ISA 250 198
INTERNATIONAL STANDARD ON AUDITING 250
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
(Effective for audits of financial statements for periods
beginning on or after December 15, 2009)
CONTENTS
Paragraph
Introduction
Scope of this ISA ........................................................................................ 1
Effect of Laws and Regulations .................................................................. 2
Responsibility for Compliance with Laws and Regulations ....................... 3−8
Effective Date ............................................................................................. 9
Objectives .................................................................................................. 10
Definition ................................................................................................... 11
Requirements
The Auditor’s Consideration of Compliance with Laws and
Regulations .......................................................................................... 12−17
Audit Procedures When Non-Compliance is Identified or Suspected ........ 18−21
Reporting of Identified or Suspected Non-Compliance .............................. 22−28
Documentation ............................................................................................ 29
Application and Other Explanatory Material
Responsibility for Compliance with Laws and Regulations ....................... A1−A6
The Auditor’s Consideration of Compliance with Laws and
Regulations .......................................................................................... A7−A12
Audit Procedures When Non-Compliance is Identified or
Suspected ............................................................................................. A13−18
Reporting of Identified or Suspected Non-Compliance .............................. A19−A20
Documentation ............................................................................................ A21
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250199
AUDITING
International Standard on Auditing (ISA) 250, “Consideration of Laws and
Regulations in an Audit of Financial Statements” should be read in conjunction
with ISA 200 “Overall Objectives of the Independent Auditor and the Conduct of
an Audit in Accordance with International Standards on Auditing.”
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250 200
Introduction
Scope of this ISA
1. This International Standard on Auditing (ISA) deals with the auditor’s
responsibility to consider laws and regulations in an audit of financial
statements. This ISA does not apply to other assurance engagements in
which the auditor is specifically engaged to test and report separately on
compliance with specific laws or regulations.
Effect of Laws and Regulations
2. The effect on financial statements of laws and regulations varies
considerably. Those laws and regulations to which an entity is subject
constitute the legal and regulatory framework. The provisions of some laws
or regulations have a direct effect on the financial statements in that they
determine the reported amounts and disclosures in an entity’s financial
statements. Other laws or regulations are to be complied with by
management or set the provisions under which the entity is allowed to
conduct its business but do not have a direct effect on an entity’s financial
statements. Some entities operate in heavily regulated industries (such as
banks and chemical companies). Others are subject only to the many laws
and regulations that relate generally to the operating aspects of the business
(such as those related to occupational safety and health, and equal
employment opportunity). Non-compliance with laws and regulations may
result in fines, litigation or other consequences for the entity that may have a
material effect on the financial statements.
Responsibility for Compliance with Laws and Regulations (Ref: Para. A1–A6)
3. It is the responsibility of management, with the oversight of those charged
with governance, to ensure that the entity’s operations are conducted in
accordance with the provisions of laws and regulations, including
compliance with the provisions of laws and regulations that determine the
reported amounts and disclosures in an entity’s financial statements.
Responsibility of the Auditor
4. The requirements in this ISA are designed to assist the auditor in identifying
material misstatement of the financial statements due to non-compliance
with laws and regulations. However, the auditor is not responsible for
preventing non-compliance and cannot be expected to detect noncompliance
with all laws and regulations.
5. The auditor is responsible for obtaining reasonable assurance that the financial
statements, taken as a whole, are free from material misstatement, whether
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250201
AUDITING
caused by fraud or error.1
In conducting an audit of financial statements, the
auditor takes into account the applicable legal and regulatory framework.
Owing to the inherent limitations of an audit, there is an unavoidable risk that
some material misstatements in the financial statements may not be detected,
even though the audit is properly planned and performed in accordance with
the ISAs.2
In the context of laws and regulations, the potential effects of
inherent limitations on the auditor’s ability to detect material misstatements
are greater for such reasons as the following:
• There are many laws and regulations, relating principally to the
operating aspects of an entity, that typically do not affect the financial
statements and are not captured by the entity’s information systems
relevant to financial reporting.
• Non-compliance may involve conduct designed to conceal it, such as
collusion, forgery, deliberate failure to record transactions,
management override of controls or intentional misrepresentations
being made to the auditor.
