ISA 240: The Auditor’s Fraud Responsibilities and 2026 Revisions

Under ISA 240, the auditor’s fraud responsibilities in a financial statement audit are to plan and perform the audit with professional skepticism, assess where the financial statements are vulnerable to material misstatement from fraud, carry out specific procedures aimed at the places fraud is most likely to hide, and communicate what they find to management, those charged with governance, and in some cases external authorities. The standard does not make the auditor a guarantor against fraud. It sets a disciplined framework for finding material fraud when it exists and for responding properly when it surfaces.

The dividing line between fraud and error in the standard is intent. An error is an accidental misstatement, like a data-entry mistake or an honest misapplication of an accounting rule. Fraud is a deliberate act by management, employees, those charged with governance, or outside parties that produces a misstatement. That intentional element drives every requirement in ISA 240. The standard groups fraudulent acts into two categories: fraudulent financial reporting, which manipulates accounting records or disclosures to change the picture the statements present, and misappropriation of assets, which is theft of company resources. The risk factors, the people typically involved, and the audit procedures needed to detect each type differ, which is why the standard treats them separately throughout.

What the Audit Does and Does Not Promise

An audit conducted under ISA 240 provides reasonable assurance that the financial statements are free of material misstatement. It cannot guarantee that every instance of fraud will be caught. The standard explicitly acknowledges an unavoidable risk that some material fraud goes undetected even in a properly planned and executed audit.

This limitation exists because fraud involves concealment. People who commit fraud forge documents, collude with others, or deliberately withhold information from the auditor. Management-level fraud is especially dangerous because the people committing it often control the records the auditor relies on. An auditor working with fabricated evidence may have no visible reason to question it. ISA 240 responds to that reality with specific procedures aimed at management override and with a demand for skepticism, but neither closes the detection gap entirely. The audit opinion is a professional judgment that the auditor followed the standard’s requirements and found no material misstatement due to fraud based on the evidence available. It is not a certificate that no fraud occurred.

Professional Skepticism and the Team Discussion

Professional skepticism is the foundation of every fraud-related requirement in ISA 240. The standard requires the auditor to maintain a questioning mind throughout the engagement, critically evaluating evidence rather than accepting it at face value. This applies even when the auditor has a long history with the client and no reason to distrust management. Past honesty is not evidence of current honesty, and the standard makes that explicit.¹

Skepticism in practice means paying attention to contradictory information, questioning the reliability of documents, and probing management’s explanations for unusual transactions. When something does not add up, the auditor is expected to dig deeper rather than rationalize it away.

Before fieldwork begins, ISA 240 requires the engagement team to discuss where the entity’s financial statements are vulnerable to material misstatement from fraud. The point is to pool the team’s knowledge about the entity, its industry, and its people, and to think through how fraud could actually be committed and concealed in this specific organization. The discussion must cover both fraudulent financial reporting and asset misappropriation, and the engagement partner must consider what to communicate to team members who were not part of the conversation.¹

Assessing Fraud Risk

ISA 240’s risk assessment framework centers on three conditions that tend to be present when fraud occurs. Practitioners often call this the fraud triangle.

Incentive or pressure. Financial pressure to meet earnings targets, debt covenants, or performance-linked compensation can push management toward manipulation. Employees facing personal financial difficulties may be tempted toward theft.
Opportunity. Weak oversight by those charged with governance, poor segregation of duties, complex transactions that are hard to monitor, or inadequate internal controls all create openings.
Rationalization. An aggressive interpretation of accounting rules, a dismissive tone about compliance, or a culture that tolerates corner-cutting can signal that people in the organization are more likely to justify dishonest behavior.

Fraud risk assessment is not a one-time exercise. ISA 240 treats it as ongoing throughout the audit, and new information obtained during fieldwork can change the assessment.

Two Mandatory Presumptions

The standard establishes a rebuttable presumption that risks of fraud exist in revenue recognition. Revenue is the line item most commonly manipulated in fraudulent financial reporting schemes. The auditor must evaluate which types of revenue, which transactions, and which assertions give rise to fraud risk. For entities with straightforward revenue streams the presumption can be rebutted, but the rationale must be documented.

The second presumption is that the risk of management override of controls exists in every entity, regardless of how strong internal controls appear. Management can prepare fraudulent entries and override otherwise effective controls in ways that are difficult to predict. ISA 240 treats this as a significant risk that cannot be reduced through the normal assessment process, and it triggers three specific procedures the auditor must perform in every engagement.²

Three Mandatory Procedures for Management Override

Because management override risk cannot be assessed away, ISA 240 requires three procedures regardless of the auditor’s overall fraud risk conclusions.²

Testing Journal Entries and Adjustments

The auditor must test whether journal entries and other adjustments recorded during the preparation of the financial statements are appropriate. The focus falls on entries that look unusual: entries made outside the normal course of business, recorded by people who do not typically process them, or posted near the end of the reporting period when pressure to hit targets is highest.

