Australian National Audit Office Auditing Standards 2024

The instrument’s core concept is the “ANAO Auditing Standards”, defined as the collection of standards described in clauses 5 to 7, to the extent they are not inconsistent with the Auditor-General Act or other relevant legislation, and to the extent they apply to the particular audit or review activity. The standards are not set out in full in the instrument; instead they are incorporated by reference to external documents that may change over time. Clause 5(a) incorporates all AUASB standards made under the ASIC Act and Corporations Act that are “current from time to time”, meaning the body of standards automatically updates as the AUASB issues new or revised standards. This ambulatory incorporation places the onus on practitioners to monitor AUASB pronouncements. Clause 5(b) adds a fixed list of seven standards (ASA 805, ASRE 2400, ASRE 2405, ASAE 3000, ASAE 3100, ASAE 3150, ASRS 4400) with specified issue dates, which do not automatically update unless the instrument is amended.

A notable conceptual addition is the definition of “ethics” in clause 4. Ethics is defined as “the performance principle relating to the extent to which the proposed use of public resources is consistent with the core beliefs and values of society.” The definition elaborates that ethical behaviour would be expected of a person in a similar situation, and includes managing conflicts of interest and approving commitments based on facts without personal bias. Importantly, the definition requires ethics to be balanced with efficiency, effectiveness and economy. This is a shift from the traditional public sector audit trinity of economy, efficiency and effectiveness. By elevating ethics to a co equal criterion, the instrument expands the scope of judgement in performance audits. The definition is inherently vague (“core beliefs and values of society”) which may increase audit risk and challenge for auditors and auditees alike.

For performance audits, the key concept is the modified application of ASAE 3500. The instrument substitutes ethics into the performance criteria, but deliberately excludes the requirement to obtain an understanding of internal controls relevant to evaluating performance against criteria (paragraph 33), the procedures relating to non-compliance with laws and regulations (paragraph 34), and the requirements for assurance report content (paragraph 45). This means the report content is instead governed by the ISSAI 3000 paragraphs 116, 122, 124 and 126. Additionally, the instrument permits the Auditor General or Independent Auditor to elect to treat a performance audit as a compliance engagement under ASAE 3100 (with its own modifications and ISSAI 4000 reporting requirements). This elective flexibility allows the audit approach to be tailored based on the subject matter, but also introduces a layer of discretion that may affect comparability across audits.

The instrument also introduces the concept of “commencement” for the purpose of determining applicable standards: the date of registration as shown in the commencement table.

The primary persons required to comply with these standards are those performing an audit or review under the Auditor-General Act 1997 and the PGPA Act. This includes ANAO staff, contractors engaged by the ANAO, and the Independent Auditor of the ANAO (appointed under Division 2 of Part 7 of the Act). For annual financial statement audits, the relevant personnel are those conducting audits of Commonwealth entities, Commonwealth companies, and the whole of government consolidated financial statements. For annual performance statement audits under Division 1A of Part 4, the auditors are assessing whether entities’ performance statements comply with the PGPA Rule and present fairly the entity’s performance. Performance audits under Division 2 cover a wide range of program and entity evaluations, often involving significant public expenditure; the auditors here must apply the modified ASAE 3500 and ISSAI 3000 reporting requirements.

Indirectly, the instrument affects the audited entities themselves. Commonwealth entities, their accountable authorities, and officials must cooperate with auditors and provide access to information. Because the standards now incorporate an ethics criterion, audited entities may face additional scrutiny regarding the ethical dimensions of their resource use, including how they manage conflicts of interest and ensure decisions are free from personal bias. This could increase the burden of documentation and justification, particularly for decisions involving discretionary spending or procurement. The vague definition of ethics may lead to inconsistent expectations between entities and auditors, raising compliance costs and potential disputes.

The instrument also affects the users of audit reports: the Parliament, the Minister for Finance, the Joint Committee of Public Accounts and Audit, and the public. The modified standards may change the form and content of audit opinions, particularly for performance audits where the report content is now governed by ISSAI 3000 paragraphs rather than the full ASAE 3500 report requirements. Any change in audit methodology or criteria can affect the reliability and comparability of audit findings over time.

Professionals in the auditing and accounting industry who may be contracted by the ANAO need to be aware that the ANAO Auditing Standards differ from the standards applicable to private sector audits under the Corporations Act. The inclusion of the ethics dimension, the exclusion of certain ASAE 3500 paragraphs, and the adoption of INTOSAI reporting requirements represent a distinct framework. Firms that also provide services to government entities in a consulting capacity must be careful to avoid conflicts of interest and to ensure their engagement terms align with the ethics principle.

