an unnecessarily complex structure increasing the risk of undisclosed transactions with related parties.

Examples: Leasehold revenue from a single unit of rental property, or multiple rental properties, with a single tenant. Based on the risk assessment procedures performed, the auditor determined that leasehold revenue is not a key performance indicator for the lessor as it is predictable and stable. Therefore, there are no significant incentives or pressures related to leasehold revenue. The auditor also determined that the accounting is outsourced to an independent asset management company such that there are no significant opportunities for management to manipulate leasehold revenue. Simple or straightforward ancillary revenue sources, which are determined by fixed rates or externally published rates (e.g., interest or dividend revenue from investments with level 1 inputs). Based on the risk assessment procedures performed, the auditor determined that management’s key performance indicators do not relate to interest or dividend revenue from investments such that there are no significant incentives or pressures related to the interest or dividend revenue from investments because the transactions are recorded in a highly automated system with no significant opportunities for management to manipulate the interest or dividend revenue from investments.

Examples: Performing further audit procedures on selected classes of transactions, account balances or disclosures that were not determined to be material. Performing tests of detail where the auditor performed substantive analytical procedures in previous audits. Adjusting the timing of audit procedures from that otherwise expected. Using different sampling methods or using different approaches to stratify the population. Performing audit procedures at different locations or at locations on an unannounced basis. Performing substantive analytical procedures at a more detailed level or lowering thresholds when performing substantive analytical procedures for further investigation of unusual or unexpected relationships. Using automated tools and techniques, such as anomaly detection or statistical methods, on an entire population to identify items for further investigation.

Examples: Increased sensitivity in the selection of the nature and extent of documentation to be examined in support of material transactions. Increased recognition of the need to corroborate management’s explanations or representations concerning significant matters. Increased involvement of auditor’s experts to assist the engagement team with complex or subjective areas of the audit. Changing the composition of the engagement team by, for example, requesting that more experienced individuals with greater skills or knowledge or specific expertise are assigned to the engagement. Increasing the extent and frequency of the direction and supervision of engagement team members and a more detailed review of their work. Using direct extraction methods or technologies when obtaining data from the entity’s information system for use in automated tools and techniques to address the risk of data manipulation. Increased emphasis on tests of details.

Examples:Nature The auditor identifies that management is under pressure to meet earnings expectations and accordingly there may be a related risk that management is inflating sales by entering into sales agreements that include terms that preclude revenue recognition or by invoicing sales before delivery. In these circumstances, the auditor may, for example, design external confirmations not only to confirm outstanding amounts, but also to confirm the details of the sales agreements, including date, any rights of return and delivery terms. In addition, the auditor may find it effective to supplement such external confirmations with enquiries of non-financial personnel in the entity regarding any changes in sales agreements and delivery terms.Timing The auditor may conclude that performing substantive testing at or near the period end better addresses an assessed risk of material misstatement due to fraud. The auditor may conclude that, given the assessed risks of intentional misstatement or manipulation, audit procedures to extend audit conclusions from an interim date to the period end would not be effective. In contrast, because an intentional misstatement — for example, a misstatement involving improper revenue recognition — may have been initiated in an interim period, the auditor may elect to apply substantive procedures to transactions occurring earlier in or throughout the reporting period.Extent The auditor may use automated tools and techniques to perform more extensive testing of digital information. Such automated techniques may be used to test all items in a population, select specific items for testing that are responsive to risks of material misstatement due to fraud, or select items for testing when performing audit sampling. For example, the auditor may stratify the population based on specific characteristics to obtain more relevant audit evidence that is responsive to the risks of material misstatement due to fraud.

Example:The auditor may request confirmation of the contractual terms for a specific class of revenue transactions, such as pricing, payment and discount terms, applicable guarantees and the existence, or absence, of any side agreements.

Example:A response to a bank confirmation request indicated that a bank account, in the name of wholly owned subsidiary incorporated in an offshore financial centre, did not exist. Upon investigating the exception, the auditor determined that the entity misstated its financial report by overstating its cash balance.

