Audit and Assurance · Fraud, laws and regulations

Fraud, Error and Responsibilities under ISA 240

Updated 11 October 2026 · Fact-checked

Fraud is an intentional act by one or more people to obtain an unjust or illegal advantage. Error is unintentional. Management and those charged with governance prevent and detect fraud. The auditor obtains reasonable assurance that the financial statements are free from material misstatement, whether caused by fraud or error, and keeps professional scepticism.

Understand Fraud, Error and Responsibilities (ISA 240)

Financial statements can be wrong for two reasons. Error is an unintentional misstatement, such as a calculation mistake, an oversight or a misapplied accounting policy. Fraud is an intentional act involving deception to gain an unjust or illegal advantage. The key test is intent. The size of the amount does not decide which one it is.

ISA 240 deals with two types of fraud that matter to an auditor: fraudulent financial reporting (misstating the financial statements to deceive users, for example overstating revenue) and misappropriation of assets (theft, such as taking cash or inventory, usually hidden by false records). Fraud is harder to find than error because it is often concealed through collusion, forged documents or management override of controls.

The fraud triangle explains why fraud happens. Three conditions usually come together: incentive or pressure (for example a bonus target or personal debt), opportunity (weak controls, or a person who can override them) and rationalisation (the person justifies the act to themselves, such as 'I'll pay it back'). Remove one side and fraud becomes less likely. Auditors use the triangle to spot fraud risk factors.

Responsibilities are split. Management and those charged with governance are responsible for preventing and detecting fraud, mainly by designing and operating internal control and promoting a culture of honesty and ethical behaviour. The auditor is not responsible for preventing fraud. The auditor's duty is to obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether due to fraud or error. Because of inherent limitations, an audit properly planned and performed may still miss a material fraud.

The auditor must keep professional scepticism throughout, discuss fraud risks within the engagement team, make enquiries of management and others, and treat fraud risks as significant risks. The risk of not detecting a fraud from management is higher than from employees, because management can override controls.

Key rules to remember

Fraud versus error: Fraud = intentional misstatement; Error = unintentional misstatement; Intent is the only difference. Both can be material.
Fraud triangle: Incentive/pressure + Opportunity + Rationalisation; All three are normally present. Use it to classify fraud risk factors in a scenario.
Two types of fraud: Fraudulent financial reporting; Misappropriation of assets; Name the type, then link it to the scenario facts.
Responsibility split: Management and TCWG: prevent and detect. Auditor: reasonable assurance on material misstatement.; The auditor does not prevent fraud and does not give a guarantee.
Presumed fraud risk in revenue and override: Revenue recognition and management override of controls are treated as fraud risks; ISA 240 requires the auditor to presume a fraud risk in revenue recognition and to always address management override.

How to solve Fraud, Error and Responsibilities (ISA 240) questions

Use this method for any question on fraud, error or responsibilities, whether it is an objective test or a written requirement.

1Read the requirement and note the verb: define, explain, identify, or state responsibilities.
2Decide if the facts show intent. If yes, it is fraud; if it is an honest mistake, it is error.
3If fraud, classify it: fraudulent financial reporting or misappropriation of assets.
4Link each fact to a side of the fraud triangle: pressure, opportunity or rationalisation.
5State who is responsible: management and those charged with governance for prevention and detection; the auditor for reasonable assurance.
6Add the auditor's response where asked: scepticism, team discussion, enquiries, tests on journals and estimates, and addressing management override.
7Write short points, each tied to a fact in the scenario, and finish with the effect on audit risk.

Quickest way: Intent, type, triangle, owner

When to use it: Use in Section A and Section B objective questions, or to plan a Section C answer in under a minute.

Intent? Yes means fraud, no means error.
Type? Reporting the numbers falsely or stealing assets.
Triangle? Tag each fact as pressure, opportunity or rationalisation.
Owner? Prevention and detection sit with management and those charged with governance.
Auditor? Reasonable assurance only, with scepticism, and no guarantee.

