The content on this page has been converted from PDF to HTML format using an artificial intelligence (AI) tool as part of our ongoing efforts to improve accessibility and usability of our publications. Note:

No human verification has been conducted of the converted content.
While we strive for accuracy errors or omissions may exist.
This content is provided for informational purposes only and should not be relied upon as a definitive or authoritative source.
For the official and verified version of the publication, refer to the original PDF document.

If you identify any inaccuracies or have concerns about the content, please contact us at [email protected].

ISA (UK) 250 (Revised September 2026)

Financial Reporting Council

The Financial Reporting Council (FRC) is the UK's independent regulator responsible for promoting responsible for promoting transparency and integrity in business. The FRC sets the UK Corporate Governance and Stewardship Codes and UK standards for accounting and actuarial work; monitors and takes action to promote the quality of corporate reporting; and operates independent enforcement arrangements for accountants and actuaries. As the Competent Authority for audit in the UK the FRC sets auditing and ethical standards and monitors and enforces audit quality.

The FRC does not accept any liability to any party for any loss, damage or costs howsoever arising, whether directly or indirectly, whether in contract, tort or otherwise from any action or decision taken (or not taken) as a result of any person relying on or otherwise using this document or arising from an omission from it.

© The Financial Reporting Council Limited 2026 The Financial Reporting Council Limited is a company limited by guarantee. Registered in England number 2486368. Registered Office: 13th Floor, 1 Harbour Exchange Square, London E14 9GE

International Standard on Auditing (UK) (ISA (UK)) 250 (Revised September 2026), Consideration of Laws and Regulations in an Audit of Financial Statements, should be read in conjunction with ISA (UK) 200 (Revised June 2016), Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing (UK).

Introduction

Scope of this ISA (UK)

1This International Standard on Auditing (UK) (ISA (UK)) deals with the auditor's responsibility to consider laws and regulations in an audit of financial statements. This ISA (UK) does not apply to other assurance engagements in which the auditor is specifically engaged to test and report separately on compliance with specific laws or regulations. The requirements and guidance in this ISA (UK) refer to, or expand on, the application of other relevant ISAs (UK), in particular ISA (UK) 200 (Revised June 2016), ISA (UK) 315 (Revised July 2020) and ISA (UK) 330 (Revised July 2017).

Effect of Laws and Regulations

2-1Laws and regulations to which an entity is subject constitute the legal and regulatory framework in which it operates; however the effect of laws and regulations on the entity's financial statements may vary. For example, the provisions of some laws or regulations may need to be applied by management when determining amounts and disclosures to be reported in an entity's financial statements (e.g., tax legislation). By contrast other laws or regulations set the provisions under which the entity is allowed to conduct its business (e.g., regulatory frameworks established by prudential supervisors in the banking or insurance industries). Non-compliance with laws and regulations may result in fines, litigation or other consequences for the entity, including a loss of public confidence that may have a material effect on the financial statements.

Non-compliance with Laws and Regulations

2-2Non-compliance with laws and regulations can arise unintentionally (i.e., through error) or intentionally (i.e., through the deliberate intentions of management, those charged with governance, employees or third parties).

Responsibility for Compliance with Laws and Regulations

Responsibilities of Management and Those Charged with Governance (Ref: Para. A1-A2-3)

3It is the responsibility of management, with the oversight of those charged with governance, to ensure that the entity's operations are conducted in accordance with the provisions of laws and regulations to which the entity is subject.

Responsibility of the Auditor (Ref: Para. A3–A8-1)

4-1This ISA (UK) addresses the auditor's responsibilities in identifying and assessing risks of material misstatement arising from non-compliance with laws and regulations, obtaining sufficient appropriate audit evidence regarding those risks, and responding appropriately to identified or suspected non-compliance with laws and regulations. The auditor is not engaged to provide assurance on an entity's compliance with laws and regulations generally, nor is the auditor expected to identify every law or regulation applicable to the entity. Accordingly, the auditor's consideration is directed towards those laws and regulations that may reasonably be expected to have a material effect on the financial statements.

5-1The auditor is responsible for obtaining reasonable assurance that the financial statements, taken as a whole, are free from material misstatement, whether due to fraud or error. This ISA (UK) establishes the auditor's responsibilities to identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, arising from non-compliance with laws and regulations, obtaining sufficient appropriate audit evidence regarding those risks, and responding appropriately to identified or suspected non-compliance with laws and regulations. However, the auditor is not responsible for preventing non-compliance and cannot be expected to detect non-compliance with all laws and regulations. Laws and regulations with which non-compliance may have a material effect on the financial statements relate to either:

The provisions of those laws and regulations generally recognized to have an effect on the determination of material amounts and disclosures in the financial statements such as tax and pension laws and regulations (Ref: Para. A11-8–A11-10); and
Laws and regulations with which compliance may be fundamental to the operating aspects of the entity or to an entity's ability to continue its business (e.g., compliance with the terms of an operating license, compliance with regulatory solvency requirements, or compliance with environmental regulations). (Ref: Para. A11-2-A11-7)

6[Not in use].

7[Not in use].

8The auditor is required by this ISA (UK) to remain alert to the possibility that other audit procedures applied for the purpose of forming an opinion on financial statements may bring instances of non-compliance to the auditor's attention. Maintaining professional skepticism throughout the audit, as required by ISA (UK) 200 (Revised June 2016),¹ is important in this context, given the extent of laws and regulations that affect the entity.

9The auditor may have additional responsibilities under law, regulation or relevant ethical requirements regarding an entity's non-compliance with laws and regulations, which may differ from or go beyond this ISA (UK), such as: (Ref: Para. A8–A8-1)

Responding to identified or suspected non-compliance with laws and regulations, including requirements in relation to specific communications with management and those charged with governance, assessing the appropriateness of their response to non-compliance and determining whether further action is needed;
Communicating identified or suspected non-compliance with laws and regulations to other auditors (e.g., in an audit of group financial statements); and
Documentation requirements regarding identified or suspected non-compliance with laws and regulations.

Complying with any additional responsibilities may provide further information that is relevant to the auditor's work in accordance with this and other ISAs (UK) (e.g., in respect of fraud or suspected fraud, or regarding the integrity of management or, where appropriate, those charged with governance).

Inherent Limitations (Ref: Para. A8-2)

9-1Whilst the risk of not detecting a material misstatement arising from intentional non-compliance with laws and regulations may be greater than for non-compliance that is unintentional, this does not diminish the auditor's responsibility to plan and perform the audit to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error. Reasonable assurance is a high, but not absolute, level of assurance.

9-2Accordingly, the inherent limitations of an audit as they relate to non-compliance with laws and regulations are not a justification for the auditor to be satisfied with less than persuasive audit evidence. ²

Effective Date

10This ISA (UK) is effective for audits of financial statements for periods commencing on or after 15 December 2027.

Objectives

11-1The objectives of the auditor are:

To identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, arising from non-compliance with laws and regulations;
To obtain sufficient appropriate audit evidence regarding the assessed risks of material misstatement, whether due to fraud or error, arising from non-compliance with laws and regulations; and
To respond appropriately to identified or suspected non-compliance with laws and regulations identified during the audit.

Definition

12For the purposes of this ISA (UK), the following term has the meaning attributed below:

Non-compliance Acts of omission or commission intentional or unintentional, committed by the entity, or by those charged with governance, by management or by other individuals working for or under the direction of the entity, which are contrary to the prevailing laws or regulations. Non-compliance does not include personal misconduct unrelated to the business activities of the entity. (Ref: Para. A9–A10)

Requirements

12-1In applying ISA (UK) 315 (Revised July 2020), the auditor shall perform the risk assessment procedures in paragraphs 12-2-12-3 to obtain audit evidence that provides an appropriate basis for the identification and assessment of risks of material misstatement arising from non-compliance with laws and regulations. (Ref: Para. A10-1-A10-11)

Obtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework, and the Entity's System of Internal Control (Ref: Para. 12-2)

12-2In applying ISA (UK) 315 (Revised July 2020),³ the auditor shall obtain an understanding of: (Ref: Para. A10-12-A11-1)

The Entity and Its Environment

Regulatory factors, including those laws and regulations with which compliance may be fundamental to the operating aspects of the entity or to an entity's ability to continue its business; (Ref: Para. A11-2-A11-7)

The Applicable Financial Reporting Framework

The provisions of laws and regulations generally recognized to have an effect on the determination of material amounts and disclosures in the financial statements; (Ref: Para. A11-8-A11-10)

The Entity's System of Internal Control (Ref: Para. A11-11-A11-14)

How management identifies those laws and regulations described in paragraphs 12-2(a) and 12-2(b);
The entity's risk assessment process to identify, assess and address business risks relating to non-compliance with those laws and regulations described in paragraphs 12-2(a) and 12-2(b); and
How those charged with governance exercise oversight over the entity's compliance with those laws and regulations described in paragraphs 12-2(a) and 12-2(b).