The standard requires the auditor to make inquiries of individuals involved in the financial reporting process about any inappropriate or unusual activity, to specifically select entries made at the end of the reporting period, and to consider whether testing should extend throughout the year. Data analytics and computer-assisted techniques can help identify patterns manual review would miss, such as round-number entries, entries posted at unusual times, or entries that bypass standard sub-ledgers and post directly to the general ledger.²

Reviewing Accounting Estimates for Bias

Management exercises significant judgment when developing accounting estimates for items like asset impairment, loan loss reserves, warranty provisions, and fair value measurements. That discretion creates an opportunity to tilt results in a preferred direction. ISA 240 requires the auditor to evaluate whether management’s judgments and assumptions, even if individually reasonable, reveal a pattern of bias when taken together.

A key part of this procedure is retrospective. The auditor must look back at estimates management made in prior years and compare them to what actually happened. One year of optimism might be a judgment call. Several years of it starts to look like a strategy.²

Evaluating the Business Rationale for Unusual Transactions

The third mandatory procedure targets significant transactions that fall outside the entity’s normal business operations or otherwise appear unusual. The auditor must evaluate whether the business rationale behind these transactions, or the lack of one, suggests they were entered into to manipulate financial reporting or conceal stolen assets.

Transactions involving related parties, those structured with unusual complexity, or those occurring right before the reporting date deserve particular scrutiny. A transaction with no clear economic benefit to the entity is a red flag. The auditor’s job is to determine whether the substance of the transaction matches the way it has been recorded and whether management’s stated purpose holds up under examination.²

Building Unpredictability Into the Audit

ISA 240 also requires the auditor to incorporate an element of unpredictability. If the audit team follows the same playbook every year, testing the same accounts, visiting the same locations, and asking the same questions at the same time, anyone planning fraud can work around those procedures. Unpredictability might mean selecting different samples than prior years, adjusting the timing of procedures without warning, testing accounts or locations that would not normally be high priority, or using unexpected analytical approaches. Predictability is what makes fraud easier to conceal, and the standard addresses it directly for that reason.

Communicating and Responding to Fraud

When the auditor identifies fraud or obtains information suggesting fraud may exist, ISA 240 triggers specific communication obligations, even for matters that seem minor. A small fraud can indicate a larger problem, particularly if it points to a breakdown in internal controls or an ethical culture issue.

Fraud involving lower-level employees is communicated to a management level above the person involved, unless that manager is suspected of participation. When fraud involves senior management or causes a material misstatement, the auditor must report directly to those charged with governance. The communication must cover the nature of the fraud, its scope, and its implications for the financial statements and the organization’s control environment. The auditor must also consider whether identified fraud changes the assessment of other audit areas, because a scheme in one division may indicate control weaknesses that affect the entire entity.

If fraud produces a material misstatement and management does not correct it, the auditor must modify the audit opinion. The modification could be a qualified opinion or an adverse opinion, depending on how pervasive the effect is. A single misstated line item that can be isolated may warrant a qualification. A pervasive scheme that affects multiple areas typically leads to an adverse opinion.

In extreme cases where circumstances make continuing the audit untenable, ISA 240 permits the auditor to consider withdrawing from the engagement. Before doing so, the auditor must determine the professional and legal responsibilities that apply, discuss the withdrawal and its reasons with management and those charged with governance, and assess whether there is a legal obligation to report the withdrawal to regulators or to the person who appointed the auditor.³

ISA 240 recognizes that the auditor’s duty of confidentiality generally prevents reporting fraud to parties outside the entity. In many jurisdictions, however, laws or regulations may require the auditor to report fraud to financial regulators or enforcement agencies, and those legal obligations override the duty of confidentiality. The auditor must assess the applicable legal framework before making any external disclosure.

What Changes Under ISA 240 (Revised) in 2026

The IAASB approved a revised version of ISA 240 that takes effect for audits of financial statements covering periods beginning on or after December 15, 2026, with early adoption encouraged. The revision does not overhaul the standard’s framework but sharpens several of its requirements.⁴

Clearer responsibilities. The revised standard more precisely defines what auditors are expected to do when addressing fraud risk, reducing ambiguity in the existing requirements.
Reinforced professional skepticism. New requirements elevate skepticism expectations across all stages of the audit, not just planning.
A fraud lens for risk assessment. The revision requires auditors to apply a more focused fraud perspective when identifying and assessing risks, with stronger links to ISA 315 on risk identification.
Clearer fraud responses. A new section establishes enhanced requirements for how auditors respond when they actually identify or suspect fraud during the engagement.
Greater transparency. The revised standard emphasizes timelier communication with management and those charged with governance, and clearer disclosures in the auditor’s reports for publicly traded entities.⁵

1
IAASB. Auditor’s Responsibility to Consider Fraud in an Audit of Financial Statements – ISA 240
2
International Federation of Accountants. International Standard on Auditing 240 – The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements
3
International Federation of Accountants. International Standard on Auditing 240 – The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements
4
IAASB. IAASB Revises Fraud Standard to Enhance Public Trust
5
IAASB. ISA 240 (Revised) – The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements