Revised UK auditing standard on fraud now effective

The Financial Reporting Council ("FRC") revised its UK auditing standard on the responsibilities of auditors relating to fraud (ISA (UK) 240) at the end of May 2021. The revised standard applies to audits of financial statements for periods commencing on or after 15 December 2021, and introduces tougher rules, particularly around risk assessment.

Auditors must obtain "reasonable assurance" that financial statements are free from material misstatement due to fraud — a high, but not absolute, level of assurance. In practice they are not expected to spot every possible fraud, but to act with "professional scepticism", remaining alert to both corroborative and contradictory evidence and to conditions suggesting a document may not be authentic. The standard stresses that auditors must not let past experience with a business, or their opinion of management's integrity, affect their approach.

The FRC has also tightened guidance on risk-assessment procedures, requiring auditors to understand fraud risk factors and to set out in the audit report the extent to which the audit was capable of detecting irregularities, including fraud. While primary responsibility for prevention and detection still rests with management, auditors are now expected to challenge management's assessment more robustly.

Fraud detection is difficult, and the revised guidance offers little on the practical steps an auditor can take. Tougher obligations coupled with limited guidance may simply increase the instances of auditors facing FRC enforcement action — but if the standard tackles the sometimes "chummy" relationship between firms and their auditors, it will be a welcome development.