Finally, the ANAO itself is affected as an organisation. The instrument applies to audits of the ANAO under Division 2 of Part 7, conducted by an Independent Auditor. The standards set the benchmark for how the ANAO’s own performance and financial statements are audited, creating a degree of accountability for the national auditor. This self-referential structure, while not unique, requires careful design to maintain independence and credibility.

The central duty imposed by the instrument is the obligation to comply with the ANAO Auditing Standards when performing the covered audit or review functions. Clause 3 expressly states that the standards are set under section 24 of the Act, and by operation of that section, compliance is mandatory. The duty applies to all persons performing the functions, not only to the Auditor-General or the Independent Auditor. This means that every ANAO employee or contractor involved in such work must adhere to the standards.

There is a right to rely on the standards as the authoritative benchmark for the performance of audit work. Because the instrument incorporates external standards by reference, auditors have the right to apply the methodologies, documentation requirements, and reporting formats contained in the AUASB standards, subject to the modifications and exclusions. For example, in a performance audit, the auditor may rely on the modified ASAE 3500 as the basis for planning and performing the engagement, but must follow the ISSAI 3000 reporting requirements rather than paragraph 45 of ASAE 3500.

The instrument also confers a significant discretionary right on the Auditor-General and the Independent Auditor of the ANAO. Clause 7 allows them to elect to conduct a performance audit wholly or partly as a compliance engagement under ASAE 3100, modified as specified. This election can be made on a case by case basis, giving flexibility to tailor the audit approach to the subject matter. The same right applies to performance audits of the ANAO under Division 2 of Part 7. This discretion is not available to other persons performing audits; it is reserved to the top office holders. The election must be made before or during the conduct of the audit, and once made, the compliance engagement standards apply to that extent.

Duties also arise from the transitional provisions in clause 9. For annual financial statement audits and annual performance statement audits, the applicable standards are those in force during the reporting period to which the subject matter relates. This imposes a duty on the auditor to identify the correct version of the standards based on the reporting period, rather than the date of audit fieldwork. For performance audits and assurance reviews, the applicable standards are those in force at the commencement of the audit or review. This provides certainty that a change in standards mid audit will not retrospectively apply. However, it also imposes a duty on the auditor to ascertain the commencement date and to monitor whether any subsequent changes in standards affect the work.

There is also a duty to ensure consistency with the Act and other relevant legislation. Clause 5 provides that the standards apply only to the extent they are not inconsistent with requirements of the Act or other legislation. This is a hierarchy provision: if a provision in an AUASB standard conflicts with the Auditor-General Act or the PGPA Act, the legislation prevails. The auditor must be able to identify such conflicts and apply the overriding law.

No explicit rights are granted to audited entities under this instrument, but they have an indirect right to have their audits conducted according to a known and publicly available set of standards. The instrument is registered on the Federal Register of Legislation, satisfying the requirements for legislative instruments to be accessible.

The instrument does not itself create penalties for non-compliance. It is a legislative instrument that sets standards, not a penal statute. Enforcement flows from the underlying legislation. Section 24 of the Auditor-General Act 1997 requires compliance with the auditing standards set under that section. Failure to comply could result in internal disciplinary action under the ANAO’s Code of Conduct or the Public Service Act 1999, if the person is an APS employee. For contractors, non-compliance could lead to termination of contract or professional liability claims.

The most immediate consequence of non-compliance is the effect on the audit opinion. If an audit is not conducted in accordance with the ANAO Auditing Standards, the resulting report may be qualified, adverse, or the auditor may disclaim an opinion. Such qualifications could have significant consequences for the audited entity, including adverse parliamentary scrutiny, potential remedial action by the Minister or the Department of Finance, and reputational damage. For the ANAO itself, a qualified audit opinion on its financial statements or performance could undermine its credibility.

The instrument modifies the content of the assurance report for performance audits. Under clause 6(a)(iii), paragraph 45 of ASAE 3500 is excluded, and instead the reporting requirements from ISSAI 3000 paragraphs 116, 122, 124 and 126 apply. This means the auditor must structure the report to include an objective, scope, methodology, criteria, findings, conclusions and recommendations in accordance with those international standards. If the auditor fails to include the required elements, the report may not be considered compliant, again affecting the opinion.

