Advanced Auditing, Assurance and Professional Ethics · General Auditing Principles and Auditors Responsibilities

Fraud Communications, Documentation and Reporting (SA 240) for CA Final

Updated 5 October 2026

Under SA 240, you obtain written representations, tell management promptly, tell those charged with governance about fraud involving management or significant employees, and document it all. Under Section 143(12), fraud by officers or employees involving or expected to involve ₹1 crore or above goes to the Central Government after a Board report; smaller fraud goes to the Audit Committee or Board.

Understand Fraud Communications, Documentation and Reporting

Finding fraud is only half the job. The other half is what you do next. SA 240 and the Companies Act, 2013 tell you whom to inform, in what order, and what to keep on file. Exam questions test this sequence.

Start with written representations. Near the end of the audit you ask management (and, where required, those charged with governance, called TCWG) to confirm in writing that: they accept responsibility for internal control to prevent and detect fraud; they have disclosed the results of their fraud-risk assessment; they have disclosed all known or suspected fraud involving management, employees with significant roles in internal control, or others where the effect could be material; and they have disclosed any allegations of fraud raised by employees, former employees, analysts, regulators or others. These representations support your evidence. They never replace your own procedures.

Communication inside the entity follows a ladder. If you find fraud, or get information that fraud may exist, you tell the appropriate level of management on a timely basis. This is usually a level above the people involved. If the fraud involves management, employees with significant roles in internal control, or others where the fraud causes a material misstatement, you also tell TCWG on a timely basis. The exception is when all TCWG are themselves involved in managing the entity. If you suspect fraud by management, you share the suspicion with TCWG and discuss the nature, timing and extent of the audit procedures needed.

Reporting outside the entity comes from two sources. SA 240 says you decide whether you have a responsibility to report to a party outside the entity. Law can override the duty of confidentiality here. For companies, Section 143(12) of the Companies Act, 2013 applies when you have reason to believe that officers or employees are committing, or have committed, an offence involving fraud against the company. The Companies (Audit and Auditors) Rules, 2014 (Rule 13) set the route. The test is whether the fraud involves or is expected to involve ₹1 crore or above. If it does, you report to the Board or Audit Committee immediately but not later than two days of your knowledge of the fraud, and then follow the reply period and filing with the Central Government. If it is below ₹1 crore, you report to the Audit Committee or Board immediately but not later than two days of your knowledge, stating the nature of the fraud, the parties involved and the amount. The company then discloses the details in the Board's report under Section 134(3)(ca).

Finally, documentation and exceptional circumstances. You document the fraud risks you assessed, your responses, and every fraud communication to management, TCWG, regulators and others. If fraud or suspected fraud puts your ability to continue in doubt, you work out your professional and legal duties, consider withdrawal where the law allows it, and report as required if you withdraw.

Key rules to remember

Written representations on fraud (SA 240): Management and TCWG confirm: (1) responsibility for fraud-prevention controls; (2) disclosure of fraud-risk assessment results; (3) disclosure of known or suspected fraud; (4) disclosure of fraud allegations received; Obtain them in writing. They are supporting evidence only, not a substitute for audit procedures.
Communication to management: Fraud identified or information indicating fraud may exist → tell the appropriate level of management on a timely basis; Usually a level above those suspected of being involved.
Communication to TCWG: Fraud or suspected fraud involving management, employees with significant roles in internal control, or others (material misstatement) → tell TCWG on a timely basis; Not needed if all TCWG are involved in managing the entity. If management is suspected, also discuss the audit procedures needed.
Section 143(12) threshold (Rule 13): Fraud by officers or employees involving or expected to involve ₹1 crore or above → Central Government route; below ₹1 crore → Audit Committee or Board route; Test the amount involved or expected to be involved in the fraud. If a case leaves it unclear whether several frauds are to be treated together, state your assumption.
Procedure for ₹1 crore or above: Report to Board or Audit Committee immediately but not later than 2 days of knowledge → seek reply or observations within 45 days → forward your report, the reply or observations, and your comments to the Central Government within 15 days of receiving the reply or of the expiry of the 45 days; Send to the Secretary, Ministry of Corporate Affairs, in a sealed cover by registered post with acknowledgement due or speed post, followed by an email.
Procedure below ₹1 crore: Report to the Audit Committee (or Board) immediately but not later than 2 days of knowledge, specifying the nature of the fraud, the parties involved and the amount; Specify the details as Rule 13 requires. You do not report to the Central Government on this route. The company discloses the details in the Board's report under Section 134(3)(ca). The 45-day reply period and the 15-day filing apply only at ₹1 crore or above.
Documentation (SA 240): Document: fraud risks identified and assessed (financial statement and assertion level); your responses; communications to management, TCWG, regulators and others; reasons if the revenue-fraud presumption is rejected; Use a short note to the file and keep copies of letters and minutes.
Exceptional circumstances: Determine duties → consider withdrawal (if law permits) → discuss with management and TCWG → decide on reporting to the appointing authority or regulators; Withdrawal is a last step, not the first reaction.

