ISA 240 Never Says “Fraud Triangle” — and Its Definition Has Only Two Sides

The fraud triangle is taught in every forensic accounting course and it does not appear in the auditing standards by that name. ISA 240 never uses the phrase. What it does contain is the same three conditions in its own words — and, until the revised standard takes effect, a formal definition that carries only two of them.

The three conditions, in the standard's language

ISA 240's application material states it at paragraph A1: "Fraud, whether fraudulent financial reporting or misappropriation of assets, involves incentive or pressure to commit fraud, a perceived opportunity to do so and some rationalization of the act."

It names them as a set at paragraph A26, classifying its illustrative risk factors "based on the three conditions that are generally present when fraud exists: an incentive or pressure to commit fraud; a perceived opportunity to commit fraud; and an ability to rationalize the fraudulent action."

So the substance of the triangle is there, sourced to the standard rather than to criminology. Two qualifications come with it, and both are useful in practice.

The standard is candid that the third condition is largely unobservable: risk factors "reflective of an attitude that permits rationalization of the fraudulent action may not be susceptible to observation by the auditor". And it refuses to rank them — "fraud risk factors cannot easily be ranked in order of importance".

It also makes a point that cuts against the common framing of fraud as a character problem: "even otherwise honest individuals can commit fraud in an environment that imposes sufficient pressure on them." The triangle is about conditions, not about identifying bad people.

The two-legged definition

Here is the asymmetry worth knowing. The three conditions live in application material. The defined term is narrower.

The extant standard's paragraph 12(b) defines fraud risk factors as "events or conditions that indicate an incentive or pressure to commit fraud or provide an opportunity to commit fraud". Incentive and opportunity. Rationalisation is absent from the definition while present in the explanatory material a few pages later.

ISA 240 (Revised), effective for periods beginning on or after 15 December 2026, closes the gap. Its paragraph 18(b) defines fraud risk factors as events or conditions indicating an incentive or pressure, or providing an opportunity, "or an attitude or rationalization that justifies the fraudulent action". The three conditions themselves carry across unchanged.

The practical consequence is small but real. Anyone who built a risk-factor framework from the definition rather than the application material built a two-sided one, and the revision makes that inconsistency visible. Our piece on the two live versions of ISA 240 covers the rest of what changes and when.

A precision that matters if you cite the standard

The three conditions sit in application and other explanatory material, and the illustrative risk factors sit in an appendix. They are not requirements. The standard says so of the appendix directly: the risk factors described there "are only examples and other risk factors may exist".

That is not a reason to treat them lightly. It is a reason to be accurate about what you are citing. A training note that presents the fraud triangle as a requirement of ISA 240 has overstated it; one that presents it as the standard's own classification of conditions generally present when fraud exists has it right.

What the standard does require, and the techniques it names

The requirements sit elsewhere, and two of them are unconditional.

The auditor must presume a risk of fraud in revenue recognition, and if that presumption is rebutted the reasons must be documented. And management override of controls is treated as a risk in every audit: the standard states the risk "is nevertheless present in all entities" and is therefore a significant risk, without any rebuttal route.

On what fraudulent financial reporting actually looks like, the standard is more concrete than most summaries suggest. It names manipulation, falsification including forgery, or alteration of accounting records or supporting documentation; misrepresentation in or intentional omission from the financial statements; and intentional misapplication of accounting principles as to amount, classification, presentation or disclosure.

On override techniques specifically it names recording fictitious journal entries, particularly close to period end; inappropriately adjusting assumptions and changing judgments; concealing facts; engaging in complex transactions structured to misrepresent position or performance; and altering records and terms of significant unusual transactions.

It also draws the line between that and theft. Misappropriation of assets "involves the theft of an entity's assets and is often perpetrated by employees in relatively small and immaterial amounts", though management are "usually more able to disguise or conceal" it. And it is "often accompanied by false or misleading records or documents" to hide the gap.

Where responsibility sits

Worth restating because it is routinely got backwards: "the primary responsibility for the prevention and detection of fraud rests with both those charged with governance of the entity and management." The auditor's obligation is reasonable assurance, with the standard acknowledging an "unavoidable risk" that some material misstatements go undetected even in a properly planned and performed audit.

For a practical treatment using documented fraud cases, see our forensic accounting CPD course, and for the control-side work, our internal audit fundamentals CPD course. The standard itself is published by the IAASB.