Audit and Assurance · Fraud, laws and regulations

Reporting Fraud and Management Representations in ACCA Audit and Assurance

Updated 11 October 2026 · Fact-checked

When the auditor finds or suspects fraud, they communicate it on a timely basis to the right level of management and to those charged with governance, and consider whether a duty or right exists to report externally. They also obtain written representations from management about fraud, and consider the effect on the audit report.

Understand Reporting Fraud and Management Representations

Fraud reporting is about who you tell, when, and what it does to your audit. You do not investigate like a police officer. You respond as an auditor: assess the effect on the financial statements, tell the right people, and protect your own position.

Start with management. If you find fraud or suspect it, tell the appropriate level of management promptly. That is normally a level above the people involved. If management itself may be involved, or you doubt its integrity, go straight to those charged with governance (TCWG), such as the audit committee or board. Under ISA 240, you also tell TCWG about fraud involving management, employees with significant roles in internal control, and others where the fraud causes a material misstatement. You also communicate significant concerns about management's assessment of fraud risk and controls.

External reporting is the tricky part. The auditor has a duty of confidentiality. It can be overridden where law requires disclosure, or where the law permits it and it is in the public interest. Some jurisdictions require reporting to regulators or authorities, for example for money laundering or for regulated entities. The auditor should consider legal advice and, where unsure, may consult their professional body. Do not assume you can freely tell outsiders.

Then there are written representations under ISA 240 and ISA 580. Management confirms in writing that it acknowledges responsibility for designing and operating internal control to prevent and detect fraud. It confirms it has disclosed the results of its fraud risk assessment, all known or suspected fraud, and allegations of fraud affecting the entity. These are audit evidence but not sufficient on their own. If management refuses, or you doubt its integrity, that is a serious matter and may lead to a modified opinion or disclaimer, or even withdrawal.

Finally, consider the audit report. If fraud causes a material misstatement that management will not correct, you give a qualified or adverse opinion. If you cannot obtain evidence because of suspected fraud, or management limits your work, you consider a qualified opinion or disclaimer. Reporting is also not a replacement for adjusting the audit: you reassess risk and extend procedures.

Key rules to remember

Who to tell first: Fraud suspected → appropriate level of management (above those involved) → TCWG if management involved or integrity in doubt; If management may be involved, go directly to TCWG. Do not tell the suspect.
Matters to communicate to TCWG (ISA 240): Fraud by management, by employees with significant control roles, or any fraud causing material misstatement; plus concerns about management's fraud risk assessment and controls; Communicate on a timely basis. Matters may be oral or written depending on significance.
Confidentiality override: Disclose externally only if: required by law, or permitted by law and in the public interest (or otherwise legally protected); Take legal advice. Disclose only to the proper authority and only what is relevant.
Fraud written representations: Management acknowledges responsibility for fraud prevention and detection; has disclosed fraud risk assessment results; has disclosed known or suspected fraud and allegations; Obtain these in the representation letter dated at or near the audit report date.
Effect on audit report: Material misstatement uncorrected → qualified or adverse; unable to obtain evidence → qualified or disclaimer; Choose between qualified and adverse/disclaimer by pervasiveness.

How to solve Reporting Fraud and Management Representations questions

Use this order for any scenario that mentions suspected or discovered fraud.

1Identify the facts: who is suspected, how large the amount is, and whether it is material in size or by nature.
2Decide the first recipient. If management is not involved, tell an appropriate level of management. If they are involved, tell TCWG directly.
3State what you tell TCWG and why, linking to ISA 240 requirements and the timeliness of communication.
4Consider external reporting. Name the confidentiality duty, then the legal requirement or public interest exception, and say you would take legal advice.
5Explain the response on the audit: reassess risks, extend procedures, and consider whether management integrity affects reliance on representations.
6Cover written representations: what you request and what refusal or unreliability means.
7Conclude with the audit report effect: misstatement not corrected or limitation of scope, and the type of opinion.
8Add a practical point such as documentation, or consider withdrawal if the situation cannot be resolved.

Quickest way: Tell, Protect, Evidence, Report

When to use it: Use for Section B OT cases and for short written parts in Section C when time is tight.

Tell: management, or TCWG if management is involved.
Protect: confidentiality unless law requires or permits disclosure; take legal advice.
Evidence: respond to the risk and get fraud written representations.
Report: decide the opinion by misstatement or scope limitation, and by pervasiveness.