• Whether an act constitutes non-compliance is ultimately a matter for
legal determination by a court of law.
Ordinarily, the further removed non-compliance is from the events and
transactions reflected in the financial statements, the less likely the auditor is
to become aware of it or to recognize the non-compliance.
6. This ISA distinguishes the auditor’s responsibilities in relation to
compliance with two different categories of laws and regulations as follows:
(a) The provisions of those laws and regulations generally recognized to
have a direct effect on the determination of material amounts and
disclosures in the financial statements such as tax and pension laws
and regulations (see paragraph 13); and
(b) Other laws and regulations that do not have a direct effect on the
determination of the amounts and disclosures in the financial
statements, but compliance with which may be fundamental to the
operating aspects of the business, to an entity’s ability to continue its
business, or to avoid material penalties (for example, compliance with
the terms of an operating license, compliance with regulatory solvency
requirements, or compliance with environmental regulations); noncompliance
with such laws and regulations may therefore have a
material effect on the financial statements (see paragraph 14).
1
ISA 200, “Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance
with International Standards on Auditing,” paragraph 5.
2
ISA 200, paragraphs A51-A52.
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250 202
7. In this ISA, differing requirements are specified for each of the above
categories of laws and regulations. For the category referred to in paragraph
6(a), the auditor’s responsibility is to obtain sufficient appropriate audit
evidence regarding compliance with the provisions of those laws and
regulations. For the category referred to in paragraph 6(b), the auditor’s
responsibility is limited to undertaking specified audit procedures to help
identify non-compliance with those laws and regulations that may have a
material effect on the financial statements.
8. The auditor is required by this ISA to remain alert to the possibility that
other audit procedures applied for the purpose of forming an opinion on
financial statements may bring instances of identified or suspected noncompliance
to the auditor’s attention. Maintaining professional skepticism
throughout the audit, as required by ISA 200,3
is important in this context,
given the extent of laws and regulations that affect the entity.
Effective Date
9. This ISA is effective for audits of financial statements for periods beginning
on or after December 15, 2009.
Objectives
10. The objectives of the auditor are:
(a) To obtain sufficient appropriate audit evidence regarding compliance
with the provisions of those laws and regulations generally
recognized to have a direct effect on the determination of material
amounts and disclosures in the financial statements;
(b) To perform specified audit procedures to help identify instances of
non-compliance with other laws and regulations that may have a
material effect on the financial statements; and
(c) To respond appropriately to non-compliance or suspected noncompliance
with laws and regulations identified during the audit.
Definition
11. For the purposes of this ISA, the following term has the meaning attributed
below:
Non-compliance – Acts of omission or commission by the entity, either
intentional or unintentional, which are contrary to the prevailing laws or
regulations. Such acts include transactions entered into by, or in the name of,
the entity, or on its behalf, by those charged with governance, management or
employees. Non-compliance does not include personal misconduct (unrelated
3
ISA 200, paragraph 15.
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250203
AUDITING
to the business activities of the entity) by those charged with governance,
management or employees of the entity.
Requirements
The Auditor’s Consideration of Compliance with Laws and Regulations
12. As part of obtaining an understanding of the entity and its environment in
accordance with ISA 315,4
the auditor shall obtain a general understanding
of:
(a) The legal and regulatory framework applicable to the entity and the
industry or sector in which the entity operates; and
(b) How the entity is complying with that framework. (Ref: Para. A7)
13. The auditor shall obtain sufficient appropriate audit evidence regarding
compliance with the provisions of those laws and regulations generally
recognized to have a direct effect on the determination of material amounts
and disclosures in the financial statements. (Ref: Para. A8)
14. The auditor shall perform the following audit procedures to help identify
instances of non-compliance with other laws and regulations that may have
a material effect on the financial statements: (Ref: Para. A9–A10)
(a) Inquiring of management and, where appropriate, those charged with
governance, as to whether the entity is in compliance with such laws and
regulations; and
(b) Inspecting correspondence, if any, with the relevant licensing or
regulatory authorities.
