Advanced Audit and Assurance (International) · International regulatory frameworks for audit and assurance services

Professional Scepticism, Laws, Regulations and Money Laundering in Audit

Updated 11 October 2026 · Fact-checked

Professional scepticism is a questioning mind and critical assessment of evidence. For non-compliance with laws, you identify it, assess its effect, discuss it with management and those charged with governance, then consider reporting. Money laundering suspicions may need a report to the authorities, which can override confidentiality. Always follow local law and the Code.

Understand Professional Scepticism, Laws, Regulations and Money Laundering

Professional scepticism means a questioning mind, alertness to conditions that suggest misstatement, and a critical assessment of evidence. It is not distrust of everyone. It means you do not accept an explanation just because it is plausible or because management has been honest before. Professional judgement is how you apply your training and experience to reach decisions when facts are unclear. Scepticism feeds judgement.

Under ISA 250 (Revised), management is responsible for compliance with laws and regulations. The auditor is responsible for obtaining reasonable assurance that the financial statements are free from material misstatement, including those caused by non-compliance. The auditor distinguishes two groups of laws. The first group has a direct effect on the amounts and disclosures in the financial statements, such as tax and pension laws. For these you obtain sufficient appropriate evidence. The second group does not have a direct effect but may be fundamental to the entity's ability to continue, such as operating licences or environmental rules. For these you perform only specified procedures: enquiries of management and those charged with governance, and inspection of correspondence with licensing or regulatory authorities. You also stay alert to non-compliance throughout the audit.

If you identify or suspect non-compliance, you obtain an understanding of the nature of the act and the circumstances. You discuss it with the appropriate level of management and, where needed, those charged with governance. You evaluate the effect on the financial statements, on the audit report and on your view of management integrity. You document what you found and what you did. You may need legal advice.

Confidentiality is a fundamental principle of the IESBA Code. It can be overridden when disclosure is required by law, or permitted by law and authorised by the client, or when there is a professional duty or right to disclose that is not prohibited by law. In some jurisdictions, there is a legal duty to report certain matters to a regulator. The Code's response framework for non-compliance (NOCLAR) guides the auditor on whether further action, including disclosure to an appropriate authority, is needed. Public interest is a key factor in that decision.

Money laundering is the process of making the proceeds of crime appear legitimate. Laws in most jurisdictions require professionals to report knowledge or suspicion to a designated authority, usually through the firm's nominated officer. Tipping off, meaning alerting the suspect that a report has been made or an investigation is under way, is typically an offence. The exact rules depend on local law, so in the exam say that the firm follows the law of the relevant jurisdiction.

Key rules to remember

Professional scepticism: Questioning mind + critical assessment of evidence + alertness to contrary information; Apply it at every stage: planning, evidence evaluation, estimates, management explanations and completion.
ISA 250 direct-effect laws: Laws with direct effect on amounts and disclosures → obtain sufficient appropriate audit evidence; Examples are tax and pension laws.
ISA 250 other laws: Laws fundamental to operating ability → limited procedures: enquiries of management and TCWG, and inspect correspondence with regulators; Examples are licences and environmental rules. Stay alert to possible non-compliance.
Response to suspected non-compliance: Understand → discuss with management/TCWG → evaluate effect → consider reporting and report implications → document; Take legal advice where unsure.
Confidentiality override: Disclosure allowed if required by law, or permitted by law and authorised by the client, or a professional duty or right exists and is not prohibited by law; Always check local law first.
Money laundering reporting: Knowledge or suspicion → report to the nominated officer → report to authority → no tipping off; Details vary by jurisdiction. Do not alert the suspect.

How to solve Professional Scepticism, Laws, Regulations and Money Laundering questions

Use this method for any scenario on scepticism, non-compliance, confidentiality or money laundering.

1Identify the issue from the scenario: scepticism failure, a possible illegal act, a confidentiality conflict or a money laundering suspicion.
2Classify the law involved: direct effect on the financial statements, or fundamental to operations only. This decides the work required.
3State the auditor's responsibility: management is responsible for compliance, and the auditor obtains reasonable assurance and responds to non-compliance found.
4Apply the facts: say what the auditor should do next, such as enquire, obtain evidence, discuss with those charged with governance and take legal advice.
5Assess the effect on the audit: materiality, management integrity, reliance on representations, the audit opinion and whether to continue as auditor.
6Deal with reporting and confidentiality: internal reporting to the nominated officer, external reporting where required by law, and avoid tipping off.
7Document the matter and conclude with a clear recommendation, linking back to the scenario.
8Add professional skills: be sceptical, balanced and commercial, and communicate in the format asked for.

Quickest way: Issue, Law, Action, Report

When to use it: Use when time is short and the requirement is a short list of actions or a brief explanation.

Issue: name the problem in one line.
Law: say which responsibility applies (ISA 250, Code or local money laundering law).
Action: list the audit steps and who you speak to.
Report: say who must be told, internally and externally, and what to avoid, such as tipping off.
Close with the effect on the audit opinion or the engagement.

