ACCA Strategic Professional · Advanced Audit and Assurance (International)

Laws and regulations: formula sheet

Full chapter guide

Key formulas

Responsibility split: Management and TCWG: ensure compliance. Auditor: reasonable assurance on material misstatement from non-compliance.; The audit does not relieve management of its duty, and the auditor is not responsible for preventing non-compliance.
Direct laws: Direct effect on amounts and disclosures → obtain sufficient appropriate audit evidence of compliance; Typical examples: tax, pensions, distributable profits rules.
Indirect laws: Indirect effect → (1) enquire of management and TCWG, (2) inspect correspondence with licensing or regulatory authorities; These are the only required procedures unless non-compliance is identified or suspected.
Required understanding: Understand the legal and regulatory framework and how the entity complies with it; This is part of risk assessment, linked to understanding the entity.
Response to identified or suspected non-compliance: Understand the matter → discuss with management and TCWG → evaluate effect on the audit and opinion → consider reporting; Reporting can be to TCWG, in the auditor's report, or to an outside authority where required or appropriate.
Written representation: Management confirms it has disclosed all known or suspected non-compliance; Representations do not replace other evidence.
Group 1: laws with a direct effect: Obtain sufficient appropriate audit evidence of compliance; Applies to laws that determine material amounts and disclosures, such as tax and pensions.
Group 2: other laws: Perform specified procedures to help identify non-compliance that may be material; The procedures are enquiry of management and those charged with governance, and inspection of correspondence with regulators or licensing bodies.
Written representation: Management confirms it has disclosed all known or suspected non-compliance; Required by ISA 250 (Revised). It does not replace other evidence.
Suspected non-compliance: Understand → evaluate effect → discuss → consider legal advice → conclude on opinion and reporting; Use this sequence when something looks wrong.
Staged response to NOCLAR: Understand → Discuss with management and TCWG → Assess response → Consider further action; Use this order in every answer. Do not jump to reporting or withdrawal first.
Effect on the audit opinion: Material and not properly accounted for or disclosed → qualified or adverse; unable to obtain evidence → qualified or disclaimer; Per ISA 705. Pervasiveness decides between qualified and adverse, or between qualified and disclaimer.
Refusal to cooperate: Limitation on scope → modify opinion and consider withdrawal; If management or TCWG restrict access or withhold information, treat it as a scope limitation.
Management involvement: Management involved → discuss with TCWG (or higher authority); if TCWG involved too, consider legal advice and options; Do not discuss with the people you suspect where it may tip them off or harm the investigation, such as in money laundering.
Duty to report: Law or regulation requires disclosure → you must report; Confidentiality is overridden. Failure to report is itself a breach or offence. Report even without client consent.
Right to report: No legal duty + public interest + disclosure not prohibited → you may report; Judgement is needed. Disclose only what is necessary, to the proper body, and keep records.
Permitted disclosure with consent: Client authorises → disclose within the consent given; Consider the interests of all parties who might be affected.
Tipping off: Report made or investigation likely → do not alert the client; Typically an offence under anti-money laundering law. Take legal advice before any communication on the matter.
NOCLAR response sequence: Understand → discuss with management and TCWG → consider need for further action → report if appropriate → document; Reporting externally is considered if management and TCWG do not respond appropriately.

Quick revision

ISA 250 (Revised): management is responsible for compliance; the auditor is not responsible for preventing non-compliance.
Two categories: laws with a direct effect on the financial statements, and other laws that may be fundamental to the business.
For direct-effect laws, obtain sufficient appropriate audit evidence of compliance.
For other laws, perform limited procedures: enquire of management and those charged with governance, and inspect correspondence with regulators.
Stay alert for non-compliance throughout the audit, as audit procedures may reveal it.
Obtain written representations that management has disclosed all known or suspected non-compliance.
On suspicion, understand the matter, discuss it with management and consider the effect on the financial statements and the audit.
Communicate matters to those charged with governance unless they are all involved in the non-compliance.
Consider the effect on the audit opinion, including a qualified or adverse opinion, or a disclaimer if evidence is limited.
Confidentiality can be overridden by a legal duty or right, or in the public interest, after considering legal advice.
If management does not remedy the issue, consider withdrawal from the engagement and the legal and ethical consequences.
Document the matter, the discussions and the judgements made.

Common mistakes

Saying the auditor is responsible for ensuring the client complies with laws. Fix: State that management and TCWG are responsible for compliance. The auditor obtains reasonable assurance about the effect on the financial statements.
Applying full testing to every law, including indirect ones. Fix: Say that for indirect laws the auditor enquires and inspects regulator correspondence, unless a problem is suspected.
Saying the auditor must detect all non-compliance. Fix: State that management is responsible for compliance and that the auditor gives reasonable, not absolute, assurance.
Listing every audit procedure without separating the two groups of laws. Fix: Say first whether the law has a direct effect on the financial statements. Then match the level of work to the group.
Reporting straight to the regulator without first discussing with management and TCWG. Fix: Show the staged response. Discuss and seek remediation first, then consider disclosure in the public interest.
Saying confidentiality stops the auditor from ever disclosing. Fix: State that disclosure may be required or permitted by law, or may be justified in the public interest. Mention legal advice.
Saying confidentiality always prevents the auditor from reporting to anyone outside the client. Fix: State that confidentiality is overridden by a legal duty and can be set aside where disclosure is permitted, including in the public interest.
Confusing a duty to report with a right to report. Fix: Label each point explicitly. Duty means mandatory by law. Right means permitted, requires judgement, and has no penalty for staying silent.

Exam tips

Always give the direct versus indirect classification first, with a one-line reason. It is an easy mark.
Name the responsible party explicitly. Examiners reward a clear management versus auditor distinction.
Tie each procedure to the scenario facts. Generic lists earn few marks, and professional skills marks reward application.
If a breach is found, cover materiality, TCWG communication, opinion effect and external reporting in that order.
Mention ethics and confidentiality when external reporting arises, and say the auditor should consider legal advice.
Always split laws into those with a direct effect on the financial statements and the rest, because the level of auditor responsibility differs.
Name the exact procedures for the second group: enquiry of management and those charged with governance, and inspection of correspondence with regulators.
Apply every point to the scenario, since professional skills marks reward commercial awareness and relevance.