15. During the audit, the auditor shall remain alert to the possibility that other
audit procedures applied may bring instances of non-compliance or
suspected non-compliance with laws and regulations to the auditor’s
attention. (Ref: Para. A11)
16. The auditor shall request management and, where appropriate, those charged
with governance, to provide written representations that all known instances
of non-compliance or suspected non-compliance with laws and regulations
whose effects should be considered when preparing financial statements
have been disclosed to the auditor. (Ref: Para. A12)
17. In the absence of identified or suspected non-compliance, the auditor is not
required to perform audit procedures regarding the entity’s compliance with
laws and regulations, other than those set out in paragraphs 12–16.
4
ISA 315, “Identifying and Assessing the Risks of Material Misstatement through Understanding the
Entity and Its Environment,” paragraph 11.
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250 204
Audit Procedures When Non-Compliance Is Identified or Suspected
18. If the auditor becomes aware of information concerning an instance of noncompliance
or suspected non-compliance with laws and regulations, the
auditor shall obtain: (Ref: Para. A13)
(a) An understanding of the nature of the act and the circumstances in which
it has occurred; and
(b) Further information to evaluate the possible effect on the financial
statements. (Ref: Para. A14)
19. If the auditor suspects there may be non-compliance, the auditor shall discuss
the matter with management and, where appropriate, those charged with
governance. If management or, as appropriate, those charged with governance
do not provide sufficient information that supports that the entity is in
compliance with laws and regulations and, in the auditor’s judgment, the effect
of the suspected non-compliance may be material to the financial statements, the
auditor shall consider the need to obtain legal advice. (Ref: Para. A15–A16)
20. If sufficient information about suspected non-compliance cannot be obtained,
the auditor shall evaluate the effect of the lack of sufficient appropriate audit
evidence on the auditor’s opinion.
21. The auditor shall evaluate the implications of non-compliance in relation to
other aspects of the audit, including the auditor’s risk assessment and the
reliability of written representations, and take appropriate action. (Ref: Para.
A17–A18)
Reporting of Identified or Suspected Non-Compliance
Reporting Non-Compliance to Those Charged with Governance
22. Unless all of those charged with governance are involved in management of the
entity, and therefore are aware of matters involving identified or suspected noncompliance
already communicated by the auditor,5
the auditor shall
communicate with those charged with governance matters involving noncompliance
with laws and regulations that come to the auditor’s attention during
the course of the audit, other than when the matters are clearly inconsequential.
23. If, in the auditor’s judgment, the non-compliance referred to in paragraph 22
is believed to be intentional and material, the auditor shall communicate the
matter to those charged with governance as soon as practicable.
24. If the auditor suspects that management or those charged with governance are
involved in non-compliance, the auditor shall communicate the matter to the
next higher level of authority at the entity, if it exists, such as an audit committee
5
ISA 260, “Communication with Those Charged with Governance,” paragraph 13.
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250205
AUDITING
or supervisory board. Where no higher authority exists, or if the auditor believes
that the communication may not be acted upon or is unsure as to the person to
whom to report, the auditor shall consider the need to obtain legal advice.
Reporting Non-Compliance in the Auditor’s Report on the Financial Statements
25. If the auditor concludes that the non-compliance has a material effect on the
financial statements, and has not been adequately reflected in the financial
statements, the auditor shall, in accordance with ISA 705, express a
qualified opinion or an adverse opinion on the financial statements.6
26. If the auditor is precluded by management or those charged with governance
from obtaining sufficient appropriate audit evidence to evaluate whether
non-compliance that may be material to the financial statements has, or is
likely to have, occurred, the auditor shall express a qualified opinion or
disclaim an opinion on the financial statements on the basis of a limitation
on the scope of the audit in accordance with ISA 705.
27. If the auditor is unable to determine whether non-compliance has occurred
because of limitations imposed by the circumstances rather than by
management or those charged with governance, the auditor shall evaluate
the effect on the auditor’s opinion in accordance with ISA 705.
Reporting Non-Compliance to Regulatory and Enforcement Authorities
28. If the auditor has identified or suspects non-compliance with laws and
regulations, the auditor shall determine whether the auditor has a
responsibility to report the identified or suspected non-compliance to parties
outside the entity. (Ref: Para. A19–A20)
Documentation
29. The auditor shall include in the audit documentation identified or suspected
non-compliance with laws and regulations and the results of discussion with
management and, where applicable, those charged with governance and
other parties outside the entity.7
(Ref: Para. A21)
***
Application and Other Explanatory Material
Responsibility for Compliance with Laws and Regulations (Ref: Para. 3–8)
A1. It is the responsibility of management, with the oversight of those charged with
governance, to ensure that the entity’s operations are conducted in accordance
6
ISA 705, “Modifications to the Opinion in the Independent Auditor’s Report,” paragraphs 7–8.
