The International Standards on Auditing are the globally recognized rules that tell independent auditors how to examine a company’s financial statements, from initial planning through the final signed opinion. More than 90 percent of jurisdictions belonging to the International Federation of Accountants now require or permit their use, which makes the ISAs the closest thing the profession has to a universal playbook.1IFAC. International Standards 2024 Global Adoption Snapshot An investor reading an audit opinion in Tokyo can trust that the auditor followed essentially the same process as one working in London or São Paulo.
Who Writes the Standards
The International Auditing and Assurance Standards Board (IAASB) drafts and maintains the ISAs. Since the end of 2022, the board has been housed under the International Foundation for Ethics and Audit (IFEA), a nonprofit created to reinforce the board’s independence from the accountancy profession. IFAC still provides office space and administrative support, but the legal and governance structure now separates standard-setting from professional advocacy.2International Foundation for Ethics and Audit. Questions and Answers on the International Foundation for Ethics and Audit
Two external bodies keep the process honest. The Public Interest Oversight Board watches the IAASB’s work to make sure it stays responsive to the public interest rather than the preferences of large accounting firms. The Monitoring Group, a coalition of international financial regulators, evaluates whether the overall system is working as intended.3PIOB. Purpose Before any standard takes effect, the IAASB publishes an exposure draft for worldwide comment, and its board meetings are public.
How the Standards Are Organized
ISAs are grouped into numbered series that roughly follow the life cycle of an audit. Knowing the layout makes it easier to find the standard that applies to a specific question.
- ISA 200–299 sets the auditor’s overall objectives and foundational duties like professional skepticism and documentation.
- ISA 300–499 covers planning, risk identification, and designing procedures to address those risks.
- ISA 500–599 specifies what counts as reliable evidence, including rules on confirmations, sampling, and analytical procedures.
- ISA 600–699 governs situations where the lead auditor relies on component auditors, internal auditors, or outside experts.
- ISA 700–799 dictates the structure and language of the auditor’s report, including opinion types and key audit matters.
- ISA 800–899 addresses non-standard engagements, such as audits of financial statements prepared under a special purpose framework.
The 100–700 series applies to every standard financial statement audit. The 800 series builds on that foundation for narrower or unusual engagements.4PASAI. International Standard on Auditing 800 Revised – Special Considerations Audits of Financial Statements Prepared in Accordance with Special Purpose Frameworks
Risk Assessment Drives the Audit
If one part of the framework drives everything else, it is risk assessment. ISA 315 (Revised 2019) requires the auditor to build a thorough understanding of the company and its environment before testing a single number. That means studying the industry, the entity’s internal controls, its information systems, and the nature of its transactions to figure out where financial misstatements could plausibly hide.5International Federation of Accountants. ISA 315 Revised 2019 – Identifying and Assessing the Risks of Material Misstatement
The 2019 revision introduced the “spectrum of inherent risk.” Instead of treating risk as a binary judgment, auditors now assess where each identified risk falls on a continuous range from lower to higher. Risks that land near the upper end are classified as significant risks and trigger more rigorous procedures. This forces auditors to think harder about the nature of each risk rather than relying on boilerplate assessments.
Planning sits alongside risk assessment. ISA 300 requires an overall audit strategy and a detailed plan before fieldwork begins, but treats planning as ongoing rather than a one-time event.6IAASB. Planning an Audit of Financial Statements – ISA 300 Related standards in this series cover materiality (ISA 320), the auditor’s responses to assessed risks (ISA 330), and the evaluation of misstatements found during the audit (ISA 450).7Institute of Chartered Accountants of Pakistan. ISA Adoption Status and Effective Dates
Gathering Audit Evidence
An auditor’s opinion is only as strong as the evidence behind it. ISA 500 frames the core requirement: every procedure must be designed to obtain evidence that is both sufficient (enough of it) and appropriate (relevant and reliable enough to support conclusions).8International Federation of Accountants. International Standard on Auditing 500 – Audit Evidence The standard does not prescribe a single technique. Auditors choose from inspection of documents, observation of processes, recalculation, reperformance, analytical procedures, and inquiry of management and staff.
ISA 505 governs external confirmations, the process of obtaining direct written responses from third parties like banks, customers, or suppliers. A bank confirmation verifying cash balances is considered highly reliable because it comes from a source independent of the company. ISA 560 addresses subsequent events. When the auditor learns of something significant that happened after the balance sheet date but before the report is issued, the standard requires discussion with management, a decision about whether the financial statements need amendment, and, if management refuses to make necessary changes, consideration of modifying the audit opinion.9International Federation of Accountants. ISA 560 – Subsequent Events
The Auditor’s Report and the Four Opinion Types
Everything in an audit funnels into a single document. ISA 700 controls the report’s form and content, and the rules are specific. The report must open with a clear title identifying the auditor as independent, and the first section must be the Opinion, stating whether the financial statements present a true and fair view.10Independent Regulatory Board for Auditors. International Standard on Auditing 700 Revised – Forming an Opinion and Reporting on Financial Statements Readers should not have to wade through boilerplate to find out whether the financials passed the test.
Immediately after comes the Basis for Opinion, confirming that the audit was conducted under ISAs, that the auditor met independence and ethics requirements, and that the evidence obtained was sufficient. For audits of listed companies, ISA 701 adds a required Key Audit Matters section: the issues that demanded the most judgment, involved the greatest complexity, or gave the auditor the most trouble. Publishing them gives investors a window into the audit process that a simple pass or fail opinion cannot provide.11IAASB. International Standard on Auditing ISA 701 New – Communicating Key Audit Matters in the Independent Auditors Report Jurisdictions can also require KAM disclosure for non-listed entities, and auditors may include them voluntarily.
