Advanced Audit and Assurance (International) · Fraud and error

Communication, Reporting and Ethical Implications of Fraud for Auditors

Updated 11 October 2026 · Fact-checked

When you suspect or find fraud under ISA 240, you tell the right level of management and those charged with governance on time, consider legal duties to report to authorities, keep confidentiality except where law or the Code permits disclosure, avoid tipping off in money laundering cases, assess the audit report, and consider withdrawal.

Understand Communication, Reporting and Ethical Implications of Fraud

ISA 240 puts the main duty to prevent and detect fraud on management and those charged with governance (TCWG). Your duty is to obtain reasonable assurance that the financial statements are free from material misstatement, whether from fraud or error. Once you identify or suspect fraud, communication becomes a core part of your response.

Start with who to tell. If you identify or suspect fraud by employees, tell management at an appropriate level, on a timely basis. If the fraud involves management, employees with significant roles in internal control, or others where the fraud results in material misstatement, tell TCWG on a timely basis. If management and TCWG may both be involved, consider who else is appropriate, such as a regulator or an audit committee chair, and take legal advice.

Then think about confidentiality. Your duty of confidentiality is a fundamental principle, so you normally cannot tell outsiders. The Code recognises three categories of disclosure: (a) disclosure required by law; (b) disclosure permitted by law and authorised by the client; and (c) a professional duty or right to disclose, when not prohibited by law. ISA 240 says you should determine whether there is a responsibility to report to a party outside the entity. Regulated entities such as banks often carry a statutory duty to report to the regulator. Take legal advice before disclosing.

Money laundering adds a further layer. Where fraud proceeds are involved, you may have to make a report to the national authority under local law. Tipping off, meaning alerting the client that a report has been made or an investigation is under way, is an offence in many jurisdictions. So you must be careful what you say to management and TCWG. Follow the firm's procedures and report internally to the money laundering reporting officer (MLRO).

Finally, consider the effect on the engagement. Fraud may lead you to modify the opinion (ISA 705), reassess management integrity and written representations, and consider withdrawal. If you withdraw, you discuss with TCWG, consider professional and legal duties, and respond to the incoming auditor's enquiries only with client permission or legal basis. Written representations (ISA 580) must confirm that management has disclosed all known or suspected fraud. If they are unreliable, consider the effect on the opinion.

Key rules to remember

Who to tell first: Fraud by employees → management at an appropriate level. Fraud involving management (or employees with significant internal control roles, or fraud causing material misstatement) → TCWG, on a timely basis. Then external parties if a legal or professional duty exists; If management is involved, go to TCWG. Always consider timeliness.
Confidentiality exceptions: Disclosure only if: (a) required by law; (b) permitted by law and authorised by the client; or (c) a professional duty or right to disclose, when not prohibited by law; Take legal advice. Disclose only what is needed, to the right body.
Tipping off: Do not reveal that a money laundering report was made or an investigation is under way; Report internally to the MLRO. Tipping off can be a criminal offence in many jurisdictions.
Written representations on fraud: Management confirms: responsibility for fraud prevention and detection; disclosure of known or suspected fraud; disclosure of allegations of fraud; If management refuses or the representations are unreliable, reconsider the opinion and the engagement.
Effect on audit report: Uncorrected material misstatement from fraud: material but not pervasive → qualified; material and pervasive → adverse. Inability to obtain evidence (limitation on scope): possible effects material but not pervasive → qualified; material and pervasive → disclaimer; Pervasiveness decides between the two outcomes in each case (ISA 705).

How to solve Communication, Reporting and Ethical Implications of Fraud questions

Use this order for any question on reporting or ethical responses to fraud. It keeps your answer tied to the scenario and earns professional skills marks.

1Identify the facts: is the fraud suspected or actual, who is involved, how material, and is the entity regulated or listed?
2Decide the first reporting line: management above those involved, or TCWG if management is implicated.
3Consider external reporting: statutory duty to a regulator, money laundering reporting, or a right to disclose in the public interest. Mention taking legal advice.
4Apply confidentiality: state the principle, then the exception that applies. Do not simply say you must report.
5Deal with money laundering: report internally to the MLRO and avoid tipping off when speaking to the client.
6Assess audit impact: reliability of management representations, additional procedures, effect on the opinion, and whether the matter is material and pervasive.
7Consider the engagement: continue with more scepticism, or withdraw. Note steps on withdrawal and communication with the successor.
8Close with a clear recommendation and document the judgement, since professional skills marks reward a clear, justified conclusion.

Quickest way: Who, what, how, then the audit file

When to use it: Use it when time is short and the question asks what the auditor should do about a suspected fraud.

Who to tell: management one level above, TCWG if implicated, regulator if a duty exists.
Confidentiality: disclose only where law requires or permits, after legal advice.
Money laundering: report to the MLRO and do not tip off.
Audit response: reassess risk, representations and the opinion.
Engagement: continue or withdraw, with reasons.