7
ISA 230, “Audit Documentation,” paragraphs 8–11, and A6.
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250 206
with laws and regulations. Laws and regulations may affect an entity’s financial
statements in different ways: for example, most directly, they may affect
specific disclosures required of the entity in the financial statements or they may
prescribe the applicable financial reporting framework. They may also establish
certain legal rights and obligations of the entity, some of which will be
recognized in the entity’s financial statements. In addition, laws and regulations
may impose penalties in cases of non-compliance.
A2. The following are examples of the types of policies and procedures an entity
may implement to assist in the prevention and detection of non-compliance
with laws and regulations:
• Monitoring legal requirements and ensuring that operating procedures
are designed to meet these requirements.
• Instituting and operating appropriate systems of internal control.
• Developing, publicizing and following a code of conduct.
• Ensuring employees are properly trained and understand the code of
conduct.
• Monitoring compliance with the code of conduct and acting
appropriately to discipline employees who fail to comply with it.
• Engaging legal advisors to assist in monitoring legal requirements.
• Maintaining a register of significant laws and regulations with which the
entity has to comply within its particular industry and a record of
complaints.
In larger entities, these policies and procedures may be supplemented by
assigning appropriate responsibilities to the following:
• An internal audit function.
• An audit committee.
• A compliance function.
Responsibility of the Auditor
A3. Non-compliance by the entity with laws and regulations may result in a material
misstatement of the financial statements. Detection of non-compliance,
regardless of materiality, may affect other aspects of the audit including, for
example, the auditor’s consideration of the integrity of management or
employees.
A4. Whether an act constitutes non-compliance with laws and regulations is a
matter for legal determination, which is ordinarily beyond the auditor’s
professional competence to determine. Nevertheless, the auditor’s training,
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250207
AUDITING
experience and understanding of the entity and its industry or sector may
provide a basis to recognize that some acts, coming to the auditor’s
attention, may constitute non-compliance with laws and regulations.
A5. In accordance with specific statutory requirements, the auditor may be
specifically required to report, as part of the audit of the financial
statements, on whether the entity complies with certain provisions of laws or
regulations. In these circumstances, ISA 7008
or ISA 8009
deal with how
these audit responsibilities are addressed in the auditor’s report.
Furthermore, where there are specific statutory reporting requirements, it
may be necessary for the audit plan to include appropriate tests for
compliance with these provisions of the laws and regulations.
Considerations Specific to Public Sector Entities
A6. In the public sector, there may be additional audit responsibilities with respect
to the consideration of laws and regulations which may relate to the audit of
financial statements or may extend to other aspects of the entity’s operations.
The Auditor’s Consideration of Compliance with Laws and Regulations
Obtaining an Understanding of the Legal and Regulatory Framework (Ref: Para. 12)
A7. To obtain a general understanding of the legal and regulatory framework, and
how the entity complies with that framework, the auditor may, for example:
• Use the auditor’s existing understanding of the entity’s industry,
regulatory and other external factors;
• Update the understanding of those laws and regulations that directly
determine the reported amounts and disclosures in the financial
statements;
• Inquire of management as to other laws or regulations that may be
expected to have a fundamental effect on the operations of the entity;
• Inquire of management concerning the entity’s policies and
procedures regarding compliance with laws and regulations; and
• Inquire of management regarding the policies or procedures adopted
for identifying, evaluating and accounting for litigation claims.
8
ISA 700, “Forming an Opinion and Reporting on Financial Statements,” paragraph 38.
9
ISA 800 “Special Considerations—Audits of Financial Statements Prepared in Accordance with
Special Purpose Frameworks,” paragraph 11.
