Two Versions of ISA 240 Are Live. The Revised One Starts 15 December 2026

There are two versions of ISA 240 printed in the current IAASB handbook, and which one applies to an audit depends on when the audited period begins. The revised standard takes effect for audits of financial statements for periods beginning on or after 15 December 2026. For anyone auditing a calendar-year entity, that means the 2027 audit.

Two standards, side by side

The extant standard is ISA 240, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, effective for periods beginning on or after 15 December 2009. It has been in force, with conforming amendments, for the better part of two decades.

ISA 240 (Revised) was issued as a final pronouncement in July 2025, and carries its own effective date: periods beginning on or after 15 December 2026. Both texts appear in the 2025 edition of the IAASB handbook, under headings that differ only by the word "Revised". A reader who searches the handbook for ISA 240 and takes the first result may land on either.

The IAASB's own framing of why it revised the standard is short: the update "responds to global scrutiny and stakeholder concern regarding the auditor's role in detecting fraud".

The renumbering trap

Before quoting any paragraph number, check which text and which edition it comes from. The extant standard's numbering shifted when conforming amendments from the revised ISA 315 landed, and a great deal of online material still cites the older numbers.

In the currently published extant text, the revenue recognition presumption is paragraph 27, management override is paragraphs 32 and 33, and the documentation requirement for rebutting the revenue presumption is paragraph 48. Older summaries cite 26, 31 and 47 respectively. In the revised standard, the revenue presumption moves again, to paragraph 41.

So a training note, an audit methodology or a working paper that cites "ISA 240 paragraph 26" is quoting a text that has not been current for several years, and will be two revisions behind by the end of 2026.

What actually changes, beyond renumbering

Three changes matter in practice.

The definition of a fraud risk factor gains a third limb. In the extant standard, paragraph 12(b) defines fraud risk factors as "events or conditions that indicate an incentive or pressure to commit fraud or provide an opportunity to commit fraud". Two conditions. The revised standard's paragraph 18(b) adds "or an attitude or rationalization that justifies the fraudulent action".

This closes a genuine asymmetry. The three conditions generally present when fraud exists have always appeared in the standard's application material, but until the revision the defined term carried only two of them. Anyone who learned fraud risk factors from the definition rather than the application material learned a two-sided version.

Journal entry testing gains a completeness requirement. The extant standard requires the auditor, irrespective of their risk assessment, to test the appropriateness of journal entries, making inquiries of those involved in financial reporting, selecting period-end entries, and considering the need to test entries throughout the period.

The revised standard adds a requirement that does not exist today: to "obtain audit evidence about the completeness of the population of journal entries and other adjustments made throughout the period". It also hardens "consider the need to test" into "determine the need to test". For teams running data analytics over the ledger, the completeness of the extracted population becomes an evidential question rather than an assumption.

Rebutting the revenue presumption gets harder. Both versions presume a risk of fraud in revenue recognition, and both allow rebuttal with documented reasons. The revised standard's application material narrows the room considerably, stating that the significance of fraud risk factors "ordinarily makes it inappropriate for the auditor to rebut the presumption", and that there are only "limited circumstances" where rebuttal may be appropriate.

What does not change

Two anchors survive, and they are worth restating because they are frequently muddled in the other direction.

Primary responsibility for prevention and detection sits with the entity, not the auditor. The extant standard puts it plainly: "The primary responsibility for the prevention and detection of fraud rests with both those charged with governance of the entity and management." The revised standard keeps the substance while reordering the two parties, and adds a counterweight on the auditor's side — that the higher risk of missing fraud than error "does not diminish the auditor's responsibility" to plan and perform the audit properly.

And management override of controls remains a risk in every audit. Unlike the revenue presumption, it is not rebuttable: the extant standard states the risk "is nevertheless present in all entities", and the revised standard requires the auditor to treat it as a fraud risk at the financial statement level "irrespective of the auditor's assessment".

What to do in the next six weeks

Three practical steps. Establish which version applies to each engagement by period start date rather than by audit year, because a December year-end and a January year-end fall on opposite sides. Re-check paragraph citations in methodologies and training material against the currently published text. And for the journal entry work, decide now how completeness of the ledger population will be evidenced, because that is the one genuinely new obligation rather than a restatement.

For a practical treatment of how financial statement fraud is detected and evidenced in practice, see our forensic accounting CPD course, and for the control-testing side, our internal audit fundamentals CPD course. Our list of international accounting standards covers the reporting framework the audit opinion attaches to.

Both versions of the standard, and the effective dates quoted above, are published by the IAASB. Note that its Basis for Conclusions and fact sheet sit behind registration, so the reasoning behind individual changes is not quoted here.