Common mistakes in Communication, Reporting and Ethical Implications of Fraud

Saying the auditor must report all fraud to the regulator.
Students overlook confidentiality and treat reporting as automatic.
Fix: State that confidentiality applies unless law requires or permits disclosure, or there is a professional duty. Check whether the entity is regulated and take legal advice.
Telling the client's management that a money laundering report was made.
It feels open and honest to tell the client.
Fix: Explain that tipping off can be an offence. Report to the MLRO and say nothing that reveals the report.
Reporting a suspected fraud to the manager who is suspected of it.
Students forget to check who is involved.
Fix: Go one level above those involved, or to TCWG if management may be implicated.
Treating withdrawal as the first and only response.
Withdrawal seems like the safe way out.
Fix: Consider it only after assessing management integrity, materiality and legal duties. Often you continue with more procedures. Also remember that withdrawing does not remove reporting duties.
Ignoring the audit report and written representations.
Students focus on the ethics and forget the audit consequences.
Fix: Add the effect on representations (ISA 580) and the opinion (ISA 705), covering misstatement and limitation on scope.
Giving generic answers not applied to the scenario.
Students recite ISA 240 rather than analysing facts.
Fix: Use the names, amounts and roles in the case. Link each action to a specific fact.

Worked examples

Example 1

During the audit of Rao Ltd, a private company, you find that the finance director has been diverting customer receipts to a personal account. The amount is material. The managing director is a close friend of the finance director. Explain the steps you should take regarding communication and the engagement.

Show the solution

The fraud involves senior management, so it is significant. Management is implicated, so reporting to the finance director alone is inappropriate.
Raise it with TCWG, such as the non-executive directors or audit committee. Be careful if the managing director may also be involved, and consider who is independent.
Consider external duties. Rao Ltd is private and not regulated, so there may be no statutory duty to report to a regulator, but there may be money laundering reporting. Report internally to the MLRO and take legal advice.
Apply confidentiality. Without a legal requirement, legal permission or a professional right or duty to disclose, you cannot disclose to outsiders without client consent. Statutory money laundering reporting does not need client consent. Do not tip off the finance director about any money laundering report.
Consider the audit: reassess the fraud risk and management integrity, perform extra procedures to quantify the loss, and treat representations from management with caution.
If the fraud is uncorrected and material, modify the opinion under ISA 705. If management blocks your work, consider a limitation on scope.
Consider withdrawal if integrity concerns are such that you cannot rely on management or TCWG fails to act. Take legal advice and document the reasons.

Answer: Report to independent TCWG, not the finance director. Report to the MLRO and avoid tipping off; statutory money laundering reporting does not need client consent. Disclose externally otherwise only if law requires or permits it, or there is a professional right or duty to disclose. Extend procedures and assess the opinion. Consider withdrawal if TCWG does not act or management integrity is in doubt.

Example 2

You are the auditor of Norland Bank, a regulated entity. You suspect that a senior manager has falsified loan records to hide losses. State your reporting responsibilities and how confidentiality affects them.

Show the solution

Identify the entity as regulated. Many jurisdictions place a statutory duty on auditors of banks to report matters of material significance to the regulator.
Communicate the suspicion to management one level above the manager, or to TCWG if senior management may be involved.
Explain that confidentiality does not prevent reporting to the regulator where law requires it. Disclosure is made in good faith and is limited to relevant information.
Take legal advice on the scope of the duty, and check the jurisdiction's rules.
Consider money laundering reporting if the fraud generated criminal proceeds. Report to the MLRO and avoid tipping off.
Assess the effect on the audit: the loan loss may be a material misstatement. Consider modifying the opinion and reassessing management representations.

Answer: Tell TCWG and, where a statutory duty exists, the regulator, since confidentiality is overridden by law. Take legal advice, avoid tipping off, and consider the opinion and the engagement.

Exam tips

Always link your answer to the facts: who is involved, how material, and whether the entity is regulated.
Show that you know confidentiality is a duty with exceptions. Name the exception that applies.
Mention tipping off whenever money laundering appears in the scenario.
Cover three consequences: communication, audit report and the engagement. Many answers cover only one.
Reach a clear recommendation. Professional skills marks reward judgement, not lists.

Practice questions from Fraud and error

Communication, Reporting and Ethical Implications of Fraud: frequently asked questions

Can an auditor report fraud to a regulator without client consent?

Yes, where law requires it, or where there is a professional duty or right to disclose and law does not prohibit it. Disclosure that law merely permits needs the client's authorisation. Without such a basis, confidentiality applies. Take legal advice first.

What is tipping off?

It is alerting the client or a third party that a money laundering report has been made or an investigation is under way. In many jurisdictions it is an offence. You report internally to the MLRO and avoid revealing it.

Who should the auditor tell first if fraud is suspected under ISA 240?

It depends on who is involved. Fraud by employees goes to management at an appropriate level. Fraud involving management, employees with significant internal control roles, or fraud causing material misstatement goes to TCWG, on a timely basis. Where both may be involved, consider legal advice and external reporting options.

When should an auditor withdraw because of fraud?

Consider withdrawal when fraud or management's response raises doubt about integrity, or when you cannot continue to obtain sufficient evidence. Discuss with TCWG, take legal advice and document your reasons. Withdrawal does not remove any duty to report.