Examples:The process of selecting journal entries and other adjustments for testing may be enhanced if the auditor leverages insights based on the auditor’s understanding about: How the financial report (including events and transactions) may be susceptible to material misstatement due to fraud, particularly in areas where fraud risk factors are present. The application of accounting principles and methods that may be susceptible to material misstatement due to management bias. Deficiencies in internal control that present opportunities for those charged with governance, management, or others within the entity to commit fraud.

Example: Among the journal entries and other adjustments most susceptible to management override of controls are manual adjusting journal entries and other adjustments directly made to the financial report that occur after the closing of a financial reporting period and have little or no explanatory support.

Examples: Risks of material misstatement that may be strongly linked to fraud schemes that can occur over a long period of time (e.g., complex related party transaction structures that may obscure their economic substance). Anomalies or outliers in the journal entry data throughout the period that may be detected from the use of automated tools and techniques.

Examples:Indicators of possible management bias in how management made the accounting estimates that may represent a risk of material misstatement due to fraud include: Changes in methods, significant assumptions, sources, or items of data selected that are not based on new circumstances or new information, which may not be reasonable in the circumstances nor in compliance with the applicable financial reporting framework. Adjustments, made to the output of the model(s), that are not appropriate in the circumstances when considering the requirements of the applicable financial reporting framework.

Examples: Analysing the activity in an estimate account during the year and comparing it to the current and prior period estimates. Benchmarking assumptions used for the estimate, using data visualisation to understand the location of point estimates within the range of acceptable outcomes. Using predictive analytics to identify the likelihood of future outcomes based on historical data.

Examples: Uncharacteristically large amounts of income being reported in the last few weeks of the reporting period. Unusual transactions. Income or expenses that is inconsistent with trends in cash flow from operations:o Uncharacteristically low amounts of revenue or expenses at the start of the subsequent period; oro Uncharacteristically high levels of refunds or credit notes at the start of the subsequent period.

Examples: Consulting with others in the firm. Obtaining legal advice from external counsel to understand the engagement partner’s options and the professional or legal implications of taking any particular course of action. Consulting on a confidential basis with a regulator or professional body (unless doing so is prohibited by law or regulation or would breach the duty of confidentiality).

Examples: New allegations of fraud were made by a disgruntled former employee. Management followed the policies and procedures in place at the entity and referred the matter to the legal and human resources departments. Since the entity’s policies and procedures were followed and prior allegations with similar facts and circumstances had been investigated and determined to be without merit, management determined that no further action was necessary. A suspected fraud involving a senior member of management was reported to those charged with governance by an employee. As a result, those charged with governance followed the policies and procedures in place at the entity, including engaging a certified fraud examiner to perform an independent forensic investigation.

Example: Based on an understanding of the suspected fraud obtained through understanding the entity’s whistleblower program, the engagement partner determined the suspected fraud was clearly inconsequential because it was limited to the misappropriation of immaterial assets by employees.

Example: Based on an understanding of the suspected fraud, the engagement partner believed the integrity of management was in question. Given the significance and pervasiveness of the matter, the engagement partner determined that no further work was to be performed across the entire audit engagement until the matter had been appropriately resolved.

Examples:Qualitative circumstances include whether a misstatement: Involves those charged with governance, management, related parties, or third parties that brings into question the integrity or competence of those involved. Affects compliance with law or regulation which may also affect the auditor’s consideration of the integrity of management, those charged with governance or employees. Affects compliance with debt covenants or other contractual requirements which may cause the auditor to question the pressures being exerted on management to meet certain earnings expectations.Quantitative circumstances include whether a misstatement: Affects key performance indicators such as earnings per share, net income and working capital, that may have a negative effect on the calculation of compensation arrangements for senior management at the entity. Affects multiple reporting periods such as when a misstatement has an immaterial effect on the current period’s financial report but is likely to have a material effect on future periods’ financial report.

