Integrated Business Solutions (Multidisciplinary Case Study with Strategic Management) · Advanced Auditing, Assurance and Professional Ethics

Fraud, Laws and Regulations, and Going Concern: CA Final Audit Notes

Updated 5 October 2026 · Fact-checked

This topic covers the auditor's duties on fraud (SA 240), non-compliance with laws (SA 250) and going concern (SA 570). The auditor obtains reasonable assurance, not a guarantee. To solve a question, identify the issue, quote the standard's duty, apply the facts, then state the action: procedures, communication, reporting and the effect on the opinion.

Understand Fraud, Laws and Regulations, and Going Concern

An audit gives reasonable assurance that financial statements are free from material misstatement, whether caused by fraud or error. The difference is intent. Fraud is an intentional act by management, those charged with governance, employees or third parties involving deception to gain an unjust or illegal advantage. Error is unintentional.

Under SA 240, the primary responsibility for preventing and detecting fraud lies with management and those charged with governance. The auditor is responsible for obtaining reasonable assurance on material misstatement due to fraud. Because fraud may involve concealment and collusion, the risk of not detecting fraud is higher than for error. The auditor must keep professional skepticism throughout, hold a discussion among the engagement team, and treat revenue recognition as a presumed fraud risk unless the presumption is rebutted. Management override of controls is always a risk, so you must test journal entries, review estimates for bias and assess the business rationale of significant unusual transactions.

Under SA 250, the auditor looks at two categories of laws:

Laws generally recognised to have a direct effect on the determination of material amounts and disclosures in the financial statements, such as tax and pension laws. The auditor obtains sufficient appropriate audit evidence of compliance.
Other laws that do not directly affect the amounts and disclosures but whose compliance may be fundamental to the operating aspects of the business, to its ability to continue its business, or to avoid material penalties. For these, the auditor performs specified procedures to help identify non-compliance that may have a material effect on the financial statements. These are inquiry of management and those charged with governance about compliance, and inspection of correspondence with licensing or regulatory authorities.

The auditor does not search for all non-compliance. If non-compliance is suspected, the auditor discusses it with management, considers the effect on the financial statements and the report, and communicates with those charged with governance.

Under SA 570, management assesses whether the entity can continue as a going concern, and the auditor evaluates that assessment. Financial statements are prepared on a going concern basis unless management intends to liquidate or cease trading, or has no realistic alternative. Events such as recurring losses, negative cash flows, loan defaults, loss of key customers or licences, and pending litigation may cast significant doubt.

The outcomes are:

If there is a material uncertainty that is adequately disclosed, the auditor gives an unmodified opinion with a section headed Material Uncertainty Related to Going Concern.
Disclosure is adequate only if it covers the events and conditions, management's plans to deal with them, and the existence of a material uncertainty. If disclosure is inadequate, the opinion is qualified or adverse.
If the going concern basis is inappropriate, the opinion is adverse.
If management is unwilling to make or extend its assessment, the auditor considers the implications for the report, including a possible qualification or disclaimer of opinion. A significant delay by management in making its assessment is also a matter the auditor considers.

In India, the Companies Act adds a reporting duty. Under section 143(12), if the auditor has reason to believe that an offence involving fraud is being or has been committed against the company by officers or employees, the auditor must report it. The Companies (Audit and Auditors) Rules, 2014 (Rule 13) set the routes:

Fraud involving ₹1 crore or more is reported to the Central Government. The auditor first reports to the Board or audit committee within 2 days of knowledge, seeking a reply or observations within 45 days, and then reports to the Central Government within 60 days of receiving the Board's reply or observations, or of the period expiring.
Fraud involving less than ₹1 crore is reported to the audit committee or Board within 2 days of knowledge, and the company discloses it in the Board's report.

The auditor also considers the CARO reporting on fraud and the relevant reporting in the auditor's report. In a case study, link the facts to these duties.