12-3The auditor shall:

Make inquiries of management, and where appropriate those charged with governance, and of other appropriate individuals within the entity to: (Ref: Para. A11-15)
1. Determine whether they have knowledge of any identified or suspected non-compliance with laws and regulations affecting the entity; and
2. Obtain their views about:
  1. Whether and how the financial statements may be materially misstated due to non-compliance with laws and regulations; and
  2. Whether they are aware of deficiencies in the system of internal control related to the prevention and detection of non-compliance with laws and regulations, and the remediation efforts to address such deficiencies;
Inspect the following for indications of non-compliance with laws or regulations:
1. Correspondence, if any, with relevant licensing or regulatory authorities;
2. Where appropriate, legal confirmations obtained as part of the auditor's procedures; (Ref: Para. A11-16)
3. Minutes of meetings of shareholders, management and those charged with governance; and
4. Such other records or documents as the auditor considers necessary in the circumstances of the entity. (Ref: Para. A11-17)

Remaining Alert Throughout the Audit for Indications of Non-Compliance

13-1The auditor shall remain alert throughout the audit for any indications of non-compliance with laws or regulations. (Ref: Para. A12-1-A14-1)

Identifying and Assessing the Risks of Material Misstatement Arising From Non-Compliance

14-1In applying ISA (UK) 315 (Revised July 2020), the auditor shall determine whether the audit evidence obtained from risk assessment procedures and related activities indicates the existence of:

A risk of material misstatement arising from non-compliance with laws and regulations; or (Ref: Para. A15-1-A15-4)
Identified or suspected non-compliance with laws and regulations. (Ref: Para. A15-5)

Responses to the Assessed Risks of Material Misstatement Arising From Non-Compliance

15-1In applying ISA (UK) 330 (Revised July 2017), the auditor shall design and perform further audit procedures whose nature, timing, and extent are based on and are responsive to the assessed risks of material misstatement arising from non-compliance with laws and regulations. (Ref: Para. A15-6-A15-9)

Evaluating the Audit Evidence Obtained

16-1The auditor shall evaluate whether sufficient appropriate audit evidence has been obtained regarding:

Identified risks of material misstatement arising from non-compliance with laws and regulations; and
Whether there is a material misstatement of the financial statements relating to any identified or suspected non-compliance with laws and regulations.

In making this evaluation, the auditor shall consider all audit evidence obtained, including audit evidence that is consistent or inconsistent with other audit evidence, and regardless of whether it appears to corroborate or contradict the assertions in the financial statements. (Ref: Para. A15-10-A15-11)

Written Representations

17The auditor shall request management and, where appropriate, those charged with governance to provide written representations that all known instances of non-compliance or suspected non-compliance with laws and regulations whose effects should be considered when preparing financial statements have been disclosed to the auditor. (Ref: Para. A16)

18[Not in use].

Audit Procedures When Non-Compliance Is Identified or Suspected

19If the auditor becomes aware of information concerning an instance of non-compliance or suspected non-compliance with laws and regulations, the auditor shall obtain:

An understanding of the nature of the act and the circumstances in which it has occurred; and (Ref: Para. A17-1-A18-1)
Further information to evaluate the possible effect on the financial statements. (Ref: Para. A19)

20If the auditor suspects there may be non-compliance, the auditor shall discuss the matter, unless prohibited by law or regulation, with the appropriate level of management and, where appropriate, those charged with governance. If management or, as appropriate, those charged with governance do not provide sufficient information that supports that the entity is in compliance with laws and regulations and, in the auditor's judgment, the effect of the suspected non-compliance may be material to the financial statements either quantitatively or qualitatively, and where there is more than one occurrence, both individually and in aggregate, the auditor shall consider the need to obtain legal advice. (Ref: Para. A20-A22)

21If sufficient information about suspected non-compliance cannot be obtained, the auditor shall evaluate the effect of the lack of sufficient appropriate audit evidence on the auditor's opinion.

22The auditor shall evaluate the implications of identified or suspected non-compliance in relation to other aspects of the audit, including the auditor's risk assessment and the reliability of written representations, and take appropriate action. (Ref: Para. A23-A25-2)

Concluding and Adequacy of Disclosures

22-1If non-compliance or suspected non-compliance with laws and regulations has been identified, the auditor shall conclude whether, in the auditor's professional judgment, a material misstatement of the financial statements exists. In doing so, the auditor shall take into account: (Ref: Para. A25-3)

The requirements of the applicable financial reporting framework; and
Whether the financial statements adequately reflect or, where appropriate, disclose the non-compliance or suspected non-compliance with laws and regulations.

Communicating and Reporting Identified or Suspected Non-Compliance

Communicating Identified or Suspected Non-Compliance with Those Charged with Governance

23Unless all of those charged with governance are involved in management of the entity, and therefore are aware of matters involving identified or suspected non-compliance already communicated by the auditor,⁴ the auditor shall communicate, unless prohibited by law or regulation, with those charged with governance matters involving non-compliance with laws and regulations that come to the auditor's attention during the course of the audit, other than when the matters are clearly inconsequential.

23-1For audits of financial statements of public interest entities, when an auditor suspects or has reasonable grounds to suspect that irregularities, including fraud with regard to the financial statements of the entity, may occur or have occurred, the auditor shall, unless prohibited by law or regulation, inform the entity and invite it to investigate the matter and take appropriate measures to deal with such irregularities and to prevent any recurrence of such irregularities in the future. (Ref: Para. A25-4–A25-5)

24If, in the auditor's judgment, the non-compliance referred to in paragraph 23 is believed to be intentional and material, the auditor shall communicate the matter, unless prohibited by law or regulation, with those charged with governance as soon as practicable. (Ref: Para. A25-6)

25If the auditor suspects that management or those charged with governance are involved in non-compliance, the auditor shall communicate the matter, unless prohibited by law or regulation, to the next higher level of authority at the entity, if it exists, such as an audit committee or supervisory board. Where no higher authority exists, or if the auditor believes that the communication may not be acted upon or is unsure as to the person to whom to report, the auditor shall consider the need to obtain legal advice. (Ref: Para. A25-7)

Potential Implications of Identified or Suspected Non-Compliance for the Auditor's Report on the Financial Statements (Ref: Para. A26-A27)

26If the auditor concludes that the identified or suspected non-compliance has a material effect on the financial statements, and has not been adequately reflected, or where appropriate, disclosed in the financial statements, the auditor shall, in accordance with ISA (UK) 705 (Revised June 2016), express a qualified opinion or an adverse opinion on the financial statements.⁵

27If the auditor is precluded by management or those charged with governance from obtaining sufficient appropriate audit evidence to evaluate whether non-compliance that may be material to the financial statements has, or is likely to have, occurred, the auditor shall express a qualified opinion or disclaim an opinion on the financial statements on the basis of a limitation on the scope of the audit in accordance with ISA (UK) 705 (Revised November 2019).⁶

28If the auditor is unable to determine whether non-compliance has occurred because of limitations imposed by the circumstances rather than by management or those charged with governance, the auditor shall evaluate the effect on the auditor's opinion in accordance with ISA (UK) 705 (Revised November 2019).

Reporting Identified or Suspected Non-Compliance to an Appropriate Authority Outside the Entity

29If the auditor has identified or suspects non-compliance with laws and regulations, the auditor shall determine whether law, regulation or relevant ethical requirements: (Ref: Para. A28-A34-1)

Require the auditor to report to an appropriate authority outside the entity.
Establish responsibilities or rights under which reporting to an appropriate authority outside the entity may be appropriate in the circumstances.

29-1For audits of financial statements of public interest entities, where the entity does not investigate the matter referred to in paragraph 23-1, the auditor shall inform the authorities responsible for investigating such irregularities. (Ref: Para. A34-2-A34-3)

Documentation

29-2In applying ISA (UK) 230 (Revised June 2016), the auditor shall include the following in the audit documentation:

Significant matters arising from the auditor's consideration of:
1. The applicable financial reporting framework, including the provisions of laws and regulations generally recognized to have an effect on the determination of material amounts and disclosures in the financial statements; and
2. Those laws and regulations that with which compliance may be fundamental to the operating aspects of the entity or to an entity's ability to continue its business;
Any indications of non-compliance with laws and regulations; and
The auditor's significant judgments in identifying and assessing risks of material misstatement arising from non-compliance with laws and regulations.

30The auditor shall include in the audit documentation⁷ identified or suspected non-compliance with laws and regulations and: (Ref: Para. A35-A36)

The audit procedures performed, the significant professional judgments made and the conclusions reached thereon; and
The discussions of significant matters related to the non-compliance with management, those charged with governance and others, including how management and, where applicable, those charged with governance have responded to the matter.

Application and Other Explanatory Material

Responsibility for Compliance with Laws and Regulations (Ref: Para. 3–9-2)

Responsibilities of Management and Those Charged with Governance (Ref: Para. 3)

A1It is the responsibility of management, with the oversight of those charged with governance, to ensure that the entity's operations are conducted in accordance with laws and regulations. Laws and regulations may affect an entity's financial statements in different ways: for example, most directly, they may affect specific disclosures required of the entity in the financial statements or they may prescribe the applicable financial reporting framework. They may also establish certain legal rights and obligations of the entity, some of which will be recognized in the entity's financial statements. In addition, laws and regulations may impose penalties in cases of non-compliance.

