ISA 240 The Auditor's Responsibilities Relating to Fraud

ISA 240 The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements is the international auditing standard that sets out how auditors address the risk of fraud. Fraud is one of the most serious risks an auditor faces, and ISA 240 provides the framework for dealing with it. This practical guide explains what ISA 240 covers, the types of fraud, where responsibility lies, the auditor's approach, and why it matters — in plain language. It's a core auditing topic, relevant to ACCA study. (Always refer to the standard for authoritative requirements.)

What is ISA 240?

ISA 240 deals with the auditor's responsibilities relating to fraud when auditing financial statements. Fraud, in this context, is an intentional act involving the use of deception to obtain an unjust or illegal advantage. The standard sits alongside ISA 315 (identifying and assessing risks) and ISA 330 (responding to risks), applying those principles specifically to the heightened challenge that fraud presents.

The two types of fraud

ISA 240 distinguishes two types of intentional misstatement relevant to the auditor:

• Fraudulent financial reporting — deliberately misstating the financial statements, for example by manipulating, falsifying or altering records, misrepresenting transactions, or intentionally misapplying accounting standards. This is often driven by pressure to meet targets or expectations.
• Misappropriation of assets — the theft of an entity's assets, such as stealing cash or inventory, often accompanied by false records to conceal it.

The fraud triangle

A useful concept underlying fraud risk is the fraud triangle, which describes three factors typically present when fraud occurs. Incentive or pressure — a reason to commit fraud, such as financial difficulty or pressure to hit targets. Opportunity — circumstances that allow it, such as weak controls or the ability to override them. And rationalisation or attitude — a mindset that lets the person justify the act. Auditors find this framework helpful in thinking about where and why fraud might arise, and ISA 240's risk-assessment requirements reflect these underlying drivers.

Where responsibility lies

A crucial point in ISA 240 is the division of responsibility. The primary responsibility for the prevention and detection of fraud rests with those charged with governance and management of the entity — not the auditor. The auditor's responsibility is to obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by fraud or error. The auditor does not guarantee that all fraud will be detected, but must plan and perform the audit to address the risk that fraud could cause a material misstatement.

The auditor's approach

ISA 240 requires auditors to take fraud seriously throughout the audit:

• Professional scepticism. The auditor must maintain professional scepticism throughout, recognising the possibility of fraud despite past experience of management's honesty.
• Engagement team discussion. The team discusses how and where the financial statements might be susceptible to fraud.
• Risk assessment and response. The auditor identifies and assesses the risks of material misstatement due to fraud, and designs responses — including unpredictable procedures.
• Presumed risks. ISA 240 presumes there are risks of fraud in revenue recognition, and always requires procedures to address the risk of management override of controls — a risk present in every entity.
• Communication. The auditor communicates fraud-related matters to management and those charged with governance as appropriate.

Why fraud is so challenging — and why ISA 240 matters

The risk of not detecting a material misstatement from fraud is higher than from error, because fraud is deliberately concealed, may involve collusion, and can involve management override of the very controls designed to prevent it. ISA 240 matters because it equips auditors to confront this challenge systematically — through scepticism, targeted risk assessment, and procedures aimed squarely at the areas where fraud is most likely. Given the damage fraud can do to investors and confidence in financial reporting, it's one of the most important auditing standards.

Frequently asked questions

What is ISA 240?

The international auditing standard on the auditor's responsibilities relating to fraud — intentional acts of deception to gain an unjust advantage — in an audit of financial statements.

What are the two types of fraud?

Fraudulent financial reporting (deliberately misstating the financial statements) and misappropriation of assets (theft of the entity's assets, often concealed with false records).

Who is responsible for preventing fraud?

Primary responsibility rests with those charged with governance and management. The auditor's role is to obtain reasonable assurance the financial statements are free from material misstatement, whether from fraud or error.

Why is fraud harder to detect than error?

Because it is deliberately concealed, may involve collusion, and can involve management override of controls — so ISA 240 requires heightened scepticism and procedures, including for revenue recognition and management override.

Build your auditing skills with Learnsignal

Standards like ISA 240 are central to auditing. Learnsignal's tutor-led ACCA courses develop the audit knowledge the ISAs require — with clear teaching and exam-focused practice. (Always refer to the latest text of the standard for authoritative requirements.)