Users of the financial report are interested in matters related to fraud about which the auditor had a robust dialogue with those charged with governance. The considerations in paragraph 60 focus on the nature of matters communicated with those charged with governance that are intended to reflect matters related to fraud that may be of particular interest to intended users.
In addition to matters that relate to the specific required considerations in paragraph 60, there may be other matters related to fraud communicated with those charged with governance that required significant auditor attention and that therefore may be determined to be key audit matters in accordance with paragraph 61.
Matters related to fraud are often matters that require significant auditor attention. For example, the identification of fraud or suspected fraud may require significant changes to the auditor’s risk assessment and re-evaluation of the planned audit procedures (i.e., a significant change in the audit approach).
The determination of key audit matters involves making a judgement about the relative importance of matters that required significant auditor attention. Therefore, it may be rare that the auditor of a complete set of general-purpose financial report of a publicly traded entity would not determine at least one key audit matter related to fraud. However, in certain limited circumstances, the auditor may determine that there are no matters related to fraud that are key audit matters in accordance with paragraph 61.
Accounting estimates are often the most complex areas of the financial report because they may be dependent on significant management judgement. Significant auditor attention may be required in accordance with paragraph 60(a) to respond to assessed risks of material misstatement due to fraud associated with an accounting estimate that involves significant management judgement. Significant management judgement is often involved when an accounting estimate is subject to a high degree of estimation uncertainty and subjectivity.

Example:The auditor determines significant auditor attention was required to respond to the risk of material misstatement due to fraud associated with the entity’s estimate of expected credit losses. Management utilises a model that requires a complex set of assumptions about future developments in a variety of entity-specific scenarios that are difficult to predict. Based on the auditor’s identification of aggressive profitability expectations of investment analysts about the entity, the auditor identified a risk of material misstatement due to fraud because of the subjectivity involved in the expected credit losses estimate and the incentive this creates for intentional management bias.

ASA 265 requires the auditor to communicate a significant deficiency in internal control to those charged with governance that is relevant to the prevention and detection of fraud. Significant deficiencies may exist even though the auditor has not identified misstatements during the audit. For example, the lack of a whistleblower program (or other program to report fraud) may be indicative of deficiencies in the entity’s control environment, but it may not directly relate to a risk of material misstatement due to fraud. The auditor may also communicate these deficiencies to management.
This ASA requires management override of controls to be a risk of material misstatement due to fraud (see paragraph 40) and presumes that there are risks of material misstatement due to fraud in revenue recognition (see paragraph 41). The auditor may determine these matters to be key audit matters related to fraud because risks of material misstatement due to fraud are often matters that both require significant auditor attention and are of most significance in the audit. However, this may not be the case for all these matters. The auditor may determine that certain risks of material misstatement due to fraud did not require significant auditor attention and, therefore, these risks would not be considered in the auditor’s determination of key audit matters in accordance with paragraph 60.
As described in ASA 701,[77] the auditor’s decision-making process in determining key audit matters is based on the auditor’s professional judgement about which matters were of most significance in the audit of the financial report of the current period. Significance can be considered in the context of quantitative and qualitative factors, such as relative magnitude, the nature and effect on the subject matter and the expressed interests of intended users or recipients.[78]
One of the considerations that may be relevant in determining the relative significance of a matter that required significant auditor attention, and whether such a matter is a key audit matter, is the importance of the matter to intended users’ understanding of the financial report as a whole.[79] As users of the financial report are interested in matters related to fraud, one or more of the matters related to fraud that required significant auditor attention in performing the audit, determined in accordance with paragraph 60, would ordinarily be of most significance in the audit of the financial report of the current period and therefore are key audit matters.
ASA 701[80] includes other considerations that may be relevant to determining which matters related to fraud that required significant auditor attention, were of most significance in the current period and therefore are key audit matters.

