Audit and Assurance · Fraud, laws and regulations

ISA 250 Laws and Regulations in Audit

Updated 11 October 2026 · Fact-checked

ISA 250 deals with the auditor's duty to consider laws and regulations in an audit of financial statements. Management is responsible for compliance. The auditor obtains reasonable assurance on laws with a direct effect on the numbers, and performs limited procedures on other laws. If non-compliance is suspected, the auditor investigates, communicates and considers reporting.

Understand Laws and Regulations (ISA 250)

Every company must obey laws and regulations. Some breaches can change the financial statements. Others do not change the numbers but may still harm the business. ISA 250 sets out how far the auditor must look into this.

Responsibility. Management, with those charged with governance (TCWG), is responsible for making sure the entity complies with laws and regulations. The auditor is not responsible for preventing non-compliance. An audit cannot be expected to detect all of it. The auditor's duty is to obtain reasonable assurance that the financial statements are free from material misstatement, including misstatement caused by non-compliance.

Two categories of laws. This is the most tested point.

Laws with a direct effect on material amounts and disclosures in the financial statements. Examples: tax legislation, pension laws, and company law on dividends and disclosures. For these, the auditor obtains sufficient appropriate audit evidence about compliance with the provisions of those laws.
Other laws with no direct effect on the numbers but which may be fundamental to the business continuing, or to avoiding material penalties. Examples: health and safety, environmental permits, and licensing rules for operating a regulated business. For these, the auditor performs specified procedures to help identify non-compliance that may have a material effect on the financial statements.

For the second category, the auditor is required to perform at least these procedures: enquire of management and TCWG whether the entity complies, and inspect correspondence with licensing or regulatory authorities. These are minimum procedures, not a limit. If non-compliance is identified or suspected, the auditor must respond further, as set out below.

Suspected non-compliance. If the auditor becomes aware of non-compliance or suspected non-compliance, the auditor seeks to understand the nature of the act and the circumstances, and obtains further information to evaluate the possible effect on the financial statements. The auditor discusses it with management and, where appropriate, TCWG. If management cannot provide enough information, the auditor considers taking legal advice. The auditor then assesses the effect on the audit, including risk assessment, the reliability of management representations and the audit opinion.

Reporting. Non-compliance is communicated to TCWG on a timely basis unless all of them are involved in it. In that case the auditor considers what action to take, including legal advice. The auditor may have to report to an authority outside the entity where law requires it, or where the ethics code permits or requires disclosure in the public interest. The auditor also considers the effect on the audit report and whether withdrawal is appropriate.

Key rules to remember

Responsibility split: Management and TCWG = ensure compliance; Auditor = reasonable assurance of no material misstatement from non-compliance; The auditor does not prevent or detect all non-compliance.
Direct laws: Direct effect on material amounts or disclosures → obtain sufficient appropriate audit evidence about compliance; Examples: tax, pensions, company law disclosures.
Indirect (other) laws: No direct effect → at least enquire of management and TCWG + inspect correspondence with regulators; Examples: health and safety, environmental and licensing laws. These are the minimum procedures. The auditor must respond further if non-compliance is identified or suspected.
Response to suspected non-compliance: Understand → discuss with management/TCWG → evaluate effect → communicate → consider reporting and opinion; Legal advice may be needed if management cannot give enough information.
Written representations: Obtain written representation that management has disclosed all known or suspected non-compliance; This supports the audit work but is not a substitute for it.

How to solve Laws and Regulations (ISA 250) questions

Use this method for any ISA 250 scenario or requirement, whether it is an objective test question or a written answer.

1Identify the law involved and classify it: does it have a direct effect on the financial statements, or is it an other law?
2State who is responsible: management and TCWG for compliance, with the auditor obtaining reasonable assurance.
3Match the audit procedures to the category: sufficient appropriate evidence about compliance for direct laws, and at least enquiry and inspection of regulator correspondence for other laws.
4If non-compliance is suspected, say the auditor must understand the facts, discuss with management and, where appropriate, TCWG, and obtain more evidence.
5Assess the effect: possible material misstatement, disclosure needs, fines or provisions, going concern, and reliability of management.
6Decide on communication: TCWG first, unless they are involved. Then consider reporting to an external authority, with legal advice and confidentiality in mind.
7Consider the audit report: a modified opinion if the effect is material and unresolved, and withdrawal if integrity is in doubt.
8Document the matter and the discussions.

Quickest way: Classify, respond, report

When to use it: Use this for objective test questions and for planning a short written answer when time is tight.

Underline the law. Ask: does breach change the numbers directly? If yes, it is a direct law.
Recall the one-line procedure: evidence for direct laws, enquiry and correspondence for others.
For suspected breach, think in order: discuss, evaluate, communicate, report, opinion.
Check who is involved. If TCWG are involved, the auditor cannot just tell them and must consider outside action.
Eliminate options that say the auditor must detect all non-compliance or must always report to the regulator.