Key rules to remember

Fraud vs error: Fraud = intentional act involving deception; Error = unintentional misstatement; Intent decides the label. The auditor's duty is reasonable assurance on material misstatement from both.
Fraud risk factors (fraud triangle): Incentive or pressure + Opportunity + Attitude or rationalisation; Use these three headings to analyse any fraud case scenario.
Presumed fraud risks: Revenue recognition (rebuttable) + Management override of controls (not rebuttable); Management override cannot be rebutted. Always perform journal entry testing, estimate review and unusual transaction review.
Types of fraud misstatement: Fraudulent financial reporting + Misappropriation of assets; Misappropriation is often seen in small amounts but can be material.
SA 250 two-tier approach: Laws with direct effect on amounts and disclosures (e.g. tax, pension laws): obtain sufficient appropriate evidence of compliance; Other laws fundamental to operations: specified procedures to help identify non-compliance that may materially affect the financial statements, being inquiry of management and those charged with governance, and inspection of correspondence with licensing or regulatory authorities; The auditor is not responsible for preventing non-compliance and is not expected to detect all of it.
Going concern outcomes: No material uncertainty: unmodified, no special section; Material uncertainty adequately disclosed (events and conditions, management's plans, existence of material uncertainty): unmodified plus Material Uncertainty section; Inadequate disclosure: qualified or adverse; Basis inappropriate: adverse; Management unwilling to make or extend its assessment: consider qualification or disclaimer; Match the facts to one of these outcomes.
Section 143(12) reporting: Fraud of ₹1 crore or more: report to Board or audit committee within 2 days, then to Central Government within 60 days (after the Board's reply or observations, or the 45-day period); Fraud below ₹1 crore: report to audit committee or Board within 2 days, and disclosed in the Board's report; The ₹1 crore threshold decides the route. These are under the Companies (Audit and Auditors) Rules, 2014.

How to solve Fraud, Laws and Regulations, and Going Concern questions

Use the same sequence for fraud, non-compliance and going concern case scenarios. It keeps your answer in provision, facts and conclusion form.

1Read the facts and label the issue: fraud, non-compliance with law, going concern, or a mix.
2Name the standard or section that governs it (SA 240, SA 250, SA 570, section 143(12)).
3State the auditor's duty in one line, such as reasonable assurance, skepticism or evaluating management's assessment.
4Apply the facts: show the red flags, the risk factor or the event that casts doubt.
5List the procedures the auditor performs, such as inquiry, journal entry testing, review of cash flow forecasts or confirming facility renewals.
6State the communication: management, those charged with governance, and the regulator or Central Government where the law requires it.
7State the effect on the auditor's report and opinion, with the reason.
8Close with a one-line conclusion that answers exactly what was asked.

Quickest way: Three-box scan for case studies

When to use it: Use this when a Paper 6 case study mixes fraud, legal and going concern facts and you have only a few minutes per question.

Scan the facts and mark each as Fraud, Law or Going concern.
For each mark, write the single standard and the key consequence: skepticism and reporting, communication and disclosure, or evaluation and opinion type.
For MCQs, eliminate options that make the auditor responsible for preventing fraud or for detecting all non-compliance.
For written answers, write the standard, the fact, the action and the report effect in four short lines.
For fraud against the company by officers or employees, add section 143(12) and pick the route by amount: ₹1 crore or more to the Central Government, below ₹1 crore to the audit committee or Board.

Common mistakes in Fraud, Laws and Regulations, and Going Concern

Saying the auditor is responsible for preventing and detecting fraud.
The word 'detect' appears in the standard, so students assume full responsibility.
Fix: Write that management and those charged with governance have the primary responsibility. The auditor obtains reasonable assurance and keeps skepticism.
Rebutting the management override risk.
Students mix it up with the revenue recognition presumption, which can be rebutted.
Fix: Remember that management override is always a risk. Test journal entries, estimates and unusual transactions.
Qualifying the opinion whenever a going concern uncertainty exists.
Students link any problem to a modified opinion.
Fix: If the material uncertainty is adequately disclosed, the opinion stays unmodified and a separate Material Uncertainty section is added.
Treating all non-compliance as an audit failure.
Students ignore the two-tier approach in SA 250.
Fix: Separate laws with direct effect on the financial statements from other laws, and say the auditor is not expected to detect all non-compliance.
Reporting a section 143(12) fraud only to management or the audit committee in every case.
Students overlook that the route depends on the amount involved.
Fix: State both routes: Central Government for fraud of ₹1 crore or more, and audit committee or Board for fraud below ₹1 crore, as set out in the rules.
Forgetting the auditor's own ethical and withdrawal options after finding fraud or management refusal.
Students stop at the opinion.
Fix: Add that the auditor considers the need to withdraw from the engagement where the law permits and may take legal advice.

Worked examples

Example 1

During the audit of Zenith Traders Ltd, the auditor finds that the sales manager, together with the accountant, recorded fictitious sales before year-end to meet a bonus target. The amount is material. Management says that the auditor should have prevented it. Advise the auditor on responsibility and action.