If a matter related to fraud is determined to be a key audit matter and there are a number of separate, but related, considerations that were of most significance in the audit, the auditor may communicate the matters together in the auditor’s report. For example, long-term contracts may involve significant auditor attention with respect to revenue recognition and revenue recognition may also be identified as a risk of material misstatement due to fraud. In such circumstances, the auditor may include in the auditor’s report one key audit matter related to revenue recognition with an appropriate subheading that clearly describes the matter, including that it relates to fraud.
Relating a matter directly to the specific circumstances of the entity may help to minimise the potential that such descriptions become overly standardised and less useful over time. In describing why the auditor considered the matter to be one of most significance in the audit, the auditor may highlight aspects specific to the entity (e.g., circumstances that affected the underlying judgements made in the financial report of the current period) so as to make the description more relevant for intended users. This may be particularly important in describing a key audit matter that recurs over multiple periods. Similarly, in describing how the key audit matter related to fraud was addressed in the audit, the auditor may highlight matters directly related to the specific circumstances of the entity, while avoiding generic or standardised language.
ASA 701[81] includes considerations and guidance on original information (information about the entity that has not otherwise been made publicly available by the entity) that may be particularly relevant in the context of communicating key audit matters related to fraud.
ASA 701[82] describes that management or those charged with governance may decide to include new or enhanced disclosures in the financial report or elsewhere in the annual report relating to a key audit matter in light of the fact that the matter will be communicated in the auditor’s report. Such new or enhanced disclosures, for example, may be included to provide more robust information about identified fraud or suspected fraud or identified deficiencies in internal control that are relevant to the prevention and detection of fraud.

Auditing Standard ASA 240Auditing Standard ASA 240

Get a plain-English read of Auditing Standard ASA 240

Auditing Standard ASA 240

The Auditor's Responsibilities Relating to Fraud in an Audit of a Financial Report

Application

Operative Date

Introduction

Scope of this Auditing Standard

Responsibilities of the Auditor, Management and Those Charged with Governance

Key Concepts in this ASA

Relationship with Other ASAs

Effective Date

Objectives

Definitions

Requirements

Professional Scepticism

Engagement Resources

Engagement Performance

Ongoing Nature of Communications with Management and Those Charged with Governance

Risk Assessment Procedures and Related Activities

Obtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework and the Entity’s System of Internal Control

Evaluation of Fraud Risk Factors

Identifying and Assessing the Risks of Material Misstatement due to Fraud

Responses to the Assessed Risks of Material Misstatement Due to Fraud

Overall Evaluation Based on Audit Procedures Performed

Fraud or Suspected Fraud (Ref: Para. A7–A11, A28 and A156–A172)

Auditor Unable to Continue the Audit Engagement

Auditor’s Report

Written Representations

Communications with Management and Those Charged with Governance

Reporting to an Appropriate Authority Outside the Entity

Documentation

Application and Other Explanatory Material

Responsibilities of the Auditor, Management and Those Charged with Governance

Key Concepts in this ASA

Relationship with Other ASAs (Ref: Para. 15)

Definitions (Ref: Para. 18)

Professional Scepticism (Ref: Para. 7, 19–22 and 55–58)

Engagement Resources (Ref: Para. 23)

Engagement Performance (Ref: Para. 24 and 29)

Ongoing Nature of Communications with Management and Those Charged with Governance (Ref: Para. 25)

Risk Assessment Procedures and Related Activities (Ref: Para. 26)

Obtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework and the Entity’s System of Internal Control

Evaluation of Fraud Risk Factors (Ref: Para. 38)

Identifying and Assessing the Risks of Material Misstatement due to Fraud (Ref: Para. 39)

Responses to the Assessed Risks of Material Misstatement Due to Fraud

Fraud or Suspected Fraud (Ref: Para. 55–58)

Auditor Unable to Continue the Audit Engagement (Ref: Para. 59)

Auditor’s Report (Ref: Para. 60–62)

Written Representations (Ref: Para. 63)

Communications with Management and Those Charged with Governance (Ref: Para. 64–66)

Reporting to an Appropriate Authority Outside the Entity (Ref: Para. 67)

Documentation (Ref: Para. 68)