Advanced Audit and Assurance (International) · Laws and regulations

Audit Procedures for Identifying Non-Compliance with Laws and Regulations

Updated 11 October 2026 · Fact-checked

Under ISA 250 (Revised), you identify non-compliance by understanding the legal framework, enquiring of management and those charged with governance, inspecting correspondence with regulators, and obtaining written representations. If you suspect non-compliance, you gather more information, assess the effect on the financial statements and report appropriately.

Understand Audit Procedures for Identifying Non-Compliance

Laws and regulations fall into two groups. The first group has a direct effect on the amounts and disclosures in the financial statements, such as tax and pension laws. The second group does not have a direct effect, but compliance may be vital to the entity's operations, its licence to operate or its ability to continue as a going concern. Examples are environmental permits and financial services licences.

Your responsibility differs between the two groups. For the first group, you must obtain sufficient appropriate audit evidence that the laws are complied with. For the second group, you only perform specified procedures to help identify non-compliance that may have a material effect on the financial statements. These are enquiries of management and those charged with governance, and inspecting correspondence with licensing or regulatory authorities.

You are not expected to detect all non-compliance. Management is responsible for compliance, and an audit has inherent limits. The further a law is from the financial statements, the less likely you are to notice a breach. Even so, you must stay alert throughout the audit.

The work is spread across the audit. At planning you obtain a general understanding of the legal and regulatory framework and how the entity complies. During the audit you stay alert to evidence of non-compliance in other procedures, such as reading minutes and testing legal expenses. At completion you obtain a written representation that management has disclosed all known or suspected non-compliance.

If you identify or suspect non-compliance, you understand the nature of the act and the circumstances. You obtain further information to evaluate the possible effect on the financial statements. You discuss it with management and those charged with governance, and consider whether you need legal advice. You then evaluate the implications for your opinion, the risk assessment, the reliability of representations, and your reporting and ethical duties.

Key rules to remember

Group 1: laws with a direct effect: Obtain sufficient appropriate audit evidence of compliance; Applies to laws that determine material amounts and disclosures, such as tax and pensions.
Group 2: other laws: Perform specified procedures to help identify non-compliance that may be material; The procedures are enquiry of management and those charged with governance, and inspection of correspondence with regulators or licensing bodies.
Written representation: Management confirms it has disclosed all known or suspected non-compliance; Required by ISA 250 (Revised). It does not replace other evidence.
Suspected non-compliance: Understand → evaluate effect → discuss → consider legal advice → conclude on opinion and reporting; Use this sequence when something looks wrong.

How to solve Audit Procedures for Identifying Non-Compliance questions

Use this method for any question asking which procedures to perform, or what to do when non-compliance is suspected.

1Read the scenario and identify the law or regulation involved. Decide whether it affects the financial statements directly or only through operations, licences or going concern.
2State the auditor's responsibility for that group: sufficient evidence for direct-effect laws, specified procedures for the others.
3List planning procedures: understanding the legal framework, how management ensures compliance, and the industry's regulation.
4List procedures during the audit: enquiries of management and those charged with governance, inspection of correspondence with regulators, reading minutes, and reviewing legal expenses and legal letters.
5Link each procedure to a specific fact in the scenario, such as a fine, a missing licence, or an unusual payment.
6If non-compliance is suspected, explain the response: understand it, evaluate the financial effect, discuss with management and those charged with governance, and consider legal advice.
7Conclude on the effect on the audit opinion, the reliance on management representations, and the reporting duties, including to regulators where required.
8Add the written representation at completion and state that it supports other evidence rather than replacing it.

Quickest way: Plan, Ask, Inspect, Represent, Respond

When to use it: Use when you have little time and need a structured list of procedures that scores on any scenario.

Plan: understand the legal framework and the entity's compliance controls.
Ask: enquire of management and those charged with governance about compliance and any known breaches.
Inspect: read correspondence with regulators and licensing bodies, minutes and legal invoices.
Represent: obtain written representation on disclosure of non-compliance.
Respond: if suspected, understand it, assess the financial effect, discuss it, take legal advice if needed, then conclude on opinion and reporting.
Tie each point to the scenario in one sentence.