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250 208
Laws and Regulations Generally Recognized to Have a Direct Effect on the
Determination of Material Amounts and Disclosures in the Financial Statements
(Ref: Para. 13)
A8. Certain laws and regulations are well-established, known to the entity and
within the entity’s industry or sector, and relevant to the entity’s financial
statements (as described in paragraph 6(a)). They could include those that
relate to, for example:
• The form and content of financial statements;
• Industry-specific financial reporting issues;
• Accounting for transactions under government contracts; or
• The accrual or recognition of expenses for income tax or pension costs.
Some provisions in those laws and regulations may be directly relevant to
specific assertions in the financial statements (for example, the
completeness of income tax provisions), while others may be directly
relevant to the financial statements as a whole (for example, the required
statements constituting a complete set of financial statements). The aim of
the requirement in paragraph 13 is for the auditor to obtain sufficient
appropriate audit evidence regarding the determination of amounts and
disclosures in the financial statements in compliance with the relevant
provisions of those laws and regulations.
Non-compliance with other provisions of such laws and regulations and
other laws and regulations may result in fines, litigation or other
consequences for the entity, the costs of which may need to be provided for
in the financial statements, but are not considered to have a direct effect on
the financial statements as described in paragraph 6(a).
Procedures to Identify Instances of Non-Compliance—Other Laws and Regulations
(Ref: Para. 14)
A9. Certain other laws and regulations may need particular attention by the
auditor because they have a fundamental effect on the operations of the
entity (as described in paragraph 6(b)). Non-compliance with laws and
regulations that have a fundamental effect on the operations of the entity
may cause the entity to cease operations, or call into question the entity’s
continuance as a going concern. For example, non-compliance with the
requirements of the entity’s license or other entitlement to perform its
operations could have such an impact (for example, for a bank, noncompliance
with capital or investment requirements). There are also many
laws and regulations relating principally to the operating aspects of the
entity that typically do not affect the financial statements and are not
captured by the entity’s information systems relevant to financial reporting.
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250209
AUDITING
A10. As the financial reporting consequences of other laws and regulations can
vary depending on the entity’s operations, the audit procedures required by
paragraph 14 are directed to bringing to the auditor’s attention instances of
non-compliance with laws and regulations that may have a material effect
on the financial statements.
Non-Compliance Brought to the Auditor’s Attention by Other Audit Procedures (Ref:
Para. 15)
A11. Audit procedures applied to form an opinion on the financial statements may
bring instances of non-compliance or suspected non-compliance with laws
and regulations to the auditor’s attention. For example, such audit
procedures may include:
• Reading minutes;
• Inquiring of the entity’s management and in-house legal counsel or
external legal counsel concerning litigation, claims and assessments; and
• Performing substantive tests of details of classes of transactions,
account balances or disclosures.
Written Representations (Ref: Para. 16)
A12. Because the effect on financial statements of laws and regulations can vary
considerably, written representations provide necessary audit evidence about
management’s knowledge of identified or suspected non-compliance with laws
and regulations, whose effects may have a material effect on the financial
statements. However, written representations do not provide sufficient
appropriate audit evidence on their own and, accordingly, do not affect the
nature and extent of other audit evidence that is to be obtained by the auditor.10
Audit Procedures When Non-Compliance is Identified or Suspected
Indications of Non-Compliance with Laws and Regulations (Ref: Para. 18)
A13. If the auditor becomes aware of the existence of, or information about, the
following matters, it may be an indication of non-compliance with laws and
regulations:
• Investigations by regulatory organizations and government departments
or payment of fines or penalties.
• Payments for unspecified services or loans to consultants, related
parties, employees or government employees.
10
ISA 580, “Written Representations,” paragraph 4.
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250 210
• Sales commissions or agent’s fees that appear excessive in relation to
those ordinarily paid by the entity or in its industry or to the services
actually received.
• Purchasing at prices significantly above or below market price.
• Unusual payments in cash, purchases in the form of cashiers’ checks
payable to bearer or transfers to numbered bank accounts.
• Unusual transactions with companies registered in tax havens.
• Payments for goods or services made other than to the country from
which the goods or services originated.
• Payments without proper exchange control documentation.
• Existence of an information system which fails, whether by design or
by accident, to provide an adequate audit trail or sufficient evidence.
• Unauthorized transactions or improperly recorded transactions.