A2The following are examples of the types of policies and procedures an entity may implement to assist in the prevention and detection of non-compliance with laws and regulations:

Monitoring legal requirements and ensuring that operating procedures are designed to meet these requirements.
Instituting and operating appropriate systems of internal control.
Developing, publicizing and following a code of conduct.
Ensuring employees are properly trained and understand the code of conduct.
Monitoring compliance with the code of conduct and acting appropriately to discipline employees who fail to comply with it.
Engaging legal advisors to assist in monitoring legal requirements.
Maintaining a register of significant laws and regulations with which the entity has to comply within its particular industry and a record of complaints.

In larger entities, these policies and procedures may be supplemented by assigning appropriate responsibilities to the following:

An internal audit function.
An audit committee.
A compliance function.

A2-1In certain sectors or activities (e.g., financial services), there are detailed laws and regulations that specifically require management or those charged with governance to have systems to ensure compliance. Non-compliance with these laws and regulations could have a material effect on the financial statements.

A2-2Management is responsible for the preparation of financial statements that give a true and fair view. Accordingly it is necessary, where identified or suspected non-compliance with laws and regulations has occurred which may result in a material misstatement in the financial statements, for management to ensure that the matter is appropriately reflected and, where appropriate, disclosed in the financial statements.

A2-3Directors and officers of companies have responsibility to provide information required by the auditor, to which they have a legal right of access.⁸ Such legislation also provides that it is a criminal offence to give to the auditor information or explanations which are misleading, false or deceptive.

Responsibility of the Auditor (Ref: Para. 4-1–9)

A3Non-compliance by the entity with laws and regulations may result in a material misstatement of the financial statements. Detection of non-compliance, regardless of materiality, may affect other aspects of the audit including, for example, the auditor's consideration of the integrity of management, those charged with governance or employees.

A4Whether an act constitutes non-compliance with laws and regulations is a matter to be determined by a court or other appropriate adjudicative body, which is ordinarily beyond the auditor's professional competence to determine. Nevertheless, the auditor's training, experience and understanding of the entity and its industry or sector may provide a basis to recognize that some acts, coming to the auditor's attention, may constitute non-compliance with laws and regulations.

A5In accordance with specific statutory requirements, the auditor may be specifically required to report, as part of the audit of the financial statements, on whether the entity complies with certain provisions of laws or regulations. In these circumstances, ISA (UK) 700 (Revised May 2026)⁹ or ISA (UK) 800 (Revised)¹⁰ deal with how these audit responsibilities are addressed in the auditor's report. Furthermore, where there are specific statutory reporting requirements, it may be necessary for the audit plan to include appropriate tests for compliance with these provisions of the laws and regulations.

A6[Not in use].

Considerations Specific to Public Sector Entities

A7In the public sector, there may be additional audit responsibilities with respect to the consideration of laws and regulations which may relate to the audit of financial statements or may extend to other aspects of the entity's operations.

Additional Responsibilities Established by Law, Regulation or Relevant Ethical Requirements (Ref: Para. 9)

A8Law, regulation or relevant ethical requirements may require the auditor to perform additional procedures and take further actions. For example, the Code of Ethics for Professional Accountants issued by the International Ethics Standards Board for Accountants (IESBA Code) requires the auditor to take steps to respond to identified or suspected non-compliance with laws and regulations and determine whether further action is needed. Such steps may include the communication of identified or suspected non-compliance with laws and regulations between auditors within the engagement team, or other auditors performing work at entities or business units of a group for purposes other than the audit of the group financial statements.¹¹

A8-1UK legislation relating to money laundering, terrorist financing and proceeds of crime imposes additional responsibilities on the auditor. Anti-money laundering legislation does not require the auditor to extend the scope of the audit, but during the course of the audit, knowledge or suspicion, or reasonable grounds for knowledge or suspicion, relating to money laundering activities may arise that should be reported in accordance with the legislation.

In the UK, the auditor has regard to any specific requirements of the auditor's relevant professional body.

Inherent Limitations (Ref: Para. 9-1-9-2)

A8-2In the context of laws and regulations, the potential effects of inherent limitations on the auditor's ability to detect material misstatements are greater for such reasons as the following:

There are many laws and regulations, relating principally to the operating aspects of an entity, that typically do not affect the financial statements and are not captured by the entity's information systems relevant to financial reporting.
Non-compliance may involve conduct designed to conceal it, such as collusion, forgery, deliberate failure to record transactions, management override of controls or intentional misrepresentations being made to the auditor.
Whether an act constitutes non-compliance is ultimately a matter to be determined by a court or other appropriate adjudicative body.

Ordinarily, the further removed non-compliance is from the events and transactions reflected in the financial statements, the less likely the auditor is to become aware of it or to recognize the non-compliance.

Definition (Ref: Para. 12)

A9Acts of non-compliance with laws and regulations include transactions entered into by, or in the name of, the entity, or on its behalf, by those charged with governance, by management or by other individuals working for or under the direction of the entity.

A10Non-compliance also includes personal misconduct related to the business activities of the entity, for example, in circumstances where an individual in a key management position, in a personal capacity, has accepted a bribe from a supplier of the entity and in return secures the appointment of the supplier to provide services or contracts to the entity.

Engagement Resources (Ref: Para. 12-1)

A10-1ISA (UK) 220 (Revised July 2021)¹² requires the engagement partner to determine that members of the engagement team collectively have the appropriate competence and capabilities, including, where appropriate, specialized skills or knowledge, to perform risk assessment procedures, identify and assess the risks of material misstatement arising from non-compliance with laws and regulations, design and perform further audit procedures to respond to those risks, or evaluate the audit evidence obtained.

A10-2In applying this ISA (UK), the auditor's understanding of laws and regulations is obtained for the purpose of identifying and assessing risks of material misstatement of the financial statements and designing appropriate responses to those risks. As explained in paragraph 4-1, the auditor's consideration is directed towards those laws and regulations that may reasonably be expected to give rise to risks of material misstatement of the financial statements. Accordingly, the auditor's understanding is directed towards those laws and regulations that may reasonably be expected to give rise to risks of material misstatement of the financial statements, whether through their effect on amounts, disclosures, obligations, liabilities, going concern considerations or other consequences relevant to the preparation of the financial statements. Where the auditor determines that the engagement team does not possess the competence or capabilities necessary to understand particular legal or regulatory matters relevant to the audit that may reasonably be expected to have a material effect on the financial statements, the auditor may involve individuals with specialized expertise to assist in applying the requirements of this ISA (UK).

A10-3In determining whether the engagement team collectively possesses sufficient competence and capabilities to perform the risks assessment procedures required by this ISA (UK), the auditor may consider such factors as:

The nature and complexity of the legal and regulatory framework applicable to the entity.
Whether the entity operates in a highly regulated sector.
Significant changes in laws, regulation or regulatory expectations.
The extent to which compliance with particular laws or regulations is fundamental to the operating aspects of the entity or to an entity's ability to continue as a going concern.
Whether the entity operates across multiple jurisdictions or regulatory regimes that give rise to differing, complex or overlapping legal and regulatory requirements.
Prior instances of identified or suspected non-compliance.
The existence of significant investigations, regulatory enquiries or litigation.
The extent to which specialized technical or industry knowledge is required to understand the matters giving rise to potential risks of material misstatement arising from non-compliance with laws and regulations.
Whether members of the engagement team have obtained relevant experience from prior engagements involving similar circumstances.

A10-4In many audits, the auditor's understanding of laws and regulations for the purpose of identifying and assessing risks of material misstatement may be obtained through inquiries of management and those charged with governance, together with the auditor's understanding of the entity, its industry, and its operating environment. Accordingly, the involvement of individuals with specialized legal or regulatory expertise will not ordinarily be necessary solely to perform the risk assessment procedures required by this ISA (UK).

A10-5The need for specialized skills or knowledge may become more relevant after the auditor has identified a risk of material misstatement arising from non-compliance with laws and regulations or where the auditor has identified actual or suspected non-compliance. In such circumstances, the auditor may determine that specialized skills or knowledge are necessary to assist in understanding the:

Requirements of a specific law or regulation.
Implications of actual or potential non-compliance.
Likelihood and magnitude of potential financial statement effects.
Design of appropriate audit responses.

The need for such expertise depends on the nature and circumstances of the identified risk or matter and is not determined solely by the existence of a complex legal or regulatory framework.

A10-6The auditor may also determine that specialized skills or knowledge are necessary where identified or suspected non-compliance involves specialized legal or regulatory requirements, significant legal interpretation or uncertainty, or may have significant implications for the financial statements or the entity's ability to continue as a going concern.