Common mistakes in Professional Scepticism, Laws, Regulations and Money Laundering

Saying the auditor is responsible for preventing illegal acts.
Students confuse the auditor's role with management's role.
Fix: State that management and those charged with governance are responsible for compliance. The auditor obtains reasonable assurance and responds when non-compliance is found.
Saying the auditor must always report to the authorities.
Students overstate the reporting duty.
Fix: Say it depends on law and the Code. Money laundering suspicions are normally reportable. For other non-compliance, consider legal duties, public interest and the NOCLAR framework.
Treating confidentiality as absolute.
It is a fundamental principle, so students assume it cannot be overridden.
Fix: Give the exceptions: disclosure required by law, permitted by law and authorised by the client, or a professional duty or right that is not prohibited by law.
Telling the client about a money laundering report.
Students think openness with management is always right.
Fix: Warn against tipping off. Take advice from the nominated officer before discussing the matter with the client.
Writing generic scepticism definitions with no link to the scenario.
Students memorise a definition and stop.
Fix: Name the specific evidence or explanation that should be challenged and say what corroborating evidence the auditor would seek.
Ignoring the effect on the financial statements and the audit report.
Students focus on reporting and forget the audit consequences.
Fix: Always consider materiality, disclosure, reliability of representations, and whether a modified opinion or withdrawal is needed.

Worked examples

Example 1

During the audit of Zeta Co, you learn that the company has operated a factory without a renewed environmental licence for six months. The regulator has sent a warning letter. Explain the auditor's responsibilities and the actions you would take.

Show the solution

Classify the law: environmental licensing does not directly affect the amounts in the financial statements but may be fundamental to the company's ability to continue operating. Under ISA 250, limited procedures are required, but this is now known non-compliance, so you must respond.
Responsibility: management is responsible for compliance. You are responsible for reasonable assurance on material misstatement and for responding to the non-compliance identified.
Understand the matter: obtain the warning letter, enquire of management why the licence lapsed, and ask what penalties or closure are possible. Consider taking legal advice.
Discuss with management and those charged with governance, and ask for their plan to remedy the situation.
Assess the financial statement effect: possible fines, a provision or contingent liability, impairment of the factory, and going concern if closure is likely. Check whether disclosure is adequate.
Assess the effect on the audit: reconsider management integrity and reliance on representations. If the effect is material and not properly accounted for or disclosed, modify the opinion.
Consider reporting: check local law for a duty to report to the regulator. The regulator already knows of the issue, but the Code's response framework still requires you to consider whether further action is needed. Document everything.

Answer: Treat the lapsed licence as non-compliance that could affect going concern and provisions. Obtain the facts, discuss with management and those charged with governance, assess the effect on the financial statements and the audit opinion, consider legal advice and any reporting duty, and document the work.

Example 2

During an audit, a junior finds that a customer made several large cash payments just below a reporting threshold, then asked for a refund by bank transfer to a third party. The audit manager suspects money laundering. Explain what the team should do and why the client must not be told.

Show the solution

Recognise the red flags: structured cash payments, an unusual refund request and a third-party payee. These are typical indicators of laundering.
Report internally straight away. The junior reports to the engagement partner or the firm's nominated officer, in line with firm policy. The team does not investigate on its own.
The nominated officer considers the facts and decides whether to make a report to the designated authority under local law. The duty usually arises on knowledge or suspicion, not proof.
Do not tip off. Alerting the client or the customer that a report is being made or an investigation is under way is typically an offence and could prejudice an investigation.
Take advice from the nominated officer on how to continue the audit, including whether any work or communication could amount to tipping off, and whether consent is needed before proceeding.
Consider the audit effect: the possibility of fraud or illegal acts, impact on revenue and cash records, management integrity, and the need to communicate with those charged with governance if that is allowed by law.
Document the decisions and keep the information confidential, subject to legal reporting obligations.

Answer: Report the suspicion internally to the nominated officer, who decides on reporting to the authority. The team must not tip off the client, should continue only on advice, and should assess the audit and financial statement effect while documenting the matter.

Exam tips

Read the requirement verb. 'Explain' needs reasons, 'recommend' needs a clear decision, and 'discuss' needs both sides.
Always split the answer into responsibilities, actions, reporting and effect on the audit. This structure earns marks quickly.
State that rules depend on local law. Never invent section numbers or specific legal thresholds.
Use the scenario facts to show scepticism, for example by naming the explanation you would challenge and the evidence you would ask for.
Earn professional skills marks with a clear format, balanced judgement and practical advice, not a list of textbook points.

Practice questions from International regulatory frameworks for audit and assurance services

Professional Scepticism, Laws, Regulations and Money Laundering in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

ACCA Applied SkillsLaws and Regulations (ISA 250)

Professional Scepticism, Laws, Regulations and Money Laundering: frequently asked questions

What is the auditor's main responsibility under ISA 250?

The auditor obtains reasonable assurance that the financial statements are free from material misstatement caused by non-compliance with laws that have a direct effect on them. For other laws, the auditor performs limited procedures and responds if non-compliance is identified or suspected. Management remains responsible for compliance.

Can an auditor breach confidentiality to report non-compliance?

Yes, in certain situations. Disclosure may be required by law, permitted by law and authorised by the client, or justified by a professional duty or right that is not prohibited by law. The auditor should consider the public interest and take legal advice.

What is tipping off in money laundering?

Tipping off is alerting a person that a report has been made or that an investigation is under way, in a way that could prejudice it. It is typically a criminal offence. Always take advice from the firm's nominated officer.

How do I show professional scepticism in an exam answer?

Point to a specific explanation or piece of evidence in the scenario and say why it needs challenge. Then name the corroborating evidence you would obtain, such as third-party documents or independent confirmation. Avoid simply repeating the definition.