How to solve Fraud Communications, Documentation and Reporting questions

Use this order for any case question on fraud communication, reporting or withdrawal. It keeps your answer in provision-facts-conclusion form.

1Identify who is involved in the fraud (employee, officer, management, TCWG) and whether it is fraud or only suspicion. This decides the level of communication.
2Check the amount, and whether the fraud is against the company by officers or employees. This decides whether Section 143(12) applies and which route (₹1 crore threshold).
3Write the SA 240 communication step: tell the appropriate level of management, then TCWG if management or significant employees are involved, and do it on a timely basis.
4Write the external reporting step: Section 143(12) and Rule 13 if it applies. For ₹1 crore or more, give the timelines (2 days, 45 days, 15 days). Mention the duty of confidentiality being overridden by law.
5Check for exceptional circumstances: if management is evasive, obstructs the audit, or the fraud casts doubt on integrity, discuss withdrawal and the related duties.
6State the documentation: fraud risks, responses, and every communication made, with dates.
7Link to the report: consider the effect on the audit opinion and on CARO 2020 clause 11 reporting, where relevant.
8Conclude clearly in one line: what the auditor should do now.

Quickest way: Who, how much, which route

When to use it: Use this for short MCQs and 5-mark questions when you have only a few minutes.

Ask first: is the fraud by officers or employees against the company? If not, SA 240 communication still applies but Section 143(12) may not.
Check the amount involved or expected to be involved. Both routes begin with a report to the Board or Audit Committee immediately but not later than 2 days of knowledge. At ₹1 crore or above, add the 45-day reply period and the filing with the Central Government within 15 days. Below ₹1 crore, you report the nature of the fraud, the parties involved and the amount to the Audit Committee or Board; the company discloses the details in the Board's report under Section 134(3)(ca).
Ask whether management is involved. If yes, TCWG must be told and the audit procedures discussed.
Add one line each for written representations and documentation.
If the case mentions obstruction or loss of trust, add the withdrawal discussion.

Common mistakes in Fraud Communications, Documentation and Reporting

Reporting every fraud directly to the Central Government.
Students remember the section but forget the ₹1 crore split in Rule 13.
Fix: Always state the amount first. Below ₹1 crore, the report goes to the Audit Committee or Board immediately but not later than 2 days of knowledge, not to the Central Government. The company then discloses the details in the Board's report under Section 134(3)(ca).
Skipping the Board or Audit Committee step for fraud of ₹1 crore or above.
Students think a larger fraud means going straight to the Government.
Fix: Both routes begin with a report to the Board or Audit Committee immediately but not later than 2 days of knowledge. For ₹1 crore or above, then seek a reply within 45 days and file with the Central Government within 15 days of the reply or of the expiry of the 45 days, with your comments. The 45-day and 15-day steps apply only at ₹1 crore or above.
Telling TCWG about every small employee fraud with no regard to who is involved.
Students mix up the management ladder and the TCWG ladder.
Fix: Management is told about any fraud found. TCWG must be told where management, employees with significant roles in internal control, or others (with material misstatement) are involved. Judge by who and how material.
Treating the management representation letter as proof that no fraud exists.
Students over-rely on the letter as audit evidence.
Fix: Say that representations support, but do not replace, audit procedures. If representations conflict with evidence, investigate further.
Saying the auditor must always resign when fraud is found.
Students confuse the exceptional-circumstances rule with the normal case.
Fix: Withdrawal is only considered when fraud or suspected fraud raises doubt about your ability to continue, and only where the law permits it. First determine your duties and discuss with management and TCWG.
Forgetting documentation or listing only the fraud finding.
Students treat documentation as an afterthought.
Fix: List fraud risks and responses, all communications to management, TCWG, regulators and others, and reasons for any conclusions, such as setting aside the revenue-fraud presumption.

Worked examples

Example 1

During the audit of Zenith Pharma Ltd., a company with an Audit Committee, you find that the purchase manager has diverted ₹60,00,000 through fictitious vendor payments over two years. The CFO is not involved. Explain your communication and reporting responsibilities.

Show the solution

Provision: SA 240 requires timely communication of an identified fraud to the appropriate level of management. Section 143(12) with Rule 13 applies where officers or employees commit fraud against the company.
Facts: The fraud is by an employee (purchase manager) against the company. The amount of ₹60 lakh is below ₹1 crore.
Management communication: Inform the CFO or another suitable level above the purchase manager, promptly. Discuss the facts and the extent of the fraud.
TCWG: Management and the Audit Committee are not suspected. The facts do not say whether the purchase manager has a significant role in internal control or whether the fraud causes a material misstatement. If either is true, tell TCWG on a timely basis. If neither is true, SA 240 does not require TCWG communication, though reporting to the Audit Committee under Section 143(12) still applies.
Section 143(12): Because the amount is below ₹1 crore, report the matter to the Audit Committee or Board immediately but not later than 2 days of knowledge, specifying the nature of the fraud, the parties involved and the amount, as Rule 13 requires. The 45-day reply period and the filing with the Central Government do not apply. The company discloses the details in the Board's report under Section 134(3)(ca).
Representations and CARO: Ask management to confirm in writing their disclosure of known fraud. Consider clause 11 of CARO 2020 (fraud noticed or reported during the year).
Documentation: Record the risk assessment, procedures that found the fraud, dates and copies of communications, and the effect on the audit approach.