A10-7Where the auditor determines that specialized skills or knowledge are necessary, the auditor may involve individuals with specialized legal, regulatory, industry or other relevant expertise as part of the engagement team or as auditor's experts, as appropriate.

A10-8The auditor may respond to identified risks of material misstatement arising from non-compliance with laws and regulations by, for example, assigning additional individuals with specialized skills and knowledge, such as legal experts, or by assigning more experienced individuals to the engagement.

Engagement Team Discussion

A10-9As part of the engagement team discussion required by ISA (UK) 315 (Revised July 2020), the engagement team may use this as an opportunity to:

Place particular emphasis on how and where the entity's financial statements may be susceptible to material misstatement arising from non-compliance with laws and regulations.
Include any identified or suspected non-compliance with laws and regulations that have come to the attention of members of the engagement team, including how to investigate and respond to such non-compliance.

Materiality in Relation to Non-Compliance with Laws and Regulations

A10-10The auditor considers both quantitative and qualitative factors when considering those laws and regulations with which non-compliance may have a material effect on the financial statements, including in circumstances where the effect on the determination of amounts and disclosures in the financial statements is not quantitatively material. For example, although acts of non-compliance may not result in material fines or penalties, disclosure may nonetheless be necessary where the nature of the entity is such that information about acts of non-compliance would be important to users of the financial statements.

Scalability

A10-11When determining the nature and extent of the procedures necessary to identify those laws and regulations with which non-compliance may have a material effect on the financial statements, the auditor takes account of the particular entity concerned and the complexity of the law and regulations with which it is required to comply. For example, a small entity which does not operate in a regulated area may require few specific procedures compared with a large multinational corporation carrying on complex, regulated business.

Obtaining an Understanding of the Entity and Its Environment, the Applicable Financial Reporting Framework, and the Entity's System of Internal Control (Ref: Para. 12-2)

A10-12As ISA (UK) 315 (Revised July 2020) explains, understanding the entity and its environment, and the applicable financial reporting framework, assists the auditor in identifying events or conditions, the characteristics of which may affect the susceptibility of assertions about classes of transactions, account balances or disclosures to misstatement.¹³ This ISA (UK) requires the auditor to obtain an understanding of regulatory factors, including those laws and regulations with which compliance may be fundamental to the operating aspects of the entity or to an entity's ability to continue its business and the applicable financial reporting framework, including the provisions of laws and regulations generally recognized to have an effect on the determination of material amounts and disclosures in the financial statements in order to help the auditor to identify events or conditions specifically relevant to laws and regulations with which inherent risk factors affect the susceptibility of assertions to misstatement.

A11To obtain an understanding of the legal and regulatory framework, and how the entity complies with that framework, the auditor may, for example:

Use the auditor's existing understanding of the entity's industry, regulatory and other external factors;
Update the understanding of those laws and regulations that directly determine the reported amounts and disclosures in the financial statements;
Inquire of management as to other laws or regulations that may be expected to have a fundamental effect on the operations of the entity;
Inquire of management concerning the entity's policies and procedures regarding compliance with laws and regulations; and
Inquire of management regarding the policies or procedures adopted for identifying, evaluating and accounting for litigation claims.

A11-1In an audit of group financial statements, a component may operate in a legal or regulatory environment that differs from that of the group or other components. In obtaining an understanding of laws and regulations that may give rise to risks of material misstatement in the group financial statements, the group auditor may obtain information through communications with group management and those charged with governance, component auditors, component management or other appropriate sources. The nature and extent of the group auditor's inquiries and procedures are matters of professional judgment and may be influenced by factors such as the significance of the component, the nature of its operations, the industry and regulatory environment in which it operates, and the susceptibility of the group financial statements to material misstatement arising from non-compliance with laws and regulations. The group auditor is not expected to obtain a detailed understanding of all laws and regulations applicable to every component or jurisdiction in which the group operates; rather, the auditor's understanding is directed towards those laws and regulations that may reasonably be expected to give rise to risks of material misstatement in the group financial statements.

Laws and Regulations That Are Fundamental to the Operating Aspects of the Entity (Ref: Para. 12-2(a))

A11-2Certain laws and regulations may need particular attention by the auditor because they have a fundamental effect on the operations of the entity. Non-compliance with laws and regulations that have a fundamental effect on the operations of the entity may cause the entity to cease operations, or call into question the entity's ability to continue as a going concern.¹⁴ For example, non-compliance with the requirements of the entity's license or other entitlement to perform its operations could have such an impact (e.g., for a bank, non-compliance with capital or investment requirements).¹⁵ There are also many laws and regulations relating principally to the operating aspects of the entity that typically do not affect the financial statements and are not captured by the entity's information systems relevant to financial reporting.

A11-3A law or regulation may be considered fundamental to the operating aspects of the entity where non-compliance could reasonably be expected to result in consequences that significantly impair the entity's ability to conduct its principal operations, continue its business, or give rise to a material effect on the financial statements. In making this determination, the auditor may consider whether compliance with the law or regulation is necessary for the entity to:

Undertake its principal business activities.
Maintain a license, registration, permit or other authorization to operate.
Access key markets, customers, funding arrangements or supply chains.
Avoid sanctions, restrictions, penalties or other consequences that could reasonably be expected to have a material effect on the financial statements or the entity's ability to continue its business.
Operate its business model without significant regulatory restriction.

One or more of these factors may indicate that compliance with a law or regulation is fundamental, depending on the facts and circumstances of the entity.

A11-4As explained in paragraph 4-1, this ISA (UK) does not require the auditor to identify every law or regulation applicable to the entity or to obtain assurance on the entity's compliance with laws and regulations generally. Management is responsible for identifying the laws and regulations to which the entity is subject and for ensuring that the entity's operations are conducted in accordance with those laws and regulations. Accordingly, the auditor's understanding of those laws and regulations that may reasonably be expected to have a fundamental effect on the operations of the entity is obtained primarily through inquiries of management and, where appropriate, those charged with governance and others within the entity (e.g. an internal audit or a regulatory compliance function), together with the auditor's understanding of the entity and its system of internal control. The auditor may also draw on knowledge obtained from previous audits, where applicable, and the auditor's understanding of the industry, sector and external environment in which the entity operates.

A11-5The extent of the auditor's work to obtain the understanding required by paragraph 12-2(a) is informed by the auditor's risk assessment and the information obtained from management, those charged with governance and other relevant sources. The auditor uses professional judgment in determining which laws and regulations may reasonably be expected to have a fundamental effect on the operations of the entity. Unless information obtained during the audit indicates that further laws or regulations may be relevant, the auditor is ordinarily entitled to rely on the understanding obtained through the procedures required by this ISA (UK) as a basis for determining the laws and regulations that warrant further consideration in the audit.

A11-6Laws and regulations with which compliance is fundamental to the operating aspects of the entity or to an entity's ability to continue its business will vary depending on the nature, size and circumstances of the entity. They may arise from general legal requirements applicable to all entities, or from industry-specific regulatory frameworks. Examples of such laws and regulations may include those that deal with:

Fraud, corruption and bribery.
Money laundering,¹⁶ terrorist financing and proceeds of crime.
Securities markets and trading.
Banking and other financial products and services.
Data protection.
Tax and pension liabilities and payments.
Environmental protection.
Public health and safety.
Sustainability and climate.

Whether such laws and regulations are fundamental depends on the nature and circumstances of the entity and the consequences that non-compliance could reasonably be expected to have for the entity's operations and financial statements. A category of law or regulation is not automatically fundamental solely because it appears in the examples above.

A11-7The determination of whether a law or regulation is fundamental is based on what the auditor knew, or could reasonably be expected to have known, at the time professional judgments are made, rather than on information or outcomes that become apparent only after the audit. The auditor's assessment is grounded in the facts and circumstances and information available during the audit, while remaining alert to information obtained throughout the engagement that may warrant reconsideration of that assessment.

Laws and Regulations Relating to the Determination of Material Amounts and Disclosures in the Financial Statements (Ref: Para. 12-2(b))

A11-8Certain laws and regulations are well-established, known to the entity and within the entity's industry or sector, and relevant to the entity's financial statements. They could include those that relate to, for example:

Industry-specific financial reporting issues;
Accounting for transactions under government contracts; or
The accrual or recognition of expenses for income tax or pension costs.

In the UK, such laws and regulations also include those which:

Determine the circumstances under which an entity is prohibited from making a distribution except out of profits available for the purpose.¹⁷
Require auditors expressly to report non-compliance, such as the requirements relating to the maintenance of adequate accounting records¹⁸ or the disclosure of particulars of directors' remuneration in the financial statements.¹⁹

A11-9Some laws and regulations may be directly relevant to specific assertions in the financial statements (e.g., the completeness of income tax provisions), while others may be directly relevant to the financial statements as a whole (e.g., the required statements constituting a complete set of financial statements).

