Fraud & Laws and Regulations
March 08, 2025
Fraud, law and regulations 1
Fraud
Fraud is an intentional act by one or more individuals among
management, those charged with governance, employees or
third parties involving the use of deception to obtain an unjust or
illegal
advantage. Fraud may be perpetrated by an individual, or collud
ed in, with people internal or external to the business.
Fraud risk factors are events or conditions which indicate an
incentive or pressure to commit fraud, or provide an opportunity
to commit fraud.
There are two types of fraud:
1. Fraudulent financial reporting
2. Misappropriation of assets
Fraud, law and regulations 2
Fraudulent financial reporting
Involves intentional misstatements, including omissions of
amounts or disclosures in financial statements, to deceive
users of the financial statements.
Examples
• Manipulation, falsification or alteration of accounting
records and/or supporting documents
• Misrepresentation (or omission) of events or transaction
s in the financial statements
• Intentional misapplication of accounting principles
Fraud, law and regulations 3
Misappropriation of assets
Involves the theft of an entity's assets and is often perpetrated by
employees in relatively small and immaterial amounts. However, it can
also involve management who are usually more capable of disguising
or concealing misappropriations in ways that are difficult to detect.
Examples
• Embezzling receipts (for example, diverting them to private bank
accounts)
• Stealing physical assets or intellectual property (inventory, selling
data)
• Causing an entity to pay for goods not received (payments to fictitiou
s vendors)
• Using assets for personal use
Real World Example: Saytam Computer Services
In 2009, the Chairman of Saytam Computer Services (in India), Ramalinga
Raju, admitted to falsifying the financial statements of the company by almost
$1.5 billion.
The financial statements contained falsified revenues, margins and cash
balances, resulting in over-inflated revenue figures.
The Chairman admitted the fraud in a letter to the Board of Directors of the
company.
Here is an extract from his letter:
"What started as a marginal gap between actual operating profit and the one
reflected in the books continued to grow over the years. It has attained
unmanageable proportions as the size of the company’s operations grew over
the years."
Fraud, law and regulations 4
Prevention and detection of fraud
The primary responsibility for the prevention and detection of fraud
rests with those changed with governance and management. It is
not primarily the responsibility of the external auditor!
However, as part of their risk assessment, auditors should discuss
how and where the financial statements may be susceptible to
fraud.
ISA 240 The auditor’s responsibilities relating to fraud in an audit of
financial statements
So, what are the responsibilities of the auditor?
The auditor is responsible for obtaining reasonable assurance
that the financial statements are free from material
misstatement, whether caused by fraud or error.
Fraud, law and regulations 5
However, the risk of not detecting a material
misstatement from fraud is higher than from error
because:
• Fraud may involve sophisticated schemes designed to c
onceal it.
• Fraud may be perpetrated by individuals in collusion.
• Management fraud is harder to detect because manage
ment is in a position to manipulate accounting records
or override control procedures.
Professional scepticism is important here – eg the auditor
should consider the possibility of management overriding
controls.
Auditor’s responsibilities for fraud
The primary responsibility is with management and TCWG
Auditors should obtain reasonable assurance that the financial statements are
free from MM, whether due to fraud or error.
The auditor is responsible for maintaining professional scepticism throughout
the audit, considering the possibility of management override of controls.
Discussions should be held among audit team members that place emphasis
on how and where the financial statements may be susceptible to fraud. (ISA
315)
Obtain written representations from management and TCWG that they accept
Fraud, law and regulations 6
Written representations
ISA 240 requires the auditor to obtain written representations from
management and those charged with governance that:
• They acknowledge their responsibility for the design,
implementation and maintenance of internal control to prevent and
detect fraud.
• They have disclosed to the auditor management’s assessment of
the risk of fraud in the financial statements.
• They have disclosed to the auditor their knowledge of any fraud
or suspected fraud which could have a material effect on the
financial statements.
• They have disclosed to the auditor their knowledge of any
allegations of fraud or suspected fraud communicated to
employees, former employees, analysts, regulators or others.
Laws and Regulations (ISA 250)
The objectives of the auditor are;
a) To obtain sufficient appropriate audit evidence regarding
compliance with the provisions of those laws and
regulations that have a direct effect on the determination
of material amounts and disclosures in the financial
statements
b) To perform specified audit procedures to help identify non-
compliance with other laws and regulations that may have
a material effect on the financial statements
c) To respond appropriately to non-compliance / suspected
non-compliance identified during the audit
Fraud, law and regulations 7
ISA 250 Consideration of laws and regulations in an audit of financial
statements.
Management’s responsibility
To ensure that the entity complies with the relevant laws and regulations.
It is not the auditor's responsibility to prevent or detect non-compliance
with laws and regulations.
Auditor’s responsibility
To obtain reasonable assurance that the financial statements are free from
material misstatement.
However, auditor must also take into account the legal and regulatory
framework within which the entity operates. ISA 315
Fraud, law and regulations 8
• ISA 315 requires auditors to obtain a general understanding
of the applicable legal and general framework and how
the entity complies with it.
• For example, making inquiries of management about laws
and regulations that may affect the entity, and about the
entity’s policies and procedures or ensuring it complies with
relevant legislation.
• The auditor shall remain alert to the possibility that audit
procedures may highlight instances of non-compliance.
• Any non-compliance should be reported to those charged
with governance or the audit committee, if the auditor
suspects that those charged with governance are not
involved.
Fraud, law and regulations 9
Auditor’s responsibilities _ Compliance in two categories
Those that have a direct effect
The auditor's responsibility is to obtain sufficient appropriate audit
evidence about compliance with those laws and regulations.
Those that do not have a direct effect
To undertake specified audit procedures to help identify non-
compliance with laws and regulations that may have a material
effect on the financial statements. (Inquiries and inspections)
Documentation of risk assessment 1
• Auditors must document the work they have done at the
risk assessment stage.
• We will look at documentation in greater detail in Chapter 7
when we discuss the audit strategy and the audit plan.
• But there are a number of matters which need to be
documented during the risk assessment and planning
stages of an audit…
Documentation of risk assessment 2
What needs to be documented?
• The discussion among the audit team concerning the suscepti
bility of the financial statements to material misstatements,
including any significant decisions reached
• Key elements of the understanding gained of the entity regard
ing the elements of the entity and its internal control
components, sources of information gained and the risk
assessment procedures undertaken
• The identified and assessed risks of material misstatement at
the financial statement level and assertion level
• Risks identified and related controls evaluated
• Overall responses to address the risks of material misstateme
nt at the financial statement level
Documentation of risk assessment 3
What needs to be documented? (continued)
• Nature, extent and timing of further audit procedures li
nked to the assessed risks at the assertion level
• Results of audit procedures
• If the auditors have relied on evidence about the effecti
veness of controls from previous audits,
conclusions about how this is appropriate
• Demonstration that the financial statements agree or re
concile with the underlying accounting records