Common mistakes in Fraud, Error and Responsibilities (ISA 240)

Saying the auditor is responsible for preventing and detecting fraud.
Students confuse the auditor's role with the purpose of internal control.
Fix: Write that management and those charged with governance prevent and detect fraud. The auditor obtains reasonable assurance on material misstatement.
Defining fraud by its size or by whether money was lost.
Large errors feel like fraud.
Fix: Use intent as the test. A large honest mistake is still error, and a small deliberate misstatement is still fraud.
Listing the fraud triangle sides without applying them to the scenario.
The triangle is memorised as a list.
Fix: Quote the fact, then name the side. For example, a bonus tied to profit is pressure; no review of journals is opportunity.
Claiming the auditor guarantees that no fraud exists.
Students overlook inherent limitations of an audit.
Fix: State that assurance is reasonable, not absolute, and that fraud involving collusion or forgery is harder to detect.
Treating management fraud as the same risk as employee theft.
Both are called fraud, so the difference is missed.
Fix: Explain that management can override controls and manipulate records, so the risk of non-detection is higher and the auditor always addresses override.
Mixing up the two fraud types.
Both can involve false records.
Fix: Ask what the fraudster gains. Misleading users of the accounts is financial reporting; taking assets for personal benefit is misappropriation.

Worked examples

Example 1

A finance director's bonus depends on reaching a profit target. Profit is below target at the year end. The director can post journals without approval. Before the year end, the director records a sale of goods that were not shipped until after the year end. Identify the type of fraud and explain the fraud triangle factors.

Show the solution

Intent: the director deliberately recorded the sale early, so this is fraud and not error.
Type: the aim is to misstate profit in the financial statements, so this is fraudulent financial reporting.
Pressure: the bonus depends on a profit target that is not being met.
Opportunity: the director can post journals without approval, so controls are weak and can be overridden.
Rationalisation: not stated in the scenario. It might be a belief that the sale will happen anyway, so it is only timing.

Answer: This is fraudulent financial reporting (a cut-off manipulation that overstates revenue and profit). Pressure is the bonus target, opportunity is unapproved journal posting, and rationalisation is not given but could be that the sale is only early.

Example 2

The directors of Kestrel Co say that, because the company is audited, they have no duty to look for fraud. Explain why this view is wrong and state the auditor's responsibilities.

Show the solution

Management and those charged with governance are responsible for preventing and detecting fraud.
They do this by designing, implementing and maintaining internal control and by promoting a culture of honesty and ethical behaviour.
The audit does not remove this duty. The auditor reports on whether the financial statements give a true and fair view.
The auditor must obtain reasonable assurance that the financial statements are free from material misstatement, whether from fraud or error.
The auditor must keep professional scepticism, discuss fraud risks in the team, make enquiries, and address management override of controls.
Because of inherent limitations, a properly performed audit may not detect all material frauds, especially those involving collusion.

Answer: The view is wrong. The directors remain responsible for preventing and detecting fraud. The auditor's duty is to obtain reasonable assurance that the financial statements are free from material misstatement due to fraud or error, applying professional scepticism, and the audit cannot guarantee that all fraud is found.

Exam tips

Use the word intent whenever you separate fraud from error. Markers look for it.
In scenario questions, quote the fact and then label it pressure, opportunity or rationalisation. Do not just list the triangle.
Always state the responsibility split clearly and add that auditor assurance is reasonable, not absolute.
For response questions, mention professional scepticism, team discussion, enquiries, journal testing and management override.
In objective tests, watch for options that say the auditor 'prevents' or 'guarantees'. These are almost always wrong.

Fraud, Error and Responsibilities (ISA 240) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Fraud, Error and Responsibilities (ISA 240): frequently asked questions

What is the difference between fraud and error in an audit?

Fraud is an intentional act involving deception to gain an unjust or illegal advantage. Error is an unintentional mistake. Both can cause a material misstatement, but fraud is harder to detect because it is often concealed.

Who is responsible for preventing and detecting fraud, the auditor or management?

Management and those charged with governance are responsible, mainly through internal control and an ethical culture. The auditor is responsible for obtaining reasonable assurance that the financial statements are free from material misstatement. The auditor does not prevent fraud.

What is the fraud triangle?

It has three elements: incentive or pressure, opportunity and rationalisation. Fraud is more likely when all three are present. Auditors use it to identify fraud risk factors.

Why is management fraud harder to detect than employee fraud?

Management can override controls and has control over accounting records. It can also direct others to act and create false documents. The auditor therefore always addresses the risk of management override.