A11-10Non-compliance with laws and regulations may result in fines, litigation or other consequences for the entity, the costs of which may need to be provided for in the financial statements, but are not considered to have an effect on the determination of material amounts and disclosures in the financial statements. However, where the auditor identifies a risk of material misstatement arising from non-compliance with laws and regulations or otherwise identifies or suspects non-compliance with laws and regulations, the auditor takes into account potential fines, litigation or other consequences for the entity when evaluating the possible effect on the financial statements in accordance with paragraph 19(b).

The Entity's System of Internal Control (Ref: Para. 12-2(c)-(e))

A11-11The audit is conducted on the premise that management and, where appropriate, those charged with governance have acknowledged and understand that they have responsibility for the preparation of the financial statements in accordance with the applicable financial reporting framework, including where relevant their fair presentation, and for such internal control as management and, where appropriate, those charged with governance determine is necessary to enable the preparation of financial statements that are free from material misstatement, whether due to fraud or error.²⁰ Accordingly, in order to comply with management's responsibility to ensure that the entity's operations are conducted in accordance with the provisions of laws and regulations to which the entity is subject, management are required, with oversight from those charged with governance, to design, implement and maintain adequate controls over compliance with laws and regulations. In their oversight role, those charged with governance monitor how management is discharging its responsibility for such controls.

A11-12In obtaining the understanding required by paragraphs 12-2(c)-(e), the auditor considers the processes, controls and governance arrangements established by management and those charged with governance to identify, monitor and address non-compliance with laws and regulations. This understanding assists the auditor in obtaining an understanding of the entity and its system of internal control relevant to the identification and assessment of risks of material misstatement arising from non-compliance with laws and regulations.

A11-13Matters that may assist the auditor in obtaining this understanding include:

How management identifies laws and regulations applicable to the entity.
The processes established to monitor compliance with those laws and regulations.
The manner in which actual or suspected instances of non-compliance are identified, investigated and addressed.
The role of those charged with governance in overseeing compliance matters.
Reports prepared by internal audit, compliance, legal, risk management or other monitoring functions.
Known deficiencies in processes, controls or governance arrangements relating to compliance with laws and regulations.

A11-14Information obtained about deficiencies in the entity's processes, controls, or the manner in which those charged with governance exercise oversight over compliance with laws and regulations may be relevant to the auditor's identification and assessment of risks of material misstatement arising from non-compliance with laws and regulations. Such deficiencies may inform the auditor's evaluation of whether actual or potential non-compliance has a reasonable possibility of resulting in a material misstatement of the financial statements. Where deficiencies in internal control are identified, the auditor considers the requirements of ISA (UK) 265 regarding communication of deficiencies in internal control to those charged with governance and management.²¹

Inquiries (Ref: Para. 12-3(a))

A11-15The auditor's inquiries of appropriate individuals within the entity may include those within the internal audit function or a regulatory compliance function, for example.

Legal Confirmations (Ref: Para. 12-3(b)(ii))

A11-16ISA (UK) 330 (Revised July 2017) requires the auditor to consider whether external confirmation procedures are to be performed as part of the audit.²² ISA (UK) 501 sets out the auditor's requirements to identify litigations and claims involving the entity which may give rise to a risk of material misstatement.²³

Remaining Alert Throughout the Audit for Indications of Non-Compliance (Ref: Para. 13-1)

A12-1The following matters may be an indication of non-compliance with laws and regulations:

Investigations by regulatory organizations and government departments or payment of fines or penalties.
Payments for unspecified services or loans to consultants, related parties, employees or government employees.
Sales commissions or agent's fees that appear excessive in relation to those ordinarily paid by the entity or in its industry or to the services actually received.
Purchasing at prices significantly above or below market price.
Unusual payments in cash, purchases in the form of cashiers' cheques payable to bearer or transfers to numbered bank accounts.
Unusual transactions with companies registered in tax havens.
Payments for goods or services made other than to the country from which the goods or services originated.
Payments without proper exchange control documentation.
Existence of an information system which fails, whether by design or by accident, to provide an adequate audit trail or sufficient evidence.
Unauthorized transactions or improperly recorded transactions.
Adverse media comment.

A12-2The auditor may become aware of information concerning an instance of non-compliance with laws and regulations other than as a result of performing the procedures required by this ISA (UK) (e.g., when the auditor is alerted to non-compliance by a whistleblower).

A12-3Where management or those charged with governance have informed the auditor of an instance of identified or suspected non-compliance with laws and regulations (e.g., in response to the inquiries made in paragraph 12-3(a), through written representations in accordance with paragraph 17 or some other means), the requirements in paragraphs 19–29-1 apply.

Information From Other Sources

A13-1In applying ISA (UK) 315 (Revised July 2020), the auditor considers whether information from other sources obtained by the auditor indicates that there may be identified or suspected non-compliance with laws and regulations.

A13-2Information obtained from other sources may also be relevant to the identification of risks of material misstatement of the financial statements due to non-compliance with laws and regulations, for example, by providing information and insights about the entity and the industry in which it operates and the regulatory framework to which it is subject.

Non-Compliance Brought to the Auditor's Attention by Other Audit Procedures

A14-1Audit procedures applied to form an opinion on the financial statements may bring instances of non-compliance or suspected non-compliance with laws and regulations to the auditor's attention. For example, such audit procedures may include:

Reading minutes;
Inquiring of the entity's management and in-house legal counsel or external legal counsel concerning litigation, claims and assessments; and
Performing substantive tests of details of classes of transactions, account balances or disclosures.

Identifying and Assessing the Risks of Material Misstatement Arising From Non-Compliance (Ref: Para. 14-1)

A15-1As explained in ISA (UK) 315 (Revised July 2020),²⁴ the identification of risks of material misstatement is performed before consideration of any related controls, and is based on the auditor's preliminary consideration of misstatements that have a reasonable possibility of both occurring, and being material if they were to occur.

A15-2In determining whether there is a risk of material misstatement arising from non-compliance with laws and regulations, the auditor takes into account whether there are:

Inherent risk factors or fraud risk factors that affect the susceptibility of relevant assertions to misstatements due to fraud or error as a result of non-compliance with laws and regulations.
Indicators of non-compliance or suspected non-compliance with laws and regulations.

A15-3Factors that the auditor may consider in determining whether there is a reasonable possibility of a risk of material misstatement arising from non-compliance with laws and regulations include:

Identified or suspected instances of non-compliance with laws and regulations.
Allegations, investigations, inspections, regulatory enquiries or enforcement activity by regulators or other authorities.
Litigation, claims, complaints or whistleblowing reports that may indicate non-compliance.
Prior instances of non-compliance by the entity or within the industry, particularly where similar circumstances continue to exist.
Significant changes in laws, regulations or regulatory expectations affecting the entity.
Business activities, transactions or arrangements that are subject to significant regulatory requirements, judgment or interpretation.
Significant deficiencies in the entity's processes, controls or governance arrangements designed to identify, prevent or detect non-compliance.
Incentives or pressures on management that may increase the likelihood of intentional non-compliance.
Indications that management or those charged with governance may not have appropriately identified or assessed the consequences of actual or potential non-compliance.
Circumstances where non-compliance could reasonably be expected to result in material fines, penalties, remediation costs, compensation payments, loss of license, restrictions on operations, significant reputational damage, going concern implications, or material financial statement disclosures.

The existence of one or more of these factors does not, by itself, indicate that a risk of material misstatement exists. The auditor exercises professional judgment in evaluating whether, individually or in combination, the factors indicate a reasonable possibility that non-compliance could result in a material misstatement of the financial statements.

A15-4In the absence of identified or suspected non-compliance, a risk of material misstatement arising from non-compliance relating to laws and regulations that are fundamental to the operating aspects of the entity would ordinarily arise only when events or conditions identified through the auditor's understanding of the entity and its environment²⁵ indicate that there is a reasonable possibility that non-compliance could occur and result in a material misstatement of the financial statements.

A15-5Where the auditor becomes aware of an instance of non-compliance or suspected non-compliance with laws and regulations, the auditor complies with the additional requirements in paragraphs 19–29-1. Where the non-compliance is intentional, then the auditor also considers whether the requirements in ISA (UK) 240 (Revised March 2026) apply.

Responses to the Assessed Risks of Material Misstatement Arising From Non-Compliance (Ref: Para. 15-1)

A15-6In designing and performing audit procedures responsive to an assessed risk of material misstatement arising from non-compliance with laws and regulations, the auditor applies ISA (UK) 330 (Revised July 2017) and designs procedures that are responsive to the nature of the identified risk. The nature, timing and extent of the auditor's response will depend on the circumstances and on how actual or potential non-compliance could give rise to a material misstatement in the financial statements. Procedures may be directed towards obtaining audit evidence about the financial statement consequences of actual or potential non-compliance, the entity's processes for identifying and addressing compliance obligations, or both.

