ACCA Applied Skills · Audit and Assurance

Fraud, laws and regulations: formula sheet

Full chapter guide

Key formulas

Fraud versus error: Fraud = intentional misstatement; Error = unintentional misstatement; Intent is the only difference. Both can be material.
Fraud triangle: Incentive/pressure + Opportunity + Rationalisation; All three are normally present. Use it to classify fraud risk factors in a scenario.
Two types of fraud: Fraudulent financial reporting; Misappropriation of assets; Name the type, then link it to the scenario facts.
Responsibility split: Management and TCWG: prevent and detect. Auditor: reasonable assurance on material misstatement.; The auditor does not prevent fraud and does not give a guarantee.
Presumed fraud risk in revenue and override: Revenue recognition and management override of controls are treated as fraud risks; ISA 240 requires the auditor to presume a fraud risk in revenue recognition and to always address management override.
Fraud triangle: Fraud = Incentive or pressure + Opportunity + Attitude or rationalisation; Use it to organise fraud risk factors in a scenario. Name which side each factor falls under.
Two types of fraud (ISA 240): Fraudulent financial reporting (misstating the financial statements) | Misappropriation of assets (theft); Say which type applies and who is likely to be responsible: usually management for the first, usually employees for the second.
Mandatory responses to management override: Test journals | Review accounting estimates for bias | Evaluate the business rationale of significant unusual transactions; These are required on every audit regardless of the assessed risks.
Revenue presumption: Presumed fraud risk in revenue recognition, unless rebutted; Treat revenue as a significant risk. The presumption can be rebutted only with a reason documented by the auditor.
Responsibility: Prevention and detection = management and those charged with governance | Reasonable assurance of no material misstatement = auditor; The auditor is not responsible for preventing fraud. Material fraud can still go undetected.
Fraud triangle: Fraud risk = Incentive or pressure + Opportunity + Rationalisation; Use it to explain why a fraud risk factor exists. Name all three parts.
Presumed fraud risks: Revenue recognition (presumed, rebuttable) + Management override of controls (always a significant risk); Management override cannot be rebutted. The revenue presumption can be rebutted only with a reason.
Mandatory override procedures: Test journals and adjustments + Review estimates for bias + Evaluate rationale for significant unusual transactions; Required whatever the auditor's assessment of fraud risk.
Overall responses: Senior staff + Supervision + Unpredictability + Review of accounting policies; Use these when the risk affects the financial statements as a whole.
Who to tell first: Fraud suspected → appropriate level of management (above those involved) → TCWG if management involved or integrity in doubt; If management may be involved, go directly to TCWG. Do not tell the suspect.
Matters to communicate to TCWG (ISA 240): Fraud by management, by employees with significant control roles, or any fraud causing material misstatement; plus concerns about management's fraud risk assessment and controls; Communicate on a timely basis. Matters may be oral or written depending on significance.
Confidentiality override: Disclose externally only if: required by law, or permitted by law and in the public interest (or otherwise legally protected); Take legal advice. Disclose only to the proper authority and only what is relevant.
Fraud written representations: Management acknowledges responsibility for fraud prevention and detection; has disclosed fraud risk assessment results; has disclosed known or suspected fraud and allegations; Obtain these in the representation letter dated at or near the audit report date.
Effect on audit report: Material misstatement uncorrected → qualified or adverse; unable to obtain evidence → qualified or disclaimer; Choose between qualified and adverse/disclaimer by pervasiveness.
Responsibility split: Management and TCWG = ensure compliance; Auditor = reasonable assurance of no material misstatement from non-compliance; The auditor does not prevent or detect all non-compliance.
Direct laws: Direct effect on material amounts or disclosures → obtain sufficient appropriate audit evidence about compliance; Examples: tax, pensions, company law disclosures.
Indirect (other) laws: No direct effect → at least enquire of management and TCWG + inspect correspondence with regulators; Examples: health and safety, environmental and licensing laws. These are the minimum procedures. The auditor must respond further if non-compliance is identified or suspected.
Response to suspected non-compliance: Understand → discuss with management/TCWG → evaluate effect → communicate → consider reporting and opinion; Legal advice may be needed if management cannot give enough information.
Written representations: Obtain written representation that management has disclosed all known or suspected non-compliance; This supports the audit work but is not a substitute for it.
Three stages of laundering: Placement → Layering → Integration; Placement puts the money into the system, layering hides its trail, integration brings it back as clean.
Reporting route: Suspicion → report to firm's MLRO → MLRO decides → report to the appropriate authority; The staff member's duty is normally met by reporting to the MLRO.
Tipping off: Tipping off = disclosing a report or investigation in a way that may prejudice it; It is an offence. The auditor must not alert the client.
Confidentiality override: Legal duty to report > duty of confidentiality; A report made in good faith in line with the law does not breach confidentiality.
Main offences: Laundering + Failure to report + Tipping off; Check your jurisdiction's wording, but exam answers use these three.

