ISA (UK) 240 and ISA (UK) 570: What the FRC's 2026 Revisions Mean for Auditors

ISA (UK) 240 and ISA (UK) 570 are about to get their first major overhaul in years. If you qualified in the last decade, the chances are you've never audited under anything other than the current versions of the fraud and going concern standards — but that's about to change. On 30 April 2026, the Financial Reporting Council (FRC) published final revisions to both standards, formally titled ISA (UK) 240 (Revised March 2026) and ISA (UK) 570 (Revised March 2026). This isn't a tweak to disclosure wording or a light editorial pass — it's a substantive update to how UK auditors are expected to assess fraud risk and evaluate going concern, and every audit practice needs to understand what's coming before it lands.

A standard that keeps getting rewritten — and why

This is actually the third generation of both standards in under ten years, and that pattern tells its own story. ISA (UK) 570 was substantially rewritten in 2019 in the aftermath of Carillion's collapse, introducing the UK-specific requirement for auditors to bring an "appropriately independent and challenging mindset" to going concern conclusions. ISA (UK) 240 was then revised in 2021 following the Patisserie Valerie failure, sharpening fraud risk assessment procedures. Now, in 2026, both are being revised again — this time driven less by a single UK corporate failure and more by the need to stay aligned with international standard-setting. Each revision has tightened the bar a little further, and this one is no exception.

What's changing, and why now

The FRC ran a formal consultation, Proposed Revisions to ISA (UK) 240 and ISA (UK) 570, from 1 October 2025 to 16 January 2026, receiving 20 responses before finalising the standards at the end of April 2026. The driving force behind the changes is alignment with the IAASB's international ISA 240 (Revised) and ISA 570 (Revised 2024), both of which take effect internationally on the same date as the UK versions. Because UK standards already contained enhancements the IAASB baseline didn't — a legacy of the post-Carillion and post-Patisserie Valerie revisions — the FRC expects only "minimal additional compliance burden" for firms that are already properly applying the current UK requirements. That's reassuring, but it isn't a reason to do nothing: the standards retain all their existing UK-specific requirements, including UK anti-money-laundering procedures under ISA (UK) 240, on top of the new international baseline.

Effective date: 2026 is a preparation year, not a live year

Both revised standards apply to audits of financial statements for periods commencing on or after 15 December 2026. For most practices with December year-end clients, that means the new requirements won't bite until you're planning audits with financial periods starting in 2027 — so 2026 should be treated as the preparation year, not the first year of application. That's a useful piece of practical planning information in itself: there's no need to panic about applying these standards to your current busy season, but there's also no excuse for leaving methodology updates and staff training until the last minute.

ISA (UK) 240: sharper fraud risk assessment, more visible scepticism

The revised ISA (UK) 240 strengthens fraud risk assessment procedures and reinforces the expectation that professional scepticism is exercised throughout the performance of the audit, not just applied as a mindset at the planning stage. It also enhances communication requirements with management and those charged with governance on fraud-related matters, and increases transparency in audit reporting on fraud, particularly for public-interest entities. In practice, expect this to translate into more robust documentation wherever fraud is suspected or a specialist is engaged — auditors will need to show their working on scepticism, not just assert it.

ISA (UK) 570: going concern as a continuous process, not a checkpoint

The revised ISA (UK) 570 clarifies how auditors evaluate an entity's ability to continue as a going concern, reflecting lessons from recent corporate failures. It retains the UK-specific requirements introduced after Carillion — the independent and challenging mindset, and the obligation to consider whether new facts have emerged since management made its own assessment — while enhancing reporting links to the UK Corporate Governance Code viability statement. Perhaps the most important shift for day-to-day practice is conceptual: going concern is framed as something to continuously reassess as the audit progresses and new facts or economic pressures emerge, rather than a single point-in-time judgement formed early and left alone. The standards also now explicitly link fraud risk and going concern risk, recognising that the two are frequently connected in practice — a business under going concern pressure is often also a business under pressure to misstate results.

The Ireland angle

Irish audit practitioners have their own parallel development to track. IAASA's Ethical Standard (Ireland) 2025 also becomes effective on 15 December 2026, introducing a "beneficial ownership group" concept for independence assessments and requiring more frequent breach reporting. IAASA standards typically track UK developments where Irish law permits, so firms operating across both jurisdictions should expect the fraud, going concern and independence changes to arrive as a connected package rather than three unrelated updates.

How the profession is reacting

ACCA has welcomed the finalised standards, with its head of audit and assurance, Antonis Diolas, noting that the FRC "has been responsive to our feedback" through the consultation process. That welcome came with a clear caveat, though: ACCA's Jessica Bingham flagged the need for "continued focus... to ensure consistent understanding and application, and to mitigate the risk of unintended consequences, including any widening of the audit expectation gap." In other words, the standards themselves are sound, but implementation risk sits with firms and their people. ACCA has committed to producing member guidance and training ahead of the rollout, and ICAS has gone further, explicitly recommending that firms "begin planning training now" given the effective date.

What audit practitioners should do between now and 2027

With roughly a year of preparation time before the new requirements bite on live engagements, the practical to-do list looks like this:

• Review current fraud risk assessment and going concern methodology against the enhanced requirements, and identify where documentation practices need to become more explicit.
• Build in training on the strengthened scepticism and continuous reassessment expectations well before the 15 December 2026 effective date — not in the run-up to it.
• Expect more detailed fraud and going concern disclosure in audit reports for public-interest entities and listed clients, and start planning reporting templates accordingly.
• If you audit or advise clients in Ireland as well as the UK, factor IAASA's Ethical Standard (Ireland) 2025 into the same planning cycle.

Standards changes like this are exactly the kind of regulatory update that's easy to file away and forget about until it's suddenly urgent. Firms that treat 2026 as genuine preparation time — updating methodology, briefing teams, and building the enhanced documentation habits early — will find the transition to the 2027 audit cycle far less disruptive than those who leave it until the effective date is on top of them. Learnsignal's CPD courses are being updated to reflect the revised standards as the detail becomes available, and our broader audit and ACCA content remains a good starting point if you want to revisit the fundamentals of ISA (UK) 240 and ISA (UK) 570 before layering the 2026 changes on top.