A15-7In some circumstances, substantive procedures directed at the financial statement consequences of actual or potential non-compliance may provide sufficient appropriate audit evidence regarding the assessed risk of material misstatement. However, particularly where the assessed risk relates to non-compliance with a law or regulation that is fundamental to the operating aspects of the entity or to the entity's ability to continue its business which could result in a material misstatement of the financial statements, substantive procedures alone may not be sufficient.²⁶ The auditor may need to obtain audit evidence regarding the design, implementation and, where relevant, operating effectiveness of controls, or perform other procedures directed at the entity's processes for identifying, monitoring and addressing compliance with the relevant law or regulation, where this is relevant to evaluating the assessed risk of material misstatement. As explained in paragraph 4-1, the auditor's objective is to obtain sufficient appropriate audit evidence regarding the assessed risk of material misstatement in the financial statements, rather than to provide assurance on the entity's compliance with laws and regulations generally.

A15-8The nature of the auditor's response will vary depending on the circumstances and the assessed risk. Examples may include:

Testing transactions, balances or disclosures that may be affected by actual or potential non-compliance.
Evaluating management's assessment of the financial statement consequences of actual or potential non-compliance, including provisions, contingent liabilities and disclosures.
Understanding and evaluating management's processes for identifying, monitoring and addressing compliance with relevant laws and regulations.
Testing the design and implementation of controls, and where appropriate their operating effectiveness.
Inspecting reports prepared by internal audit, compliance, legal or other monitoring functions.
Obtaining information from regulators, legal advisers, external specialists or other third parties where appropriate.
Involving individuals with specialized legal, regulatory or industry expertise.
Performing additional procedures in response to identified or suspected instances of non-compliance.

A15-9In responding to an assessed risk of material misstatement arising from non-compliance with laws and regulations, the auditor may determine that specialized skills or knowledge are necessary to obtain sufficient appropriate audit evidence. This may be the case where the nature of the law or regulation, the complexity of the identified risk, or the circumstances of identified or suspected non-compliance require expertise beyond that ordinarily expected of an auditor. The auditor's objective in involving such expertise remains obtaining sufficient appropriate audit evidence regarding the assessed risk of material misstatement in the financial statements.

Evaluating the Audit Evidence Obtained (Ref: Para. 16-1)

A15-10The auditor's judgment as to what constitutes sufficient appropriate audit evidence is influenced by such factors as:

The significance of any potential non-compliance with laws and regulations and the likelihood of it having a material effect on the financial statements.
The effectiveness of management's response and controls to address non-compliance with laws and regulations.
The results of the audit procedures performed, including whether such audit procedures identified actual or suspected non-compliance with laws and regulations.
The persuasiveness of the audit evidence.
The nature and reliability of information obtained from management, those charged with governance, regulators, legal advisers or other external parties.
Whether the audit evidence obtained is consistent with other information obtained during the audit, including information indicating possible non-compliance with laws and regulations.
The degree of uncertainty surrounding whether non-compliance has occurred and the significance of the potential consequences for the financial statements.
The extent to which identified or suspected non-compliance gives rise to questions regarding the integrity of management or those charged with governance.
The complexity of the legal or regulatory requirements relevant to the matter and whether the auditor has determined that specialized skills or knowledge are necessary to evaluate the audit evidence obtained.
The likelihood that identified or suspected non-compliance could give rise to material liabilities, provisions, contingent liabilities, disclosures, regulatory restrictions or going concern implications in the financial statements.

The auditor's evaluation focuses on whether sufficient appropriate audit evidence has been obtained regarding the assessed risks of material misstatement in the financial statements arising from non-compliance with laws and regulations.

A15-11As explained in ISA (UK) 330 (Revised July 2017), when obtaining more persuasive audit evidence because of a higher assessment of risk, the auditor may increase the quantity of the evidence, or obtain evidence that is more relevant or reliable, for example, by placing more emphasis on obtaining third party evidence.²⁷

Written Representations (Ref: Para. 17)

A16Because the effect on financial statements of laws and regulations can vary considerably, written representations provide necessary audit evidence about management's knowledge of identified or suspected non-compliance with laws and regulations, whose effects may have a material effect on the financial statements. However, written representations do not provide sufficient appropriate audit evidence on their own and, accordingly, do not affect the nature and extent of other audit evidence that is to be obtained by the auditor.²⁸

Audit Procedures When Non-Compliance Is Identified or Suspected

Matters Relevant to the Auditor's Understanding of the Nature of the Act and Circumstances in Which It Has Occurred (Ref: Para. 19(a))

A17-1Obtaining an understanding of the nature of the act and the circumstances in which it has occurred may include:

Examining supporting documentation about relevant events or transactions.
Making inquiries of management, and where appropriate those charged with governance, and of other appropriate individuals within the entity who are likely to have knowledge of relevant matters.
Obtaining an understanding of the nature and status of investigations by regulatory organizations and government departments or payment of fines or penalties.
Confirming significant information concerning the events or transactions with intermediaries, financial institutions, legal counsel, or others who may have relevant knowledge.
Determining whether a transaction has been properly authorized by management and, where appropriate, those charged with governance.
Determining whether similar events or transactions may have occurred.
Discussing the facts and circumstances with the entity's legal counsel or others with specialized skill or knowledge about the application of the laws and regulations to the circumstances and the possible effects on the financial statements.
Considering the results of other audit procedures related to the matter.

A17-2The extent of procedures necessary depends on factors such as:

The nature and circumstances of the matter (i.e., the information indicating that non-compliance or possible non-compliance has occurred).
The relevance and reliability of information provided by the entity about the matter.
The effectiveness of management's process for investigating the matter.

A18-1Where the auditor determines that the identified or suspected non-compliance with laws and regulations is intentional, the requirements in ISA (UK) 240 (Revised March 2026) apply.²⁹

Matters Relevant to the Auditor's Evaluation (Ref: Para. 19(b))

A19Matters relevant to the auditor's evaluation³⁰ of the possible effect on the financial statements include:

The potential financial consequences of identified or suspected non-compliance with laws and regulations on the financial statements including, for example, the imposition of fines, penalties, damages, threat of expropriation of assets,³¹ enforced discontinuation of operations, and litigation.
Whether the potential financial consequences require disclosure.
Whether the potential financial consequences are so serious as to call into question the fair presentation of the financial statements, or otherwise make the financial statements misleading.

Audit Procedures and Communicating Identified or Suspected Non-Compliance with Management and Those Charged with Governance (Ref: Para. 20)

A20The auditor is required to discuss the suspected non-compliance with the appropriate level of management and, where appropriate, with those charged with governance, as they may be able to provide additional audit evidence. For example, the auditor may confirm that management and, where appropriate, those charged with governance have the same understanding of the facts and circumstances relevant to transactions or events that have led to the suspected non-compliance with laws and regulations.

A21However, in some jurisdictions, law or regulation may restrict the auditor's communication of certain matters with management and those charged with governance. Law or regulation may specifically prohibit a communication, or other action, that might prejudice an investigation by an appropriate authority into an actual, or suspected, illegal act, including alerting the entity, for example, when the auditor is required to report the identified or suspected non-compliance to an appropriate authority pursuant to anti-money laundering legislation. In these circumstances, the issues considered by the auditor may be complex and the auditor may consider it appropriate to obtain legal advice.

A21-1In the UK, the auditor is subject to compliance with legislation relating to 'tipping off'. 'Tipping off' is an offence under Section 333A of the Proceeds of Crime Act 2002 (POCA). It arises when an individual discloses that:

A report (internal or external) has already been made where the disclosure by the individual is likely to prejudice an investigation which might be conducted following the internal or external report that has been made; or
An investigation is being contemplated or is being carried out into allegations that a money laundering offence has been committed and the disclosure by the individual is likely to prejudice that investigation.

Whilst 'tipping off' requires a person to have knowledge or suspicion that a report has been or will be made, a further offence of prejudicing an investigation is included in Section 342 of the POCA. Under this provision, it is an offence to make any disclosure which may prejudice an investigation of which a person has knowledge or suspicion, or to falsify, conceal, destroy or otherwise dispose of, or cause or permit the falsification, concealment, destruction or disposal of, documents relevant to such an investigation.

The disclosure offences under Sections 333A and 342 of the POCA are not committed if the person disclosing does not know or suspect that it is likely to prejudice an investigation.

A22If management or, as appropriate, those charged with governance do not provide sufficient information to the auditor that the entity is in fact in compliance with laws and regulations, the auditor may consider it appropriate to consult with the entity's in-house or external legal counsel about the application of the laws and regulations to the circumstances, including the possibility of fraud, and the possible effects on the financial statements. If it is not considered appropriate to consult with the entity's legal counsel or if the auditor is not satisfied with the legal counsel's opinion, the auditor may consider it appropriate to consult on a confidential basis with others within the firm, a network firm, a professional body, or with the auditor's legal counsel as to whether a contravention of a law or regulation is involved, including the possibility of fraud, the possible legal consequences, and what further action, if any, the auditor would take.