Common mistakes in Laws and Regulations (ISA 250)

Saying the auditor is responsible for ensuring the client complies with laws.
Students confuse the auditor's role with a compliance or regulatory role.
Fix: Write that management and TCWG are responsible. The auditor only obtains reasonable assurance about material misstatement.
Treating all laws the same and listing full substantive testing for every law.
Students overlook the two-category structure of ISA 250.
Fix: Classify first. Direct laws need sufficient appropriate evidence about compliance. Other laws need at least enquiry and inspection of regulator correspondence, and further response if non-compliance is identified or suspected.
Reporting suspected non-compliance straight to the regulator.
Students ignore the confidentiality duty and the steps that come first.
Fix: First understand, discuss and communicate with TCWG. Then consider external reporting where law requires it or the ethics code permits it in the public interest, taking legal advice.
Forgetting the effect on the audit report.
Answers stop at communication.
Fix: Add a sentence on modification if the effect is material and not properly accounted for or disclosed, or if the auditor cannot obtain evidence.
Believing that if no non-compliance is found, the auditor has guaranteed compliance.
Students overstate assurance.
Fix: Remember that audits have inherent limitations. The auditor gives reasonable assurance, not a guarantee.
Ignoring who is involved when communicating.
Students apply a standard step without reading the scenario.
Fix: If management or all of TCWG are implicated, do not simply report to them. Consider legal advice and other action.

Worked examples

Example 1

Constructed response style (extract, 6 marks): You are the auditor of Kora Co, a chemical manufacturer. Explain the auditor's responsibilities under ISA 250 for (a) tax legislation and (b) environmental permits, and the procedures you would perform for each. (6 marks)

Show the solution

Start with responsibility: management and TCWG are responsible for compliance. The auditor obtains reasonable assurance that the financial statements are free from material misstatement, including that arising from non-compliance.
(a) Tax legislation has a direct effect on material amounts such as tax charges, liabilities and disclosures. The auditor must obtain sufficient appropriate evidence of compliance.
Procedures for (a): review tax computations, agree them to the ledger and to returns filed, check correspondence with the tax authority, and test deferred tax and any provisions for penalties.
(b) Environmental permits are an other law. Breach may not change the numbers directly but could lead to fines, closure or clean-up costs that are material.
Procedures for (b): at a minimum, enquire of management and TCWG whether Kora complies, and inspect correspondence with the environmental regulator.
If either set of procedures suggests non-compliance, or non-compliance is otherwise suspected, the auditor would obtain more information and assess the effect on the financial statements.

Answer: Management and TCWG are responsible for compliance. For tax (a direct law), obtain sufficient appropriate evidence, for example by testing tax computations and reviewing authority correspondence. For environmental permits (an other law), perform at least enquiry of management and TCWG and inspection of regulator correspondence, and respond further if non-compliance is identified or suspected.

Example 2

Objective test style (OT case): During the audit of Alba Co, you find that the finance director made an unrecorded bribe to a local official to secure a licence. The payment is material. The board of directors includes the finance director. Which is the most appropriate first action? A. Report immediately to the regulator without telling anyone at Alba. B. Ignore it because bribery is not a financial reporting matter. C. Obtain further information, discuss it with appropriate parties who are not implicated (for example other directors or the audit committee), and consider legal advice because a director is involved. D. Withdraw from the audit without further enquiry.

Show the solution

Suspected non-compliance requires the auditor to understand the facts and obtain further information.
A is wrong. Immediate external reporting skips the required steps and risks breaching confidentiality, unless law demands it.
B is wrong. The bribe is material and unrecorded, so it may cause misstatement and also affects the reliability of management.
D is wrong. Withdrawal may be considered later, but not without enquiry.
C is correct. The auditor obtains more information and discusses the matter with parties who are not implicated, such as other directors or the audit committee. The finance director is on the board, so the auditor does not simply raise it with management and all TCWG. Because a director is involved, the auditor also considers legal advice.

Answer: C

Exam tips

Always classify the law as direct or other before writing procedures. This earns marks quickly and shows you know the structure of ISA 250.
In written answers, include the responsibility statement first. It is an easy mark and many students skip it.
For suspected non-compliance, give the sequence: understand, discuss, evaluate, communicate, consider reporting, consider the opinion.
Link non-compliance to other topics: fraud, going concern, management integrity, representations and confidentiality.
In objective tests, reject options using words like 'ensure', 'guarantee' or 'always report' when applied to the auditor.

Laws and Regulations (ISA 250) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

ACCA Strategic ProfessionalAuditor Responsibilities for Laws and Regulations (ISA 250)

Laws and Regulations (ISA 250): frequently asked questions

What is the difference between direct and indirect laws in audit?

Laws with a direct effect determine material amounts and disclosures in the financial statements, such as tax and pension law. Other laws, such as health and safety or licensing rules, do not affect the numbers directly but may be fundamental to the business. The auditor obtains sufficient evidence for the first group and performs limited procedures for the second.

Is the auditor responsible for detecting non-compliance with laws?

No. Management and TCWG are responsible for compliance. The auditor obtains reasonable assurance that the financial statements are free from material misstatement and must stay alert to the possibility of non-compliance, but an audit cannot detect every breach.

How does the auditor respond to suspected non-compliance?

The auditor obtains an understanding of the act and the circumstances and discusses it with management and, where appropriate, TCWG. The auditor then evaluates the effect on the financial statements and the audit, and may take legal advice. Communication, possible external reporting and the effect on the audit report follow.

Must the auditor report non-compliance to an outside authority?

Only where law or regulation requires it, or where the ACCA Code of Ethics permits or requires disclosure in the public interest. Otherwise confidentiality applies. Because this is a sensitive area, the auditor should consider legal advice before reporting externally.