Common mistakes in Audit Procedures for Identifying Non-Compliance

Saying the auditor must detect all non-compliance.
Students confuse the auditor's role with management's responsibility.
Fix: State that management is responsible for compliance and that the auditor gives reasonable, not absolute, assurance.
Listing every audit procedure without separating the two groups of laws.
Students recall a general checklist and skip the ISA structure.
Fix: Say first whether the law has a direct effect on the financial statements. Then match the level of work to the group.
Treating the written representation as sufficient evidence.
It is easy to obtain and appears in every completion list.
Fix: Explain that representations support but never replace other evidence, and that they carry less weight if management's integrity is in doubt.
Giving generic procedures that ignore the scenario.
Students rush to recall lists.
Fix: Name the specific regulator, licence, fine or payment in the scenario and say which document you would inspect.
Forgetting the response once non-compliance is suspected.
The question seems to ask only about identifying it.
Fix: Add the next steps: evaluate the effect, discuss with those charged with governance, consider legal advice and the opinion, and consider reporting duties.

Worked examples

Example 1

You are the audit senior on Zenith Pharma, which operates under a manufacturing licence from a national health regulator. The licence is needed to sell its products. Describe the audit procedures you would perform to help identify non-compliance with the licence conditions. (6 marks)

Show the solution

Identify the law group: the licence does not directly determine financial statement amounts, but loss of it would threaten operations and going concern. So the auditor performs specified procedures rather than seeking full assurance of compliance.
Planning: obtain an understanding of the licence conditions, the regulator's inspection regime, and the controls management has to monitor compliance.
Enquiry: ask management and those charged with governance whether there have been breaches, inspections, warnings or investigations.
Inspection: read correspondence with the health regulator, including inspection reports, warning letters and renewal notices.
Other evidence: read board and compliance committee minutes, and review legal expenses and any legal letters for disputes or fines.
Completion: obtain a written representation that all known or suspected non-compliance has been disclosed, treating it as supporting evidence only.

Answer: Understand the licence and compliance controls, enquire of management and those charged with governance, inspect regulator correspondence, read minutes and legal costs, and obtain a written representation at completion.

Example 2

During the audit of Karan Retail you find a payment of $120,000 to a foreign agent with no contract. Management says it is a consulting fee. You suspect it may be a bribe. Explain what you would do. (6 marks)

Show the solution

Understand the act: obtain details of the payment, the agent, the approval, the services supposedly received and the circumstances.
Evaluate the effect: consider whether the payment, or any resulting fines or loss of contracts, could be material or require disclosure or provisions.
Discuss: raise it with management at an appropriate level, and with those charged with governance if management is involved or does not give a credible explanation.
Seek legal advice if needed on the law applying and the consequences.
Reassess risk: consider the integrity of management, the reliability of representations, and the fraud risk assessment.
Conclude on the opinion, which may be modified if the effect is material and not properly accounted for or disclosed, and consider reporting duties, including to an authority if the law or the ethical code requires it, bearing in mind confidentiality.

Answer: Understand the payment, evaluate its financial effect, discuss it with management and those charged with governance, take legal advice, reassess risk and representations, then conclude on the opinion and any reporting duty.

Exam tips

Always split laws into those with a direct effect on the financial statements and the rest, because the level of auditor responsibility differs.
Name the exact procedures for the second group: enquiry of management and those charged with governance, and inspection of correspondence with regulators.
Apply every point to the scenario, since professional skills marks reward commercial awareness and relevance.
If the question says non-compliance is suspected, cover the response and reporting, not just detection.
Mention that written representations support but do not replace other evidence.

Practice questions from Laws and regulations

Audit Procedures for Identifying Non-Compliance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CS ProfessionalPenalties for Non-Compliance with Section 134

Audit Procedures for Identifying Non-Compliance: frequently asked questions

What procedures does ISA 250 require for laws without a direct effect?

You enquire of management and those charged with governance about compliance. You also inspect correspondence with licensing or regulatory authorities. You must also stay alert to non-compliance during the rest of the audit.

Is a written representation about non-compliance mandatory?

Yes. ISA 250 (Revised) requires you to obtain a written representation that management has disclosed all known or suspected non-compliance whose effects should be considered when preparing the financial statements. It supports other evidence only.

Must the auditor detect all non-compliance?

No. Management is responsible for compliance. The auditor gives reasonable assurance, and the further a law is from the financial statements, the less likely a breach is to be detected.

What should I do if I suspect non-compliance in the exam?

Understand the act, evaluate its effect on the financial statements, discuss it with management and those charged with governance, and consider legal advice. Then conclude on the opinion and consider reporting duties and confidentiality.