Evaluating the Implications of Identified or Suspected Non-Compliance (Ref: Para. 22)

A23As required by paragraph 22, the auditor evaluates the implications of identified or suspected non-compliance in relation to other aspects of the audit, including the auditor's risk assessment and the reliability of written representations. The implications of particular identified or suspected non-compliance will depend on the relationship of the perpetration and concealment, if any, of the act to specific controls and the level of management or individuals working for, or under the direction of, the entity involved, especially implications arising from the involvement of the highest authority within the entity. As noted in paragraph 9, the auditor's compliance with law, regulation or relevant ethical requirements may provide further information that is relevant to the auditor's responsibilities in accordance with paragraph 22.

A23-1Where the auditor identifies or suspects non-compliance with laws and regulations, the auditor may determine that a deficiency in internal control exists. In such circumstances, the requirements in ISA (UK) 265 apply.³²

A23-2In some circumstances, the implications of identified or suspected non-compliance may impact the entity's ability to continue as a going concern or the auditor may conclude that a material uncertainty exists related to identified or suspected non-compliance that may cast significant doubt on the entity's ability to continue as a going concern. In such circumstances, the requirements in ISA (UK) 570 (Revised March 2026) apply.³³

A24Examples of circumstances that may cause the auditor to evaluate the implications of identified or suspected non-compliance on the reliability of written representations received from management and, where applicable, those charged with governance include when:

The auditor suspects or has evidence of the involvement or intended involvement of management and, where applicable, those charged with governance in any identified or suspected non-compliance.
The auditor is aware that management and, where applicable, those charged with governance have knowledge of such non-compliance and, contrary to legal or regulatory requirements, have not reported, or authorized reporting of, the matter to an appropriate authority within a reasonable period.

A25In certain circumstances, the auditor may consider withdrawing from the engagement, where permitted by law or regulation, for example when management or those charged with governance do not take the remedial action that the auditor considers appropriate in the circumstances or the identified or suspected non-compliance raises questions regarding the integrity of management or those charged with governance, even when the non-compliance is not material to the financial statements. The auditor may consider it appropriate to obtain legal advice to determine whether withdrawal from the engagement is appropriate. When the auditor determines that withdrawing from the engagement would be appropriate, doing so would not be a substitute for complying with other responsibilities under law, regulation or relevant ethical requirements to respond to identified or suspected non-compliance. Furthermore, paragraph A55 of ISA (UK) 220 (Revised July 2021)³⁴ indicates that some ethical requirements may require the predecessor auditor, upon request by the proposed successor auditor, to provide information regarding non-compliance with laws and regulations to the successor auditor.

A25-1Withdrawal from the engagement by the auditor is a step of last resort. It is normally preferable for the auditor to remain in office to fulfil the auditor's statutory duties, particularly where minority interests are involved. However, there are circumstances where there may be no alternative to withdrawal, for example, where management or those charged with governance refuse to issue an entity's financial statements or the auditor wishes to inform the shareholders or creditors of the entity of the auditor's concerns and there is no immediate occasion to do so.

A25-2If the auditor determines that continued holding of office is untenable or the auditor is removed from office by the entity, the auditor will be mindful of the auditor's reporting duties.³⁵

Concluding and Adequacy of Disclosures (Ref: Para. 22-1)

A25-3When considering whether the financial statements appropriately reflect the consequences of any identified or suspected non-compliance with laws and regulations, the auditor has regard to the requirements of the applicable financial reporting framework. Identified or suspected non-compliance with laws and regulations may give rise to the recognition or disclosure of liabilities, provisions, contingent liabilities, impairments, going concern uncertainties or other disclosures in the financial statements. The auditor's consideration of these matters may include management's assessment of whether the criteria for recognition or disclosures have been met, and whether significant estimates and judgments applied in measuring recognized amounts and determining related disclosures are appropriate in the circumstances.

Communicating and Reporting Identified or Suspected Non-Compliance

Communicating Identified or Suspected Non-Compliance with Those Charged with Governance (Ref: Para. 23–24)

A25-4For audits of financial statements of public interest entities, ISA (UK) 260 (Revised November 2019)³⁶ requires the auditor to communicate in the additional report to the audit committee any significant matters involving identified or suspected non-compliance with laws and regulations or articles of association which were identified in the course of the audit.

A25-5In the UK, laws or regulations may prohibit alerting ('tipping off') the entity when, for example, the auditor is required to report the identified or suspected non-compliance with laws and regulations to an appropriate authority outside the entity pursuant to anti-money laundering legislation.

A25-6If non-compliance with laws and regulations is intentional but not material the auditor considers whether the nature and circumstances make it appropriate to communicate the matter with those charged with governance as soon as practicable.

Suspicion that Management or Those Charged with Governance are Involved in Non-Compliance (Ref: Para. 25)

A25-7In the case of suspected money laundering it may be appropriate to report the matter direct to an appropriate authority outside the entity (see paragraph A28).

Potential Implications of Identified or Suspected Non-Compliance for the Auditor's Report (Ref: Para. 26-28)

A26Identified or suspected non-compliance with laws and regulation is communicated in the auditor's report when the auditor modifies the opinion in accordance with paragraphs 26–28. In certain other circumstances, the auditor may communicate identified or suspected non-compliance in the auditor's report, for example:

When the auditor has other reporting responsibilities, in addition to the auditor's responsibilities under the ISAs (UK), as contemplated by paragraph 43 of ISA (UK) 700 (Revised May 2026);
When the auditor determines that the identified or suspected non-compliance is a key audit matter and accordingly communicates the matter in accordance with ISA (UK) 701 (Revised May 2026),³⁷ unless paragraph 14 of that ISA (UK) applies; or
In exceptional cases when management or those charged with governance do not take the remedial action that the auditor considers appropriate in the circumstances and withdrawal from the engagement is not possible (see paragraph A25), the auditor may consider describing the identified or suspected non-compliance in an Other Matter paragraph in accordance with ISA (UK) 706 (Revised June 2016).³⁸

A26-1If the auditor concludes that the view given by the financial statements could be affected by a level of uncertainty concerning the consequences of identified or suspected non-compliance with laws and regulations which, in the auditor's professional judgment, is significant, the auditor, subject to a consideration of 'tipping off' (see paragraph A21-1), includes an explanatory paragraph referring to the matter in the auditor's report.

A27Law or regulation may preclude public disclosure by either management, those charged with governance or the auditor about a specific matter. For example, law or regulation may specifically prohibit a communication, or other action, that might prejudice an investigation by an appropriate authority into an actual, or suspected, illegal act, including a prohibition on alerting the entity. When the auditor intends to communicate identified or suspected non-compliance in the auditor's report under the circumstances set out in paragraph A26 or otherwise, such law or regulation may have implications for the auditor's ability to describe the matter in the auditor's report, or in some circumstances to issue the auditor's report. In such cases, the auditor may consider obtaining legal advice to determine the appropriate course of action.

Reporting Identified or Suspected Non-Compliance to an Appropriate Authority Outside the Entity (Ref: Para. 29)

A28Reporting identified or suspected non-compliance with laws and regulations to an appropriate authority outside the entity may be required or appropriate in the circumstances because:

Law, regulation or relevant ethical requirements require the auditor to report (see paragraphs A29–A29-3);
The auditor has determined reporting is an appropriate action to respond to identified or suspected non-compliance in accordance with relevant ethical requirements (see paragraph A30);
Law, regulation or relevant ethical requirements provide the auditor with the right to do so (see paragraph A31); or
The matter may be one that ought to be reported in the public interest (see paragraphs A33-1).

A29In some jurisdictions, the auditor may be required by law, regulation or relevant ethical requirements to report identified or suspected non-compliance with laws and regulations to an appropriate authority outside the entity. For example, in some jurisdictions, statutory requirements exist for the auditor of a financial institution to report the occurrence, or suspected occurrence, of non-compliance with laws and regulations to a supervisory authority. Also, misstatements may arise from non-compliance with laws or regulations and, in some jurisdictions, the auditor may be required to report misstatements to an appropriate authority in cases where management or those charged with governance fail to take corrective action.

A29-1Anti-money laundering legislation in the UK imposes a duty on the auditor to report suspected money laundering activity. There are similar laws and regulations relating to financing terrorist offences.³⁹ The impact on the auditor of this legislation can broadly be summarized as follows:

Partners and staff in the firm are required to report suspicions of conduct which would constitute a criminal offence which gives rise to direct or indirect benefit; and
Partners and staff in the firm need to be alert to the dangers of 'tipping off' as this will constitute a criminal offence under the anti-money laundering legislation.

A29-2For auditors of public interest entities and certain other entities subject to statutory regulation,⁴⁰ laws and regulations establish separate responsibilities for the auditor to report certain information direct to an appropriate authority outside the entity. Standards and guidance on responsibilities for auditors of public interest entities is given in ISA (UK) 270⁴¹ and relevant FRC Practice Notes.

A29-3The procedures and guidance in ISA (UK) 270⁴¹ can be adapted to circumstances in which the auditor of other types of entity identifies or suspects non-compliance with laws and regulations which the auditor is under a statutory duty to report.

