Advanced Audit and Assurance (International) · Laws and regulations

Responding to Suspected Non-Compliance (NOCLAR) in an ACCA Audit

Updated 11 October 2026 · Fact-checked

NOCLAR is non-compliance with laws and regulations. When you suspect it, you obtain an understanding of the matter, discuss it with management and those charged with governance, assess the effect on the audit and the financial statements, consider reporting and the audit report, and decide whether to withdraw.

Understand Responding to Suspected Non-Compliance (NOCLAR)

NOCLAR means non-compliance or suspected non-compliance with laws and regulations. It covers acts of omission or commission, intentional or not, by the client, those charged with governance, management or people working for the client. It does not cover personal misconduct unrelated to the entity's business.

Two sources guide you. ISA 250 (Revised) sets the audit duties: you must obtain sufficient appropriate evidence about compliance with laws that have a direct effect on material amounts and disclosures, and perform specified procedures to identify other non-compliance that may have a material effect. The IESBA Code (Section 360 for auditors' professional accountants in public practice) sets the ethical response when you come across NOCLAR.

The central idea is a staged response. First, understand the matter. Then give management and those charged with governance (TCWG) the chance to rectify, remedy or mitigate it. Then judge whether the response is enough. Only after that do you decide on further action, such as reporting to an authority, modifying your opinion or withdrawing.

The key judgement is the likely effect. Consider whether the matter is clearly inconsequential. If it is not, think about the nature, the scale, the harm to investors, creditors, employees or the public, and whether the act points to a lack of integrity. Suspicion of management involvement raises the stakes, because you may doubt the reliability of representations.

Confidentiality is a duty but not absolute. Disclosure to an appropriate authority may be allowed or required by law. Where no law requires it, the Code asks you to judge whether disclosure is needed in the public interest. Take legal advice if unsure. Always document your discussions and decisions.

Key rules to remember

Staged response to NOCLAR: Understand → Discuss with management and TCWG → Assess response → Consider further action; Use this order in every answer. Do not jump to reporting or withdrawal first.
Effect on the audit opinion: Material and not properly accounted for or disclosed → qualified or adverse; unable to obtain evidence → qualified or disclaimer; Per ISA 705. Pervasiveness decides between qualified and adverse, or between qualified and disclaimer.
Refusal to cooperate: Limitation on scope → modify opinion and consider withdrawal; If management or TCWG restrict access or withhold information, treat it as a scope limitation.
Management involvement: Management involved → discuss with TCWG (or higher authority); if TCWG involved too, consider legal advice and options; Do not discuss with the people you suspect where it may tip them off or harm the investigation, such as in money laundering.

How to solve Responding to Suspected Non-Compliance (NOCLAR) questions

Use this order for any NOCLAR requirement. Apply each step to the facts in the scenario, not in the abstract.

1Identify the suspected non-compliance, the law involved and who may be responsible. State whether it is a direct or indirect law for the financial statements.
2Obtain an understanding of the matter and the circumstances. Make enquiries and gather evidence, and ask whether it is clearly inconsequential.
3Discuss with the appropriate level of management, and with TCWG unless management is involved, and ask for rectification or remediation. Consider legal advice.
4Evaluate the response. Ask if the matter has been rectified, remedied or mitigated, and consider the effect on the audit, including representations and risk assessment.
5Assess the financial statement effect: provisions, contingent liabilities, fines, going concern and disclosure. Extend audit work if needed.
6Decide the effect on the auditor's report: qualified or adverse for material misstatement, qualified or disclaimer for limitation, and consider a key audit matter.
7Consider further action: disclosure to an appropriate authority where required or justified in the public interest, and consider resignation if the matter is not resolved.
8Document the matter, discussions, judgements and decisions, and say who you will tell and why.

Quickest way: Five-prompt NOCLAR checklist

When to use it: Use this when time is short and the requirement is open, such as 'Discuss the actions the auditor should take'.

Understand: gather facts, assess seriousness.
Discuss: management, then TCWG.
Assess: has it been remedied? What is the financial effect?
Report: audit opinion, TCWG communication, authority disclosure and confidentiality.
Withdraw: consider resignation if integrity is in doubt, and document everything.