Answer: Tell the CFO promptly, and report the ₹60 lakh fraud to the Audit Committee or Board immediately but not later than 2 days of knowledge, with the nature of the fraud, the parties involved and the amount. Communicate to TCWG under SA 240 if the purchase manager has a significant role in internal control or the fraud causes a material misstatement. It is below ₹1 crore, so the Central Government route (45-day reply and 15-day filing) under Rule 13 does not apply; the company discloses the details in the Board's report under Section 134(3)(ca). Document everything and consider the effect on the audit opinion and CARO reporting.

Example 2

While auditing Orbit Components Ltd., you find invoices that look fabricated, and they were approved by the Managing Director. The MD stops you from meeting the Audit Committee and refuses access to bank records. The estimated fraud is ₹2,40,00,000. How should you proceed?

Show the solution

Provision: SA 240 requires communication to TCWG where management is suspected. If circumstances bring into question your ability to continue, you determine your legal and professional duties and consider withdrawal where law permits. Section 143(12) and Rule 13 apply to fraud of ₹1 crore or above by officers or employees.
Facts: The MD is an officer. The amount is ₹2.4 crore, above ₹1 crore. Access to the Audit Committee and records is being blocked.
TCWG: Communicate the suspicion to the Audit Committee or Board despite the MD's objection. Discuss the nature, timing and extent of the procedures needed.
Section 143(12): Report to the Board or Audit Committee immediately but not later than 2 days of knowledge and seek a reply or observations within 45 days. Then forward your report, the reply or observations, and your comments to the Central Government within 15 days of receiving the reply or of the expiry of the 45 days.
Exceptional circumstances: The MD's refusal to let you meet the Audit Committee does not stop you reporting to the Board. The refusal of access to bank records limits your evidence. If you cannot obtain sufficient appropriate audit evidence, consider a modified opinion or disclaimer. If the obstruction is serious enough to question whether you can continue, consider withdrawal if the law allows, after discussing the reasons with management and TCWG, and decide on reporting to the appointing authority or regulators.
Documentation: Record the fabricated-invoice evidence, the MD's refusal, communications with the Board and Central Government, and your reasoning on continuing.

Answer: Report the suspicion to the Board or Audit Committee immediately but not later than 2 days of your knowledge, even though the MD blocks the Audit Committee meeting, and seek a reply or observations within 45 days. Then, because ₹2.4 crore exceeds ₹1 crore, forward your report, the reply or observations, and your comments to the Central Government within 15 days of receiving the reply or of the expiry of the 45 days. Address the denied access through a modified opinion or disclaimer. Consider withdrawal, with the discussions and reporting duties above, only if you can no longer continue.

Exam tips

Write the amount test first in any 143(12) question. Examiners look for the ₹1 crore split and the 2-day, 45-day and 15-day timelines.
In written answers, use provision-facts-conclusion form. Name SA 240 for communication and documentation, and Section 143(12) with Rule 13 for reporting.
For case-scenario MCQs, find who is involved (employee, officer, management). The answer often turns on that fact alone.
Always add a documentation line. It is an easy mark and many students forget it.
Link the topic to nearby reports. Mention CARO 2020 clause 11 and the effect on your opinion when a case gives enough facts.

Practice questions from General Auditing Principles and Auditors Responsibilities

Fraud Communications, Documentation and Reporting: frequently asked questions

When must an auditor report fraud under Section 143(12)?

When the auditor has reason to believe that an offence involving fraud is being or has been committed against the company by its officers or employees. Both routes start with a report to the Board or Audit Committee immediately but not later than 2 days of knowledge. If the fraud involves or is expected to involve ₹1 crore or above, the report then goes to the Central Government after the reply period. If it is below ₹1 crore, the auditor reports the nature of the fraud, the parties involved and the amount to the Audit Committee or Board, and the company discloses the details in the Board's report under Section 134(3)(ca).

Does SA 240 require reporting fraud to TCWG every time?

No. You report to the appropriate level of management every time, but TCWG must be told when the fraud involves management, employees with significant roles in internal control, or others where it results in material misstatement. The exception is where all TCWG are involved in managing the entity.

What must the auditor document about fraud?

Document the fraud risks identified and assessed, your responses to them, and all communications about fraud made to management, TCWG, regulators and others. If you conclude that the presumed revenue-recognition fraud risk does not apply, record the reasons.

Can the auditor withdraw from the engagement because of fraud?

Only in exceptional circumstances where fraud or suspected fraud brings into question your ability to continue, and only where the law permits withdrawal. First determine your professional and legal responsibilities, discuss with management and TCWG, and decide whether you must report to the appointing authority or regulators.