Auditing Standard ASA 240 The Auditor's Responsibilities Relating to Fraud in an Audit of a Financial Report (October 2025)
Fraud or Suspected Fraud (Ref: Para. 55—Fraud or Suspected Fraud (Ref: Para. 55—58)
Start here
Get a plain-English read of Fraud or Suspected Fraud (Ref: Para. 55—
Turn the raw legal text into a practical explanation grounded in Auditing Standard ASA 240 The Auditor's Responsibilities Relating to Fraud in an Audit of a Financial Report (October 2025).
If the auditor identifies fraud or suspected fraud, the firm’s policies or procedures may include actions for the engagement partner to take, depending on the facts and circumstances of the audit engagement and the nature of the fraud.
Examples: Consulting with others in the firm. Obtaining legal advice from external counsel to understand the engagement partner’s options and the professional or legal implications of taking any particular course of action. Consulting on a confidential basis with a regulator or professional body (unless doing so is prohibited by law or regulation or would breach the duty of confidentiality).
In accordance with ASA 220,[70] the engagement partner is required to take responsibility for making the engagement team aware of the firm’s policies or procedures related to relevant ethical requirements. This includes the responsibilities of members of the engagement team when they become aware of an instance of non-compliance with laws and regulations by the entity, which includes instances of fraud.
Obtaining an Understanding of the Fraud or Suspected Fraud
The determination of which level of management is the appropriate one is a matter of professional judgement and is affected by such factors as the likelihood of collusion and the nature and magnitude of the suspected fraud. Ordinarily, the appropriate level of management is at least one level above the persons who appear to be involved with the fraud or suspected fraud.
When obtaining an understanding of the fraud or suspected fraud, the auditor may do one or more of the following depending on the facts and circumstances of the audit engagement and the nature of the fraud:
Involve an auditor’s expert, such as an individual with forensic skills.
Inspect the entity’s whistleblower program files for additional information.
Make further enquiries of:
o The entity’s in-house counsel or external legal counsel.
o Individuals within the internal audit function (if the function exists).
Evaluating the Entity’s Process to Investigate and Remediate the Fraud or Suspected Fraud
The nature and extent of the entity’s process to investigate the fraud or suspected fraud undertaken by management or those charged with governance may vary based on the circumstances, and may be influenced by the entity’s assessment of the significance of fraud risks relevant to the entity’s financial reporting objectives. For example, an entity’s whistleblower program (or other program to report fraud) may set out policies or procedures to be followed in relation to investigation and remediation of matters, including the establishment of thresholds for taking further action.
Examples: New allegations of fraud were made by a disgruntled former employee. Management followed the policies and procedures in place at the entity and referred the matter to the legal and human resources departments. Since the entity’s policies and procedures were followed and prior allegations with similar facts and circumstances had been investigated and determined to be without merit, management determined that no further action was necessary. A suspected fraud involving a senior member of management was reported to those charged with governance by an employee. As a result, those charged with governance followed the policies and procedures in place at the entity, including engaging a certified fraud examiner to perform an independent forensic investigation.
When evaluating the appropriateness of the entity’s investigation process and remedial actions implemented to respond to the fraud or suspected fraud in accordance with paragraphs 55(b) and 55(c), the auditor may consider:
In relation to the entity’s process to investigate the fraud or suspected fraud:
o The objectivity and competence of individuals involved in the entity’s process to investigate the fraud or suspected fraud.
o The nature, timing and extent of procedures to investigate the fraud or suspected fraud, including identification of root causes, if applicable.
In relation to the entity’s actions to remediate the fraud or suspected fraud:
o Whether the remedial actions address the root cause(s).
o Whether the remedial actions are proportionate to the severity and pervasiveness of the identified fraud or suspected fraud and the urgency with which the matter needs to be addressed, including how management:
Responded to any misstatements that were identified (e.g., the timeliness of when the identified misstatements were corrected by management).
Responded to the fraud (e.g., disciplinary, or legal sanctions imposed on the individuals involved in perpetrating the fraud).
Addressed the control deficiencies regarding the prevention or detection of the fraud.
The auditor may use information obtained from their understanding of the entity’s whistleblower program in accordance with paragraph 32(a)(ii), including the entity’s process for investigating and remediating allegations of fraud that came through the entity’s whistleblower program, to determine whether a fraud or suspected fraud is clearly inconsequential.
