Advanced Auditing, Assurance and Professional Ethics · General Auditing Principles and Auditors Responsibilities

Fraud and Error: Responsibilities under SA 240

Updated 5 October 2026 · Fact-checked

SA 240 deals with the auditor's responsibilities relating to fraud in an audit of financial statements. Fraud is an intentional act to obtain an unjust or illegal advantage; error is unintentional. Management and those charged with governance prevent and detect fraud. The auditor obtains reasonable assurance that the statements are free of material misstatement, whether from fraud or error.

Understand Fraud and Error: Responsibilities under SA 240

A misstatement in financial statements arises from either fraud or error. The only difference is intent. An error is an unintentional misstatement, such as a mistake in gathering data, a wrong accounting estimate caused by oversight, or a misapplied accounting policy. Fraud is an intentional act by one or more members of management, those charged with governance, employees or third parties, involving deception to obtain an unjust or illegal advantage.

SA 240 recognises two types of intentional misstatement relevant to the auditor. The first is fraudulent financial reporting: intentional misstatement or omission of amounts or disclosures to deceive users. Examples are manipulating records, misrepresenting events, and intentionally misapplying accounting principles. The second is misappropriation of assets: theft of the entity's assets, such as embezzling receipts, stealing inventory, or making payments for goods never received. It is often accompanied by false records to hide the theft.

Fraud usually involves three conditions, often called the fraud triangle: an incentive or pressure to commit fraud, a perceived opportunity (for example, weak controls or management override), and an attitude or rationalisation that justifies the act. The auditor looks for these as fraud risk factors.

Responsibility is split. Those charged with governance oversee management and the entity's systems for preventing and detecting fraud. Management, with oversight from TCWG, is responsible for designing and operating internal controls and creating a culture of honesty and ethical behaviour. The auditor is responsible for obtaining reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by fraud or error. The auditor does not make legal determinations of whether fraud has occurred.

There are inherent limitations. The risk of not detecting a material misstatement from fraud is higher than from error, because fraud may involve collusion, forgery, deliberate omission or management override of controls. An audit conducted per the SAs still carries this unavoidable risk. The auditor must therefore maintain professional skepticism throughout and accept that records and documents may not be genuine.

Key rules to remember

Fraud vs error test: Intentional act = Fraud; Unintentional act = Error; Intent is the only distinguishing factor. The auditor does not conclude on legal intent, only on whether a misstatement exists.
Two types of fraud relevant to the auditor: Fraudulent financial reporting + Misappropriation of assets; Fraudulent reporting is usually by management; misappropriation is more often by employees but can involve management.
Fraud triangle: Incentive/Pressure + Opportunity + Attitude/Rationalisation; Fraud risk factors are grouped under these three headings.
Auditor's responsibility: Reasonable assurance that financial statements as a whole are free from material misstatement (fraud or error); Reasonable assurance is high but not absolute. Auditor is not responsible for preventing fraud.
Presumed risks: Risk in revenue recognition + Risk of management override of controls; Presume a risk of fraud in revenue recognition (rebuttable, with reasons documented). Management override risk is always treated as a significant risk and cannot be rebutted. Procedures include testing journal entries, reviewing estimates for bias and evaluating the business rationale of significant unusual transactions.
Engagement team discussion: Discuss susceptibility of the entity to material misstatement due to fraud; Required among key engagement team members, with the engagement partner deciding which matters to communicate to members not present.

How to solve Fraud and Error: Responsibilities under SA 240 questions

Use this sequence for any SA 240 question, whether it asks for definitions, responsibilities or a case-based conclusion.

1Read the facts and identify whether the misstatement is intentional or unintentional. This classifies it as fraud or error.
2If fraud, classify it as fraudulent financial reporting or misappropriation of assets, and say who is involved (management, employees or third parties).
3State who is responsible for what: TCWG oversee, management prevents and detects, auditor obtains reasonable assurance.
4Link the facts to the fraud triangle: name the incentive, the opportunity and the rationalisation visible in the case.
5Apply the auditor's duties: professional skepticism, team discussion, risk assessment, presumed risks, responses to assessed risks.
6Say what the auditor must do next: evaluate the effect on the audit, communicate to the appropriate level of management or TCWG, consider reporting responsibilities and modification of the report.
7Conclude in provision-facts-conclusion form, with a clear final line answering the exact question.

Quickest way: Intent, Who, Duty

When to use it: Use for short MCQs and 4-5 mark theory questions where time is tight.

Intent: was it deliberate? Yes means fraud, no means error.
Who: management, employee or third party, and which type of fraud.
Duty: management and TCWG own prevention and detection; auditor owns reasonable assurance plus skepticism.
Add the two presumed risks (revenue recognition and management override) if the question is about risk assessment.
Close with one line on inherent limitations, since fraud is harder to detect than error.