A30In other cases, the relevant ethical requirements may require the auditor to determine whether reporting identified or suspected non-compliance with laws and regulations to an appropriate authority outside the entity is an appropriate action in the circumstances. For example, the IESBA Code requires the auditor to take steps to respond to identified or suspected non-compliance with laws and regulations and determine whether further action is needed, which may include reporting to an appropriate authority outside the entity.⁴² The IESBA Code explains that such reporting would not be considered a breach of the duty of confidentiality under the IESBA Code.⁴³

UK auditors are subject to ethical requirements from two sources: the FRC's Ethical Standard concerning the integrity, objectivity and independence of the auditor, and the ethical pronouncements established by the auditor's relevant professional body, which may include ethical requirements to determine whether reporting identified or suspected non-compliance with laws and regulations to an appropriate authority outside the entity is an appropriate action in the circumstances.

A31Even if law, regulation or relevant ethical requirements do not include requirements that address reporting identified or suspected non-compliance, they may provide the auditor with the right to report identified or suspected non-compliance to an appropriate authority outside the entity. For example, when auditing the financial statements of financial institutions, the auditor may have the right under law or regulation to discuss matters such as identified or suspected non-compliance with laws and regulations with a supervisory authority.

A32In other circumstances, the reporting of identified or suspected non-compliance with laws and regulations to an appropriate authority outside the entity may be precluded by the auditor's duty of confidentiality under law, regulation or relevant ethical requirements.

A33The determination required by paragraph 29 may involve complex considerations and professional judgments. Accordingly the auditor may consider consulting internally (e.g., within the firm or a network firm) or on a confidential basis with a regulator or professional body (unless doing so is prohibited by law or regulation or would breach the duty of confidentiality). The auditor may also consider obtaining legal advice to understand the auditor's options and the professional or legal implications of taking any particular course of action.

Reporting in the Public Interest

A33-1Where the auditor has identified or suspects non-compliance with laws and regulations which does not give rise to a responsibility under law, regulation or relevant ethical requirements to report to an appropriate authority outside the entity, the auditor considers whether the matter may be one that ought to be reported in the public interest to an appropriate authority outside the entity. In these circumstances, the auditor uses the guidance in ISA (UK) 270⁴⁴ and adapts it to the circumstances in which the auditor of other types of entity identifies or suspects non-compliance with laws and regulations.

Considerations Specific to Public Sector Entities

A34A public sector auditor may be obliged to report on identified or suspected non-compliance to the legislature or other governing body or to report them in the auditor's report.

Timing of Reports

A34-1Laws and regulations may stipulate a period within which reports are to be made. If the auditor becomes aware of identified or suspected non-compliance with laws and regulations which give rise to a statutory duty to report, the auditor complies with any such stipulated periods for reporting. Ordinarily the auditor makes a report to an appropriate authority outside the entity as soon as practicable.

Reporting to Authorities of Public Interest Entities (Ref: Para. 29-1)

A34-2The disclosure in good faith to the authorities responsible for investigating such irregularities, by the auditor, of any irregularities referred to in paragraph 29-1 shall not constitute a breach of any contractual or legal restriction on disclosure of information in accordance with UK legislation.⁴⁵

A34-3The auditor considers whether to take further action when the entity investigates the matter referred to in paragraph 23-1 but where the measures taken by management or those charged with governance, in the auditor's professional judgment, were not appropriate to deal with the irregularities identified or would fail to prevent future occurrences.

Documentation (Ref: Para. 29-2–30)

A35The auditor's documentation of findings regarding identified or suspected non-compliance with laws and regulations may include, for example:

Copies of records or documents.
Minutes of discussions held with management, those charged with governance or parties outside the entity.

A36Law, regulation or relevant ethical requirements may also set out additional documentation requirements regarding identified or suspected non-compliance with laws and regulations.⁴⁶

In the UK, the auditor has regard to any specific requirements of the auditor's relevant professional body.

Contact Information

Financial Reporting Council

London office: 13th Floor, 1 Harbour Exchange Square, London, E14 9GE

Birmingham office: 5th Floor, 3 Arena Central, Bridge Street, Birmingham, B1 2AX

+44 (0)20 7492 2300 www.frc.org.uk

Footnotes

ISA (UK) 200 (Revised June 2016), paragraph 17. ↩
ISA (UK) 200 (Revised June 2016), paragraph A54. ↩
ISA (UK) 315 (Revised July 2020), Identifying and Assessing the Risks of Material Misstatement, paragraph 19. ↩
ISA (UK) 260 (Revised November 2019), Communication with Those Charged with Governance, paragraph 13. ↩
ISA (UK) 705 (Revised June 2016), Modifications to the Opinion in the Independent Auditor's Report, paragraphs 7-8. ↩
ISA (UK) 705 (Revised June 2016), paragraphs 7 and 9. ↩
ISA (UK) 230 (Revised June 2016), Audit Documentation, paragraphs 8-11, and A6. ↩
In the UK, under Section 499-501 of the Companies Act 2006. ↩
ISA (UK) 700 (Revised May 2026), Forming an Opinion and Reporting on Financial Statements, paragraph 43. ↩
ISA (UK) 800 (Revised) Special Considerations—Audits of Financial Statements Prepared in Accordance with Special Purpose Frameworks, paragraph 11. ↩
See, for example, paragraphs R360.16–360.18 A2 of the IESBA Code. ↩
ISA (UK) 220 (Revised July 2021), paragraphs 25–28. ↩
ISA (UK) 315 (Revised July 2020), paragraph A85. ↩
See ISA (UK) 570 (Revised March 2026), Going Concern. ↩
Such requirements exist in the UK under the Financial Services and Markets Act 2000. ↩
'Money laundering' is defined in UK legislation and in general terms involves an act which conceals, disguises, converts, transfers, removes, uses, acquires or possesses property resulting from criminal conduct. ↩
In the UK, under Section 830 of the Companies Act 2006. ↩
In the UK, under Section 498 of the Companies Act 2006. ↩
In the UK, under Section 497 of the Companies Act 2006. ↩
ISA (UK) 210 (revised June 2016), paragraph 6(b). ↩
ISA (UK) 265, Communicating Deficiencies in Internal Control to Those Charged With Governance and Management, paragraphs 9-10. ↩
ISA (UK) 330 (Revised July 2017), The Auditor's Responses to Assessed Risks, paragraph 19. ↩
ISA (UK) 501, paragraphs 9-11. ↩
ISA (UK) 315 (Revised July 2020), paragraph A186. ↩
ISA (UK) 315 (Revised July 2020), paragraph A85. ↩
ISA (UK) 330 (Revised July 2017), paragraph 8(b). ↩
ISA (UK) 330 (Revised July 2017), paragraph A19. ↩
ISA (UK) 580, Written Representations, paragraph 4. ↩
ISA (UK) 240 (Revised March 2026), The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements. ↩
ISA (UK) 620 (Revised September 2026), Using the Work of an Auditor's Expert applies if the auditor judges it necessary to obtain appropriate expert advice in connection with the evaluation of the possible effect of legal matters on the financial statements. ↩
In the UK, the Proceeds of Crime Act 2002 provides procedures to enable the authorities to confiscate in criminal proceedings or bring an action for civil recovery of assets which represent the benefits of criminal conduct. ↩
ISA (UK) 265, paragraph 8. ↩
ISA (UK) 570 (Revised March 2026), Going Concern. ↩
ISA (UK) 220 (Revised July 2021), Quality Management for an Audit of Financial Statements. ↩
In the UK, under Part 16 of the Companies Act 2006. ↩
ISA (UK) 260 (Revised November 2019), paragraph 16-2(k). ↩
ISA (UK) 701 (Revised May 2026), Communicating Key Audit Matters in the Independent Auditor's Report. ↩
ISA (UK) 706 (Revised June 2016), Emphasis of Matter Paragraphs and Other Matter Paragraphs in the Independent Auditor's Report. ↩
In the UK, the Terrorism Act 2000 contains reporting requirements for the laundering of terrorist funds which include any funds that are likely to be used for the financing of terrorism. ↩
Auditors of public interest entities and other entities in the financial sector, pension schemes and charities have a statutory responsibility, subject to compliance with legislation relating to 'tipping off' (see paragraph A21-1), to report matters that are likely to be of material significance to the regulator. ↩
ISA (UK) 270, Special Considerations for Audits of Public Interest Entities—Communicating and Reporting to an Appropriate Authority Outside the Entity. ↩↩
See, for example, paragraphs 360.21 A1 and 360.25 A1-R360.27 of the IESBA Code. ↩
See, for example, paragraphs R114.1–114.1 A3 and R360.26 of the IESBA Code. ↩
ISA (UK) 270, paragraphs A47-A56. ↩
The Statutory Auditors and Third Country Auditors (Amendment) (EU Exit) Regulations 2019. ↩
See, for example, paragraph R360.28 of the IESBA Code. ↩

File

Name ISA (UK) 250 (Revised September 2026)

Publication date 29 October 2026

Type Standard

Format PDF, 741.2 KB

Download original

ISA (UK) 250 (Revised September 2026)

Footnotes

File

Is this page useful?