Quick revision

Fraud is intentional; error is unintentional.
Management and those charged with governance are responsible for preventing and detecting fraud.
The auditor obtains reasonable assurance, not absolute assurance, that the financial statements are free from material misstatement.
Fraud risk factors fall under incentive or pressure, opportunity and rationalisation.
Fraudulent financial reporting means misstating the accounts; misappropriation means stealing assets.
Under ISA 240, management override of controls is always treated as a risk, so journal entries and estimates are tested.
Revenue recognition is presumed to be a fraud risk unless the auditor concludes otherwise and documents why.
Maintain professional scepticism and hold a team discussion about where fraud could occur.
Written representations support other evidence but cannot replace it.
Under ISA 250, the auditor is not responsible for preventing non-compliance and cannot be expected to detect all of it.
Money laundering reporting is a legal duty, and tipping off the suspect is an offence in many jurisdictions.
If fraud is suspected, the auditor communicates with the right level of management or those charged with governance, depending on who may be involved.

Common mistakes

Saying the auditor is responsible for preventing and detecting fraud. Fix: Write that management and those charged with governance prevent and detect fraud. The auditor obtains reasonable assurance on material misstatement.
Defining fraud by its size or by whether money was lost. Fix: Use intent as the test. A large honest mistake is still error, and a small deliberate misstatement is still fraud.
Saying the auditor is responsible for preventing and detecting fraud. Fix: State that management and those charged with governance are responsible. The auditor obtains reasonable assurance that the financial statements are free from material misstatement, whether from fraud or error.
Confusing fraud with error. Fix: Intent is the difference. Fraud is intentional. Error is unintentional. Use the word 'intentional' in definitions.
Saying the auditor is responsible for preventing and detecting fraud. Fix: Say management and those charged with governance are responsible for prevention and detection. The auditor gets reasonable assurance on material misstatement.
Giving generic procedures such as 'check invoices' for a fraud risk. Fix: Name the risk and the assertion. Then say what you test, such as cut-off on year-end sales or journals posted near year end.
Saying the auditor must always report fraud to the police or regulator. Fix: Say external reporting depends on law or public interest. Confidentiality applies otherwise, and legal advice is sensible.
Telling the suspected manager first. Fix: If management is implicated, go directly to TCWG, such as the audit committee.
Saying the auditor is responsible for ensuring the client complies with laws. Fix: Write that management and TCWG are responsible. The auditor only obtains reasonable assurance about material misstatement.
Treating all laws the same and listing full substantive testing for every law. Fix: Classify first. Direct laws need sufficient appropriate evidence about compliance. Other laws need at least enquiry and inspection of regulator correspondence, and further response if non-compliance is identified or suspected.

Exam tips

Use the word intent whenever you separate fraud from error. Markers look for it.
In scenario questions, quote the fact and then label it pressure, opportunity or rationalisation. Do not just list the triangle.
Always state the responsibility split clearly and add that auditor assurance is reasonable, not absolute.
For response questions, mention professional scepticism, team discussion, enquiries, journal testing and management override.
In objective tests, watch for options that say the auditor 'prevents' or 'guarantees'. These are almost always wrong.
In Section C, write each point as fact, risk factor and response. Examiners reward application to the scenario, not textbook lists.
In OT questions, decide first whether the scenario points to management (financial reporting fraud) or employees (misappropriation). This usually removes two options.
Always mention the three required management override procedures if the scenario shows management pressure or control dominance.