For compliance engagements elected under clause 7, paragraph 56 of ASAE 3100 regarding assurance report content is excluded, and reporting must follow ISSAI 4000 paragraphs 202, 210 and 218. The same enforcement logic applies: non-compliance with those reporting requirements undermines the validity of the report.

In addition, the Auditor-General and the Independent Auditor have oversight responsibilities. The Auditor-General, as maker of the instrument, is also responsible for ensuring that ANAO staff comply. The Independent Auditor of the ANAO is subject to the standards when auditing the ANAO. If that Independent Auditor fails to comply, there is no direct external regulator, but the Parliament and the Joint Committee of Public Accounts and Audit could raise concerns.

The incorporation by reference of standards that are “current from time to time” (clause 5(a)) creates a moving target. If a practitioner fails to apply a newly issued AUASB standard that falls within clause 5(a), they would be non-compliant even if unaware of the change. This increases the risk of inadvertent non-compliance and places a premium on continuous professional development.

There is no express provision for civil penalties or criminal offences for breach of these standards. Enforcement is largely reputational, professional, and contractual. However, because the standards are given legal force through the Act, a serious breach could potentially be considered misconduct or failure to perform duties, leading to removal from office (in the case of the Auditor-General) or termination of engagement.

The instrument is made under section 24 of the Auditor-General Act 1997 and must be read in conjunction with that Act. The Act itself sets out the functions of the Auditor-General, the types of audits, and the powers to obtain information. The standards supplement those provisions by specifying the professional and technical requirements for conducting the audits. Clause 5 provides that the standards apply only to the extent they are not inconsistent with requirements of the Act or other relevant legislation. This establishes a clear hierarchy: the Act overrides any conflicting standard.

The instrument also interacts with the Public Governance, Performance and Accountability Act 2013. Section 49 of the PGPA Act requires the Auditor-General to audit the annual consolidated financial statements of the Australian Government. The instrument explicitly covers that audit (clause 3(c)). The PGPA Act also governs performance statements and annual reports, which are the subject matter of assurance reviews under Division 1A of Part 4 of the Auditor-General Act. The standards therefore set the bar for how those statements are audited.

The AUASB standards incorporated by reference derive their authority from the Australian Securities and Investments Commission Act 2001 and the Corporations Act 2001. Those Acts empower the AUASB to make auditing and assurance standards that have legal effect for corporations law audits. By incorporating those same standards into the ANAO framework, the instrument creates a degree of harmonisation between private and public sector audit standards, but with adjustments. For example, the ethics definition and the modifications to ASAE 3500 depart from the standard ASAE 3500 wording, meaning the public sector framework is not identical.

The instrument also references INTOSAI standards (ISSAI 3000 and ISSAI 4000). INTOSAI is an international organisation of supreme audit institutions; its standards are not legislated in Australia but are adopted voluntarily. By incorporating specific paragraphs of ISSAI 3000 and 4000, the instrument gives those paragraphs legal force for ANAO audits. This is a notable interaction: non binding international guidelines become binding domestic requirements for the ANAO.

There is a potential interaction with the freedom of information regime and the Privacy Act 1988. Audit reports are usually tabled in Parliament, so they are public. However, the standards require auditors to consider ethics, which may involve handling sensitive information about decision-makers. The auditor must balance transparency with legal obligations to protect personal information.

The Competition and Consumer Act 2010 could be relevant if ANAO standards affect procurement or contracting practices in a way that distorts competition, but this is indirect.

Because the instrument is a legislative instrument, it is subject to disallowance by either House of Parliament under the Legislation Act 2003. However, standards set by the Auditor-General under section 24 are not automatically disallowable under all circumstances; the practitioner should check the specific legislative framework.

The instrument states at clause 8 that it revokes all previous auditing standards set under section 24 of the Auditor-General Act 1997. This is a complete replacement of the prior framework. The instrument itself was made on 9 January 2024 by the Auditor-General, Grant Hehir, and commenced on the date of registration. The text does not identify the previous standards by name or date, but it is clear that they are no longer in force.

The instrument does not include any transitional provisions regarding the revocation other than clause 9, which specifies which version of the standards applies to audits already in progress or covering past periods. For annual financial statement and annual performance statement audits, the applicable standards are those in force during the reporting period to which the subject matter relates. This means that if an audit covers a reporting period that ended before the 2024 standards were registered, the prior standards continue to apply even after revocation. For performance audits and assurance reviews, the applicable standards are those in force at the commencement of the audit or review. So a performance audit that started before January 2024 but concluded after would still use the old standards for that engagement.