• Adverse media comment.
Matters Relevant to the Auditor’s Evaluation (Ref: Para. 18(b))
A14. Matters relevant to the auditor’s evaluation of the possible effect on the
financial statements include:
• The potential financial consequences of non-compliance with laws
and regulations on the financial statements including, for example,
the imposition of fines, penalties, damages, threat of expropriation of
assets, enforced discontinuation of operations, and litigation.
• Whether the potential financial consequences require disclosure.
• Whether the potential financial consequences are so serious as to call
into question the fair presentation of the financial statements, or
otherwise make the financial statements misleading.
Audit Procedures (Ref: Para. 19)
A15. The auditor may discuss the findings with those charged with governance where
they may be able to provide additional audit evidence. For example, the auditor
may confirm that those charged with governance have the same understanding
of the facts and circumstances relevant to transactions or events that have led to
the possibility of non-compliance with laws and regulations.
A16. If management or, as appropriate, those charged with governance do not provide
sufficient information to the auditor that the entity is in fact in compliance with
laws and regulations, the auditor may consider it appropriate to consult with the
entity’s in-house legal counsel or external legal counsel about the application of
the laws and regulations to the circumstances, including the possibility of fraud,
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250211
AUDITING
and the possible effects on the financial statements. If it is not considered
appropriate to consult with the entity’s legal counsel or if the auditor is not
satisfied with the legal counsel’s opinion, the auditor may consider it appropriate
to consult the auditor’s own legal counsel as to whether a contravention of a law
or regulation is involved, the possible legal consequences, including the
possibility of fraud, and what further action, if any, the auditor would take.
Evaluating the Implications of Non-Compliance (Ref: Para. 21)
A17. As required by paragraph 21, the auditor evaluates the implications of noncompliance
in relation to other aspects of the audit, including the auditor’s
risk assessment and the reliability of written representations. The
implications of particular instances of non-compliance identified by the
auditor will depend on the relationship of the perpetration and concealment,
if any, of the act to specific control activities and the level of management or
employees involved, especially implications arising from the involvement of
the highest authority within the entity.
A18. In exceptional cases, the auditor may consider whether withdrawal from the
engagement, where withdrawal is possible under applicable law or regulation, is
necessary when management or those charged with governance do not take the
remedial action that the auditor considers appropriate in the circumstances, even
when the non-compliance is not material to the financial statements. When
deciding whether withdrawal from the engagement is necessary, the auditor may
consider seeking legal advice. If withdrawal from the engagement is not
possible, the auditor may consider alternative actions, including describing the
non-compliance in an Other Matter paragraph in the auditor’s report.11
Reporting of Identified or Suspected Non-Compliance
Reporting Non-Compliance to Regulatory and Enforcement Authorities (Ref: Para. 28)
A19. The auditor’s professional duty to maintain the confidentiality of client
information may preclude reporting identified or suspected non-compliance
with laws and regulations to a party outside the entity. However, the
auditor’s legal responsibilities vary by jurisdiction and, in certain
circumstances, the duty of confidentiality may be overridden by statute, the
law or courts of law. In some jurisdictions, the auditor of a financial
institution has a statutory duty to report the occurrence, or suspected
occurrence, of non-compliance with laws and regulations to supervisory
authorities. Also, in some jurisdictions, the auditor has a duty to report
misstatements to authorities in those cases where management and, where
applicable, those charged with governance fail to take corrective action. The
auditor may consider it appropriate to obtain legal advice to determine the
11 ISA 706, “Emphasis of Matter Paragraphs and Other Matter Paragraphs in the Independent Auditor’s
Report,” paragraph 8.
CONSIDERATION OF LAWS AND REGULATIONS
IN AN AUDIT OF FINANCIAL STATEMENTS
ISA 250 212
appropriate course of action.
Considerations Specific to Public Sector Entities
A20. A public sector auditor may be obliged to report on instances of non-compliance
to the legislature or other governing body or to report them in the auditor’s
report.
Documentation (Ref: Para. 29)
A21. The auditor’s documentation of findings regarding identified or suspected
non-compliance with laws and regulations may include, for example:
• Copies of records or documents.
• Minutes of discussions held with management, those charged with
governance or parties outside the entity.