Common mistakes in Fraud and Error: Responsibilities under SA 240

Writing that the auditor is responsible for preventing and detecting fraud.
Students mix up the auditor's role with management's role.
Fix: Write that prevention and detection rest with management and TCWG. The auditor obtains reasonable assurance about material misstatement.
Distinguishing fraud and error by the size of the amount or by whether money was lost.
Students think fraud means large theft.
Fix: Use intent as the only test. Even a small intentional misstatement is fraud, and a large unintentional one is error.
Saying the auditor decides whether fraud legally occurred.
The word 'fraud' sounds like a legal conclusion.
Fix: State that the auditor assesses whether a material misstatement exists and does not make legal determinations of fraud.
Treating the revenue recognition presumption as unrebuttable, or the management override risk as rebuttable.
The two presumed risks are memorised together without their conditions.
Fix: Remember: revenue recognition fraud risk is a rebuttable presumption, with reasons documented. Management override is always present and cannot be rebutted.
Ignoring the engagement team discussion and professional skepticism in answers.
Students focus only on audit procedures.
Fix: Open the auditor's duties with skepticism and the team discussion, then add risk assessment and responses.
Treating an absence of detected fraud as proof that none exists.
Students forget the inherent limitations of an audit.
Fix: Note that an audit per the SAs gives reasonable, not absolute, assurance. Collusion, forgery and override can defeat even a well-planned audit.

Worked examples

Example 1

During the audit of Sundar Traders Ltd, you find that the accounts clerk, who also has custody of petty cash, has been passing fictitious vouchers to conceal cash shortages. The shortage is material. The CFO says internal controls are strong, and asks you to treat it as a clerical error. How do you classify it and who is responsible?

Show the solution

Intent: fictitious vouchers were passed deliberately to hide shortages. The act is intentional, so it is fraud and not error.
Type: it is theft of cash with false records to conceal it, so it is misappropriation of assets, committed by an employee.
Fraud triangle: the clerk has the opportunity (custody of cash and record-keeping, so no segregation of duties). Pressure and rationalisation need further inquiry.
Responsibility: management and TCWG are responsible for designing controls that prevent and detect such fraud. The CFO's claim of strong controls is contradicted by the lack of segregation.
Auditor's duty: the auditor must not accept the CFO's label. The auditor evaluates the effect on the financial statements and on the reliability of management representations, and extends procedures.
Communication: the auditor communicates the matter on a timely basis to the appropriate level of management and, unless all of TCWG are involved in management, to TCWG, and considers reporting responsibilities and the effect on the report.

Answer: It is fraud, specifically misappropriation of assets by an employee. Management and TCWG are responsible for prevention and detection. The auditor must reject the 'clerical error' label, extend procedures, communicate to management and TCWG and consider the impact on the audit report.

Example 2

Meera & Co. audits Zenith Pharma Ltd, a listed company. Its promoter-managing director has told the CFO that results must show growth of at least 20% to meet loan covenants. In March, large sales were booked to a new distributor with generous return rights, and the invoices were dated before year-end though goods were dispatched in April. The audit team says that, as no fraud risk was identified, standard sales testing is enough. Evaluate.

Show the solution

Intent and type: dispatch after year-end with pre-dated invoices to boost results is deliberate. It is fraudulent financial reporting by management.
Fraud triangle: incentive is loan covenants and the 20% growth target. Opportunity is the MD's influence and management override. Rationalisation is likely 'the sales will happen anyway'.
Presumed risks: SA 240 presumes a fraud risk in revenue recognition. The facts support this and nothing rebuts it. Management override is also always a risk.
Team error: the team's view that no fraud risk exists is wrong. Revenue must be treated as a significant risk, with responses designed for it.
Responses: test cut-off using dispatch documents and delivery proofs, confirm terms and balances with the distributor, review return rights and post year-end returns, test journal entries near year-end and review for bias in estimates.
Further duties: hold or update the team discussion, maintain professional skepticism, obtain representations carefully, and communicate with TCWG if misstatement is found or suspected.

Answer: The standard testing is insufficient. Revenue recognition is a presumed fraud risk, supported here by the incentive, opportunity and cut-off facts. The auditor must treat it as a significant risk, perform targeted cut-off and journal entry procedures and communicate any misstatement to management and TCWG.

Exam tips

Start every answer with the intent test. It shows the examiner you can classify the facts before applying the rule.
In case scenarios, name the type of fraud and match it to the fraud triangle using facts from the case, not generic lists.
Always write both presumed risks (revenue recognition and management override) and note which can be rebutted.
Use provision-facts-conclusion form: state the SA 240 requirement, apply the case facts and give a one-line conclusion.
In MCQs, watch for options that put prevention and detection on the auditor. These are almost always wrong.

Practice questions from General Auditing Principles and Auditors Responsibilities

Fraud and Error: Responsibilities under SA 240 in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Fraud and Error: Responsibilities under SA 240: frequently asked questions

What is the main difference between fraud and error in audit?

The difference is intent. Fraud is an intentional act involving deception to gain an unjust or illegal advantage. Error is an unintentional misstatement, such as a calculation mistake or oversight.

Is the auditor responsible for detecting all frauds under SA 240?

No. The auditor obtains reasonable assurance that the financial statements are free from material misstatement, whether due to fraud or error. Because of inherent limitations, a material misstatement may go undetected even when the audit is properly planned and performed.

What are the two types of fraud in SA 240?

They are fraudulent financial reporting and misappropriation of assets. The first involves intentionally misstating financial statements to deceive users. The second involves theft of the entity's assets, often hidden by false records.

Who is responsible for preventing fraud in a company?

Management is responsible for designing and operating internal controls and promoting a culture of honesty. Those charged with governance oversee this. The auditor does not bear this responsibility.