These transitional provisions prevent retroactive changes and provide certainty, but they also mean that practitioners may need to maintain familiarity with the revoked standards for some time, particularly for financial statement audits covering periods that may cross multiple reporting periods. There is no sunset date for the old standards; they remain relevant as long as there are outstanding audits for prior reporting periods or commenced engagements.

The instrument itself may be amended in future by a new instrument made under section 24. The reference to AUASB standards “current from time to time” in clause 5(a) is a form of automatic updating that does not require amendment of this instrument. However, changes to the listed standards in clause 5(b) or to the modifications in clauses 6 and 7 would require a new legislative instrument. The instrument is likely to be reviewed periodically as AUASB and INTOSAI issue new standards.

No amendment history is provided within the source, as it is the original instrument. Users should consult the Federal Register of Legislation for any subsequent amending instruments.

The source text for this instrument does not refer to any litigation. As a legislative instrument only recently made (January 2024), there is no known case law interpreting it. However, it is possible to identify areas that could potentially lead to disputes in the future.

The definition of “ethics” in clause 4 is a likely source of litigation or at least formal disagreement. The phrase “core beliefs and values of society” is inherently contestable. What constitutes society’s core beliefs may change over time or differ among communities. If an audited entity challenges an adverse finding based on an alleged failure to meet the ethics criterion, a court or tribunal might need to interpret the term. The instrument provides some guidance (managing conflicts of interest, avoiding personal bias) but these are illustrative, not exhaustive. The balancing requirement with efficiency, effectiveness and economy adds another layer of subjectivity.

The exclusion of paragraphs 33, 34 and 45 from ASAE 3500 could also lead to disputes. Paragraph 33 requires obtaining an understanding of internal controls relevant to performance criteria. Its exclusion means auditors are not required to assess controls in performance audits. If an audited entity believes the audit was flawed because controls were not considered, it might argue the audit was not conducted in accordance with proper standards. Conversely, the auditor might be criticised for not looking at controls even though the standard excludes that requirement. The instrument’s drafting is clear, but misunderstandings could arise.

The interaction between the ANAO Auditing Standards and the underlying Act’s provisions could also be litigated. Clause 5 limits the standards to the extent they are not inconsistent with the Act or other relevant legislation. If an AUASB standard arguably conflicts with the Auditor-General Act, a court may need to determine which prevails. For example, the Act might provide specific powers or limitations that a standard does not account for.

The transitional rules in clause 9 could be tested if there is ambiguity about when an audit “commenced” or what constitutes the “reporting period”. For performance audits, commencement might be the date the Auditor-General approved the audit plan or the date fieldwork began. The instrument does not define commencement for this purpose. Disputes could arise over which version of standards applied, affecting the validity of the audit report.

Because the standards govern the conduct of the Auditor-General and the ANAO, any litigation would likely involve judicial review under the Administrative Decisions (Judicial Review) Act 1977 or the Constitution. Given the ANAO’s role in holding government accountable, such litigation would be high profile but historically rare. No cases are currently known.

The instrument contains several traps for the unwary. First, the definition of “ethics” in clause 4 is extremely broad and subjective. It ties the concept to “core beliefs and values of society”, which provides little objective guidance. Auditors may struggle to apply this consistently, and audited entities may face unpredictable demands. The drafting also requires ethics to be balanced against the other criteria, but does not specify how much weight each should carry. This creates significant uncertainty and increases the risk of audit findings that are difficult to defend.

Second, the incorporation of AUASB standards “current from time to time” in clause 5(a) means that the applicable standards can change without any amendment to this instrument. A practitioner who applies an outdated version of an AUASB standard may inadvertently be non-compliant. There is no grace period provided for when a new AUASB standard becomes effective; the instrument simply adopts whatever is current. This imposes an ongoing monitoring burden and could lead to compliance failures when new standards are issued with short lead times.

Third, the modifications to ASAE 3500 (clause 6) are not trivial. Three entire paragraphs are excluded: paragraph 33 (understanding internal controls), paragraph 34 (non compliance procedures), and paragraph 45 (assurance report content). A practitioner familiar with the standard ASAE 3500 might inadvertently include these requirements in their audit methodology. The instrument clearly states the exclusions, but in practice the auditor must actively delete those requirements from their procedures. The replacement of report content with ISSAI 3000 paragraphs is another potential pitfall: the ISSAI requirements may be less prescriptive, leading to inconsistency in reporting formats.