Common mistakes in Responding to Suspected Non-Compliance (NOCLAR)

Reporting straight to the regulator without first discussing with management and TCWG.
Students treat NOCLAR as a whistleblowing question only.
Fix: Show the staged response. Discuss and seek remediation first, then consider disclosure in the public interest.
Saying confidentiality stops the auditor from ever disclosing.
Confidentiality is learned as an absolute principle.
Fix: State that disclosure may be required or permitted by law, or may be justified in the public interest. Mention legal advice.
Always modifying the opinion.
Students link any wrongdoing with a modified opinion.
Fix: Modify only if the matter creates a material misstatement or a scope limitation. If accounted for and disclosed properly, no modification is needed on that basis.
Ignoring the effect on the audit itself.
Focus is on the legal breach, not on reliability of evidence.
Fix: Reassess risks, the reliability of representations, and the need for more procedures, especially if management is involved.
Recommending withdrawal as the first response.
It feels like the safest option.
Fix: Withdrawal is a last resort after the matter is not remedied or management obstructs. Mention professional and legal requirements on resignation.
Forgetting documentation and the tipping-off risk.
Students stop at the opinion.
Fix: End with documentation. If money laundering is suspected, avoid alerting the people involved.

Worked examples

Example 1

During the audit of Zeta Co, you find that the company may have paid bribes to win a government contract. The finance director says it was a 'consultancy fee'. Explain the actions you should take.

Show the solution

Understand the matter: obtain details of the payment, the contract and the consultant, and review the supporting documents. Consider the laws on bribery and the seriousness.
Discuss with management at an appropriate level above the finance director, and with TCWG, because the finance director may be involved. Ask for an explanation and for rectification or remediation.
Evaluate the response. Consider whether the explanation is credible and whether the company will stop, correct and disclose. Consider legal advice.
Consider the financial statement effect: possible fines, loss of the contract, a provision or contingent liability, and going concern. Reassess risk of fraud and the reliability of management representations.
Consider the audit report: modify the opinion if the effect is material and not properly accounted for or disclosed, or if you cannot get enough evidence.
Consider further action. If not resolved, consider disclosure to an appropriate authority where law requires or the public interest justifies it, and consider resignation. Document everything.

Answer: Understand the facts, discuss with management and TCWG, assess the response and the financial effect, modify the opinion if material, consider disclosure to an authority and withdrawal if unresolved, and document.

Example 2

Management of Beta Ltd refuses to give you access to records relating to a suspected breach of environmental law. A possible fine could be material. What is the effect on your report and what else should you consider?

Show the solution

Identify the problem: a limitation on scope, because you cannot obtain sufficient appropriate evidence about a possibly material matter.
Ask TCWG to resolve the restriction and communicate the matter to them.
If access is not given, assess pervasiveness. If the possible effect is material but not pervasive, give a qualified opinion. If pervasive, give a disclaimer.
Consider whether the refusal damages the reliability of management and the representations. Consider your duties on confidentiality and any legal duty to report.
Consider withdrawal if the refusal means you cannot complete the audit, taking legal advice and communicating with TCWG first. Document the matter.

Answer: This is a scope limitation: qualify with 'except for' if material but not pervasive, or disclaim if pervasive. Consider withdrawal, reporting duties and documentation.

Exam tips

Use the staged order: understand, discuss, assess, report, withdraw. Examiners reward the sequence.
Tie each action to the scenario facts. Name the law, the person involved and the amount. Generic answers score few professional skills marks.
Link NOCLAR to the audit report. State the type of modification and the reason, not just 'modify'.
Balance confidentiality with public interest disclosure, and mention legal advice.
If management is involved, say you go to TCWG and doubt representations. That shows scepticism.

Practice questions from Laws and regulations

Responding to Suspected Non-Compliance (NOCLAR): frequently asked questions

What is NOCLAR in audit?

NOCLAR stands for non-compliance with laws and regulations. It covers acts by the client, TCWG, management or employees that go against laws or regulations. Auditors must respond under ISA 250 (Revised) and the IESBA Code.

What should an auditor do if non-compliance is suspected?

Understand the matter, then discuss it with management and TCWG so it can be remedied. Assess the effect on the audit and the financial statements. Then consider the audit report, disclosure to an authority and withdrawal.

Does NOCLAR always lead to a modified audit opinion?

No. A modification is needed only if the effect is material and is not properly accounted for or disclosed, or if you cannot obtain enough evidence. Pervasiveness decides the type of modification.

Can the auditor breach confidentiality to report NOCLAR?

Sometimes. Law may require or permit disclosure to an authority. Where it does not, the Code asks you to judge whether disclosure is in the public interest. Take legal advice before you act.