The opinion itself falls into one of four categories:
- An unmodified opinion means the financial statements are free of material misstatement.
- A qualified opinion flags a specific issue but says the rest of the financials are fairly presented.
- An adverse opinion means the misstatements are so pervasive that the financial statements as a whole cannot be relied upon.
- A disclaimer of opinion means the auditor could not obtain enough evidence to form any conclusion at all.
Quality Management at the Firm Level
A good auditor working inside a poorly managed firm will eventually produce bad work. That insight led the IAASB to issue International Standard on Quality Management 1 (ISQM 1), which took effect on December 15, 2022, and replaced the older quality control standard.12IAASB. Quality Management Instead of a checklist of policies, ISQM 1 requires each firm to design a quality management system tailored to its own risks and circumstances, addressing eight components: the firm’s risk assessment process, governance and leadership, relevant ethical requirements, acceptance and continuance of engagements, engagement performance, resources, information and communication, and monitoring and remediation.
At the engagement level, ISA 220 (Revised) makes the engagement partner personally responsible for quality. The partner must be involved enough in the audit to have a basis for determining whether significant judgments and conclusions are appropriate, and must foster a culture where team members feel safe raising concerns.13Independent Regulatory Board for Auditors. ISA 220 Revised – Quality Management for an Audit of Financial Statements
Ethics, Independence, Fraud, and Documentation
Every ISA engagement rests on the International Ethics Standards Board for Accountants (IESBA) Code of Ethics. Auditors must act with integrity, maintain objectivity, and stay professionally competent, and they must be independent from the companies they audit in fact and in appearance. An auditor who holds shares in a client, or whose close family member works in the client’s finance department, cannot credibly claim to be unbiased.
Professional skepticism is a defined requirement, not a slogan. ISA 200 describes it as maintaining a questioning mind and being alert to conditions that suggest possible misstatement, whether from error or fraud. ISA 240 addresses fraud directly. An audit is not designed to catch every instance of fraud, but the auditor must specifically assess the risk of material misstatement caused by fraudulent activity, look for management override of controls, evaluate unusual journal entries, and consider whether revenue recognition methods are being manipulated.14IAASB. ISA 240 Revised – The Auditors Responsibilities Relating to Fraud in an Audit of Financial Statements
Documentation ties all of this together. ISA 230 requires records detailed enough that an experienced auditor with no connection to the engagement could pick up the file and understand what was done, what was found, and what conclusions were reached.15International Federation of Accountants. ISA 230 – Audit Documentation Regulators investigating an audit breakdown almost always start by reviewing the documentation, and gaps in the file are treated as evidence that the work was never performed.
Where the Standards Apply
Countries adopt ISAs in different ways. Some make them mandatory for all audits within their borders. Others converge existing national standards with the ISAs, keeping local requirements where needed but aligning the overall framework. A smaller number permit ISAs only for cross-border or multinational engagements while retaining separate domestic standards for local audits. For companies listed on multiple stock exchanges, a single audit conducted under ISAs can satisfy regulators in several countries at once, sparing the cost of redundant audits under different national rules.
The United States is the notable exception. Auditors of U.S. public companies follow standards issued by the Public Company Accounting Oversight Board (PCAOB), which differ from ISAs in important ways. The American Institute of CPAs has largely converged its own standards with the ISAs for audits of private companies, but full adoption remains a jurisdictional choice.
A Simplified Standard for Smaller Audits
A frequent criticism has been that ISA complexity is disproportionate for audits of small businesses, charities, and similarly straightforward organizations. The IAASB responded with a standalone standard, the ISA for Audits of Financial Statements of Less Complex Entities (ISA for LCE), effective for audits beginning on or after December 15, 2025, in jurisdictions that choose to adopt it.16IAASB. International Standard on Auditing for Audits of Financial Statements of Less Complex Entities
It is not available for every engagement. Listed entities are excluded, as are deposit-taking institutions like banks, entities whose primary business is providing insurance to the public, and group audits that require component auditors to handle parts of a corporate group. National regulators can add further exclusions or set size thresholds.17IAASB. ISA for LCE Guidance – Authority of the Standard The goal is not to lower audit quality for small entities but to strip away requirements that only make sense for complex organizations.
Beyond Financial Statements: Sustainability Assurance
The most significant expansion of the IAASB’s work in recent years has nothing to do with financial statements. International Standard on Sustainability Assurance 5000 (ISSA 5000) creates a framework for independent assurance on sustainability reports, covering topics like carbon emissions, labor practices, and governance disclosures. It takes effect for sustainability information reported for periods beginning on or after December 15, 2026.18IAASB. International Standard on Sustainability Assurance ISSA 5000
ISSA 5000 is designed to work with any sustainability reporting framework, whether the ISSB Standards, the European Sustainability Reporting Standards, the GRI Standards, or another set of criteria. It accommodates two levels of assurance. A limited assurance engagement provides moderate confidence, comparable to a review of financial statements, while a reasonable assurance engagement requires substantially more work and provides the higher level of confidence associated with a full audit.19IAASB. Understanding the International Standard on Sustainability Assurance 5000 Most early regulatory mandates are expected to start with limited assurance and transition to reasonable assurance over time.