Common mistakes in Reporting Fraud and Management Representations

Saying the auditor must always report fraud to the police or regulator.
Students treat fraud as automatically criminal and forget confidentiality.
Fix: Say external reporting depends on law or public interest. Confidentiality applies otherwise, and legal advice is sensible.
Telling the suspected manager first.
Students follow the usual rule of telling management without checking who is involved.
Fix: If management is implicated, go directly to TCWG, such as the audit committee.
Treating the representation letter as sufficient evidence of no fraud.
Students over-trust a signed document.
Fix: State that representations support but do not replace other evidence, and cannot override contradictory evidence.
Giving an unmodified opinion because fraud was reported to TCWG.
Students confuse communication with resolution.
Fix: Reporting does not fix the financial statements. If a material misstatement remains, modify the opinion.
Choosing adverse opinion for a scope limitation.
Students mix up misstatement and inability to obtain evidence.
Fix: Misstatement leads to qualified or adverse. Limitation of scope leads to qualified or disclaimer.
Ignoring management refusal to give representations.
Students think it is only an administrative gap.
Fix: Refusal is a scope limitation and raises doubts on integrity. Consider a modified opinion or withdrawal.

Worked examples

Example 1

During the audit of Lumen Co, you find that the finance director has been approving fictitious supplier invoices. The amount is material. Explain to whom you communicate this and the effect on your audit report if the financial statements are not corrected.

Show the solution

The finance director is part of management and is involved, so telling management is inappropriate.
Communicate directly and promptly with TCWG, such as the audit committee or board, as the fraud involves management and is material.
Consider external reporting. Confidentiality applies, but disclosure may be required by law or permitted in the public interest. Take legal advice before disclosing.
Reassess fraud risks and extend audit procedures, and consider whether you can rely on management representations.
If the financial statements remain materially misstated because the invoices are not corrected, the issue is a material misstatement.
Choose qualified if the effect is material but not pervasive, or adverse if it is material and pervasive.

Answer: Report directly to TCWG, not to the finance director. Consider legal or public interest disclosure externally with legal advice. If the misstatement is not corrected, issue a qualified opinion, or an adverse opinion if pervasive.

Example 2

Which one of the following is a required fraud-related written representation from management under ISA 240? A) Management has hired an experienced audit team. B) Management has disclosed all known or suspected fraud and allegations of fraud affecting the entity. C) Management guarantees that no fraud has occurred. D) Management accepts responsibility for the auditor's fee.

Show the solution

Option A is about the auditor's staffing, not a management representation.
Option C overstates: management cannot guarantee that no fraud occurred, and ISA 240 asks for disclosure of known or suspected fraud.
Option D has no link to fraud.
Option B matches ISA 240, which requires confirmation that management has disclosed known or suspected fraud and allegations of fraud.

Answer: B

Exam tips

Always ask who is involved before choosing the recipient. Management involvement points to TCWG.
On external reporting, give the confidentiality duty and its exceptions in one sentence each, then mention legal advice.
Link every fraud scenario to the audit report: say whether it is a misstatement or a scope limitation, then pick the opinion.
In OT questions, watch for absolute words like always or guarantees. Those options are usually wrong.
For Section C, set out your answer under clear headings: communicate, external, evidence and representations, report.

Reporting Fraud and Management Representations: frequently asked questions

How do I report fraud to those charged with governance in ACCA AA?

Say you communicate on a timely basis, usually in writing if the matter is significant. Do it directly if management is involved or its integrity is in doubt. Cover the nature of the fraud, its effect, and any concerns about controls.

Does the auditor have a duty to report fraud to external authorities?

It depends on the law of the jurisdiction. The auditor's duty of confidentiality is overridden where law requires disclosure, or where law permits it and it is in the public interest. The auditor should take legal advice first.

What fraud written representations does ISA 240 require?

Management confirms it acknowledges responsibility for fraud prevention and detection controls. It also confirms it has disclosed its fraud risk assessment results and all known or suspected fraud and allegations affecting the entity.

What if management refuses to give the representations?

This is a scope limitation and casts doubt on management's integrity. You discuss it with TCWG, reassess the reliability of other representations, and consider a qualified opinion, disclaimer or withdrawal.