Example: Based on an understanding of the suspected fraud obtained through understanding the entity’s whistleblower program, the engagement partner determined the suspected fraud was clearly inconsequential because it was limited to the misappropriation of immaterial assets by employees.
Impact on the Overall Audit Strategy
The understanding obtained about the fraud or suspected fraud impacts the engagement partner’s determination of whether and how to adjust the overall audit strategy, including determining whether there is a need to perform additional risk assessment procedures or further audit procedures, especially in circumstances when information comes to the engagement partner’s attention that differs significantly from the information available when the overall audit strategy was originally established.[71]
As described in ASA 220,[72] in fulfilling the requirement in paragraph 56, the engagement partner may obtain information from other members of the engagement team (e.g., component auditors).
Based on the understanding obtained about the fraud or suspected fraud and the impact on the overall audit strategy, the engagement partner may determine that it is necessary to discuss an extension of the audit reporting deadlines with management and those charged with governance, where an extension is possible under applicable law or regulation. If an extension is not possible, ASA 705 deals with the implications for the auditor’s opinion on the financial report.
Example: Based on an understanding of the suspected fraud, the engagement partner believed the integrity of management was in question. Given the significance and pervasiveness of the matter, the engagement partner determined that no further work was to be performed across the entire audit engagement until the matter had been appropriately resolved.
The Auditor Identifies a Misstatement Due to Fraud
ASA 450[73] and ASA 700[74] establish requirements and provide guidance on the evaluation of misstatements and the effect on the auditor’s opinion in the auditor’s report.
The following are examples of qualitative or quantitative circumstances that may be relevant when determining whether the misstatement due to fraud is material:
Examples:Qualitative circumstances include whether a misstatement: Involves those charged with governance, management, related parties, or third parties that brings into question the integrity or competence of those involved. Affects compliance with law or regulation which may also affect the auditor’s consideration of the integrity of management, those charged with governance or employees. Affects compliance with debt covenants or other contractual requirements which may cause the auditor to question the pressures being exerted on management to meet certain earnings expectations.Quantitative circumstances include whether a misstatement: Affects key performance indicators such as earnings per share, net income and working capital, that may have a negative effect on the calculation of compensation arrangements for senior management at the entity. Affects multiple reporting periods such as when a misstatement has an immaterial effect on the current period’s financial report but is likely to have a material effect on future periods’ financial report.
The implications of an identified misstatement due to fraud on the reliability of information intended to be used as audit evidence depends on the circumstances. For example, an otherwise insignificant fraud may be significant if it involves senior management. In such circumstances, the reliability of information previously obtained and intended to be used as audit evidence may be called into question as there may be doubts about the completeness and truthfulness of representations made and about the authenticity of accounting records and documentation.
Since fraud involves incentive or pressure to commit fraud, a perceived opportunity to do so or some rationalisation of the act, an instance of fraud is unlikely to be an isolated occurrence. Misstatements, such as numerous misstatements at a business unit or geographical location even though the cumulative effect is not material, may also be indicative of a risk of material misstatement due to fraud.
Considerations Specific to Public Sector Entities
For public sector entities, an example of both qualitative and quantitative circumstance includes whether a misstatement affects the determination of the surplus or deficit reported for the period, or whether or not the public sector entity has met or exceeded its approved budget, including where relevant, whether its expenses are within statutory limits.
Determining if Control Deficiencies Exist
ASA 265[75] provides requirements and guidance about the auditor’s communication of significant deficiencies in internal control identified during the audit to those charged with governance. Examples of matters that the auditor considers in determining whether a deficiency or combination of deficiencies in internal control constitutes a significant deficiency include:
The susceptibility to loss due to fraud of the related asset or liability.
The importance of the controls to the financial reporting process (e.g., controls over the prevention and detection of fraud).
Indicators of significant deficiencies in internal control include, for example:
Evidence of ineffective aspects of the control environment, such as the identification of management fraud, whether or not material, that was not prevented by the entity’s system of internal control.
The lack of a process to investigate the fraud or suspected fraud or a process to investigate the fraud or suspected fraud that is not appropriate in the circumstances.
The lack of, or ineffective, remediation measures implemented by management to prevent or detect the reoccurrence of the fraud or suspected fraud.
Section Fraud or Suspected Fraud (Ref: Para. 55— - Auditing Standard ASA 240 The Auditor's Responsibilities Relating to Fraud in an Audit of a Financial Report (October 2025) - Fraud or Suspected Fraud (Ref: Para. 55—58) | Zoe