Show the solution

Issue: fraud by employees through fictitious revenue, which is fraudulent financial reporting. The governing provisions are SA 240 and section 143(12).
Responsibility: the primary responsibility to prevent and detect fraud lies with management and those charged with governance. The auditor obtains reasonable assurance and keeps professional skepticism, so management's claim is not correct.
Red flags: bonus target gives incentive, collusion between two employees gives opportunity, and year-end timing is a warning sign. Revenue recognition is a presumed fraud risk.
Procedures: test cut-off, confirm balances with customers, vouch dispatch and delivery evidence, and review credit notes after year-end.
Communication: inform management and those charged with governance. As this is fraud against the company by employees, report under section 143(12). If the amount is ₹1 crore or more, report to the Board or audit committee within 2 days and then to the Central Government within 60 days as the rules require. If it is below ₹1 crore, report to the audit committee or Board within 2 days, and the Board's report discloses it.
Report effect: because the misstatement is material, the auditor asks for correction. If it is not corrected, the opinion is qualified or adverse depending on pervasiveness.

Answer: The auditor is not responsible for preventing the fraud but must obtain reasonable assurance and apply skepticism. The auditor performs cut-off and confirmation procedures, communicates with management and those charged with governance, reports under section 143(12) through the route set by the ₹1 crore threshold, and modifies the opinion if the material misstatement is not corrected.

Example 2

Orbit Retail Ltd has incurred losses for three years, its bank loans are overdue and the lender has not renewed the working capital facility. Management has prepared the financial statements on a going concern basis and discloses the uncertainty and its plans clearly in the notes. Advise the auditor on the opinion.

Show the solution

Issue: events and conditions may cast significant doubt on going concern. SA 570 applies.
Evaluate management's assessment: obtain cash flow forecasts, test their assumptions, review the status of lender discussions and any support from promoters.
Conclude on appropriateness: management's use of the going concern basis is still appropriate, since it has not intended to liquidate or has no realistic alternative to continuing.
Material uncertainty: the overdue loans and lack of facility renewal indicate a material uncertainty. The auditor checks whether disclosure is adequate.
Disclosure: the notes clearly describe the events, management's plans and the fact of material uncertainty, so the disclosure is adequate.
Opinion: give an unmodified opinion and add a section headed Material Uncertainty Related to Going Concern that refers to the note. Obtain written representations from management.

Answer: The auditor gives an unmodified opinion with a separate Material Uncertainty Related to Going Concern section drawing attention to the disclosure note. If the disclosure were inadequate, the opinion would be qualified or adverse.

Exam tips

In case studies, write the standard name and number once, then spend the rest of the answer on the facts.
For MCQs on responsibility, reject options that put sole or primary responsibility for fraud on the auditor.
Use the going concern outcome list to decide between unmodified with a section, qualified, adverse and disclaimer.
Always add the communication step: those charged with governance, and the regulator or Central Government where the law requires.
For section 143(12), remember the ₹1 crore threshold, the 2-day report to the Board or audit committee and the 60-day report to the Central Government.

Practice questions from Advanced Auditing, Assurance and Professional Ethics

Fraud, Laws and Regulations, and Going Concern in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Fraud, Laws and Regulations, and Going Concern: frequently asked questions

What are the key points of SA 240 for CA Final?

Management has the primary responsibility for fraud prevention and detection. The auditor obtains reasonable assurance, applies skepticism, discusses fraud risk within the team, and treats revenue recognition and management override as risks. Revenue recognition may be rebutted, management override may not.

How do I report fraud under section 143(12)?

If the auditor has reason to believe that an offence involving fraud is being or has been committed against the company by officers or employees, the auditor reports as the Companies (Audit and Auditors) Rules, 2014 prescribe. Fraud of ₹1 crore or more goes to the Central Government: report to the Board or audit committee within 2 days, then to the Central Government within 60 days. Fraud below ₹1 crore is reported to the audit committee or Board within 2 days and disclosed in the Board's report.

When does going concern lead to a modified opinion?

A modified opinion arises when disclosure of a material uncertainty is inadequate, which leads to a qualified or adverse opinion. It is also adverse when the going concern basis is used but is inappropriate. If management is unwilling to make or extend its assessment, the auditor considers a qualification or disclaimer. If the uncertainty is adequately disclosed, the opinion is unmodified with a Material Uncertainty section.

Is the auditor required to detect all non-compliance with laws?

No. Under SA 250, the auditor obtains sufficient evidence for laws that directly affect the amounts and disclosures in the financial statements. For other laws fundamental to operations, the auditor performs specified procedures: inquiry of management and those charged with governance, and inspection of correspondence with licensing or regulatory authorities. When non-compliance is identified or suspected, the auditor takes the steps the standard requires.