Fourth, the elective provision in clause 7 allows the Auditor-General or Independent Auditor to conduct a performance audit as a compliance engagement using ASAE 3100. This election is discretionary and not publically notified in advance necessarily. Auditees may be unaware whether their audit is being conducted under the performance standard or the compliance standard, which could affect the nature of the audit and the conclusions. The standards applied differ significantly (ASAE 3500 modified vs ASAE 3100 modified), and the auditee’s obligations may vary. There is no requirement for the auditor to notify the auditee of the election, though professional practice would likely require it.

Fifth, clause 9(a) for annual audits refers to “the ANAO Auditing Standards in force during the reporting period to which the subject matter of the audit relates.” If the reporting period spans multiple standards (e.g., if standards changed mid year), it is unclear which version applies to which part of the period. The instrument does not provide a rule for partial periods. The most natural reading is that the standards in force at each point during the period apply to that portion, creating a hybrid standard for the audit. This could be extremely confusing to apply in practice.

Sixth, the revocation of all previous standards (clause 8) could create archival problems. Practitioners need to retain copies of the old standards for transitional purposes, but there is no obligation on the regulator to keep them publicly accessible beyond normal legislative registers.

Finally, the instrument does not contain any provision for relief from compliance in exceptional circumstances, nor any mechanism to resolve disputes about interpretation of the standards. Auditors and auditees are left to work through difficulties informally or through the ANAO’s internal processes.

Compliance with the ANAO Auditing Standards requires systematic attention to several layers. For any given audit or review, the first step is to identify the correct category of engagement: financial statement audit (annual), performance statement audit (annual), performance audit, assurance review, audit of the ANAO, or consolidated financial statements audit. Each category determines which standards apply under clauses 5, 6 or 7.

For annual financial statement audits (Divisions 1 and 1A of Part 4, and section 49 PGPA), the applicable standards are: all AUASB standards made under paragraph 227B(1)(a) of the ASIC Act and section 336 of the Corporations Act that are current from time to time, plus the seven listed standards in clause 5(b). The practitioner must ensure that the version of each standard applied is the one current during the reporting period of the auditee, as per clause 9(a). This may require reconstructing what standards were in force months or years earlier. It is critical to document the reporting period and the applicable standards versions.

For performance audits under Division 2 (and Division 2 of Part 7 for ANAO audit), the default standards are ASAE 3500 modified as per clause 6, plus ISSAI 3000 reporting paragraphs 116,122,124,126. The practitioner must ensure that the audit methodology excludes paragraphs 33, 34 and 45 of ASAE 3500, and does not apply the standard’s report content requirements. Instead, the report must follow ISSAI 3000 structure. Additionally, the auditor must incorporate the ethics criterion into the performance criteria, replacing “economy, efficiency, effectiveness” with “economy, efficiency, effectiveness and/or ethics”. This substitution should be reflected in all relevant documentation: audit plan, criteria, evidence collection, and conclusions.

If the Auditor-General or Independent Auditor elects to conduct the performance audit as a compliance engagement under clause 7, the applicable standards become ASAE 3100 (modified) plus ISSAI 4000 reporting paragraphs 202,210,218. The exclusion of paragraph 56 of ASAE 3100 means the report content must follow ISSAI 4000 instead. The auditor must confirm the election has been made in writing and document the basis.

For assurance reviews under Division 2A of Part 4, the standards under clause 5 apply (AUASB standards plus listed ones). These reviews are typically not performance audits, so the special performance audit standards do not apply.

The definition of ethics in clause 4 must be understood and applied. Practitioners should develop a consistent approach to evaluating ethics, potentially using frameworks such as conflict of interest registers, probity checklists, and documentation of decision-making processes. Given the vagueness, auditors should seek legal advice on contentious cases and consider precedent from previous ANAO reports. It may be prudent to document how ethics was balanced against other criteria.

Because the instrument incorporates standards by reference, practitioners must maintain a current library of AUASB standards and monitor for updates. The ANAO should provide internal guidance, but individual auditors are responsible for staying informed. Subscription to AUASB announcements is advisable.

Internal procedures should include a checklist confirming which standards apply to each engagement, with cross references to clauses 5,6,7 and 9. For engagements that straddle standard changes, the transitional rules in clause 9 must be applied correctly. This may involve applying different standards to different parts of the engagement.

Finally, compliance should be documented in the audit file, including the basis for determining applicable standards, the election decision (if any), and the handling of ethics. The report should explicitly state that the audit was conducted in accordance with the ANAO Auditing Standards 2024 (or the relevant prior version). Failure to do so could result in a non‑compliant opinion.