Warning

The content on this page has been converted from PDF to HTML format using an artificial intelligence (AI) tool as part of our ongoing efforts to improve accessibility and usability of our publications. Note:

  • No human verification has been conducted of the converted content.
  • While we strive for accuracy errors or omissions may exist.
  • This content is provided for informational purposes only and should not be relied upon as a definitive or authoritative source.
  • For the official and verified version of the publication, refer to the original PDF document.

If you identify any inaccuracies or have concerns about the content, please contact us at [email protected].

ISA (UK) 270 (September 2026)

The Financial Reporting Council (FRC) is the UK's independent regulator responsible for promoting transparency and integrity in business. The FRC sets the UK Corporate Governance and Stewardship Codes and UK standards for accounting and actuarial work; monitors and takes action to promote the quality of corporate reporting; and operates independent enforcement arrangements for accountants and actuaries. As the Competent Authority for audit in the UK the FRC sets auditing and ethical standards and monitors and enforces audit quality.

The FRC does not accept any liability to any party for any loss, damage or costs howsoever arising, whether directly or indirectly, whether in contract, tort or otherwise from an action or decision taken (or not taken) as a result of any person relying on or otherwise using this document or arising from any omission from it.

The Financial Reporting Council Limited 2026 The Financial Reporting Council Limited is a company limited by guarantee. Registered in England number 2486368. Registered Office: 13th Floor, 1 Harbour Exchange Square, London E14 9GE

Contents

International Standard on Auditing (UK) (ISA (UK)) 270, Special Considerations for Auditors of Public Interest Entities—Communicating And Reporting To An Appropriate Authority Outside The Entity, should be read in conjunction with ISA (UK) 200 (Revised June 2016), Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing (UK).

Introduction

Scope of this ISA (UK)

1This International Standard on Auditing (UK) (ISA (UK)) deals with the auditor's responsibility to consider whether law, regulation or relevant ethical requirements:

  1. Requires the auditor of a Public Interest Entity to report to an appropriate authority outside the entity; or
  2. Establishes responsibilities under which reporting to an appropriate authority outside the entity may be appropriate in the circumstances,

in respect of information that comes to the auditor's attention during the course of the audit.

2This ISA (UK) applies to audits of financial statements of public interest entities.

3An auditor of an entity that is not a public interest entity may find this ISA (UK), adapted as necessary, useful when that auditor is required by law, regulation or relevant ethical requirements to report to an appropriate authority outside the entity. For example:

  • All auditors have additional responsibilities that arise as a result of money laundering, terrorist financing and proceeds of crime legislation which may require them to make a report to an appropriate authority outside the entity. 1
  • Auditors of charities are required to report matters of material significance and to consider whether to report matters that are relevant to UK charity regulators.
  • Relevant ethical requirements require the auditor to take steps to respond to identified or suspected non-compliance with laws and regulations and determine whether further action is needed, which may include reporting to an appropriate authority outside the entity.2

Responsibility for Compliance With Laws and Regulations

4As explained in ISA (UK) 250 (Revised September 2026),3 it is the responsibility of management, with the oversight of those charged with governance, to ensure that the entity's operations are conducted in accordance with the provisions of laws and regulations to which the public interest entity is subject.

5However, the auditor is responsible for ensuring that the audit is conducted in accordance with applicable law and regulation. For example, the auditor may be required to comply with additional legal or regulatory requirements that arise from being appointed as the auditor to a public interest entity which is regulated by an authority outside the entity.

Communicating and Reporting to an Appropriate Authority Outside the Entity

6Law, regulation or ethical requirements may establish requirements or responsibilities for the auditor to report certain information that comes to the auditor's attention during the course of the audit to an appropriate authority outside the entity. These requirements or responsibilities may arise because law, regulation or relevant ethical requirements:

  • Require the auditor, or provide the auditor with a right, to report.
  • Establish responsibilities or rights under which reporting to an appropriate authority outside the entity is appropriate in the circumstances.

7Whilst law, regulation or ethical requirements may confer a responsibility or right to report to an appropriate authority outside the entity, they do not usually impose a responsibility for the auditor to carry out specific work. Accordingly, this ISA (UK) is premised on the basis that no additional audit procedures, other than those undertaken as part of the audit, are necessary for the fulfilment of these responsibilities.

8Law or regulation may impose additional obligations on the auditor in relation to communicating and reporting to an appropriate authority outside the entity that are beyond the scope of this ISA (UK). However, an auditor may find this ISA (UK), adapted as necessary in the circumstances, useful when the auditor has a responsibility to provide a report on matters specified in law or regulation to an authority outside the entity.

Effective Date

9This ISA (UK) is effective for audits of financial statements of public interest entities for periods commencing on or after 15 December 2027.

Objective

10The objective of the auditor of a public interest entity is to respond appropriately to information about which the auditor becomes aware during the audit that may require the auditor to report to an appropriate authority outside the entity.

Definitions

11For the purposes of this ISA (UK), the following terms have the meanings attributed below:

  1. Public interest entity – Is defined in UK legislation4 as:
    1. An issuer whose transferable securities are admitted to trading on a UK regulated market;5
    2. A credit institution within the meaning given by Article 4(1)(1) of Regulation (EU) No. 575/2013 of the European Parliament and of the Council, which is a CRR firm within the meaning of Article 4(1)(2A) of that Regulation;
    3. A person who would be an insurance undertaking as defined in by Article 2(1) of Council Directive 91/674/EEC of 19 December 1991 of the European Parliament and of the Council on the annual accounts and consolidated accounts of insurance undertakings as that Article had effect immediately before exit day, were the United Kingdom a Member State.
  2. Reportable matter – Information about which the auditor becomes aware during the audit that the auditor of a public interest entity: (Ref: Para. A10)
    1. Is required to report to an appropriate authority outside the entity in accordance with law, regulation or relevant ethical requirements; or
    2. Has determined, in the exercise of responsibilities or rights established by law, regulation or relevant ethical requirements, that reporting such information to an appropriate authority outside the entity is an appropriate action in the circumstances.

Requirements

12The auditor shall obtain an understanding of whether there are circumstances in which law, regulation or relevant ethical requirements may: (Ref: Para. A11-A12)

  1. Require the auditor to report to an appropriate authority outside the entity; or (Ref: Para. A13-A19)
  2. Establish responsibilities or rights under which reporting to an appropriate authority outside the entity may be appropriate in the circumstances. (Ref: Para. A20)

Quality Management for an Audit of Financial Statements

Engagement Resources

13In applying ISA (UK) 220 (Revised July 2021), the engagement partner shall determine that members of the engagement team, and any auditor's external experts who are not part of the engagement team, collectively have the appropriate competence and capabilities to identify information that may relate to a reportable matter. (Ref: Para. A21-A24)

Remaining Alert Throughout the Audit for Information that May Relate to a Reportable Matter

14The auditor shall remain alert throughout the audit for information that may relate to a reportable matter. (Ref: Para. A25-A30)

Responding to Information that May Relate to a Reportable Matter

15If, during the audit, the auditor becomes aware of information that may relate to a reportable matter, the auditor shall:

  1. Obtain an understanding of the nature of the matter and the circumstances in which it has occurred; (Ref: Para. A31)
  2. Discuss the matter, unless prohibited by law or regulation, with the appropriate level of management, and, where appropriate, those charged with governance; and (Ref: Para. A32)
  3. Determine whether the matter is a reportable matter. (Ref: Para. A33–A56)

16Unless all of those charged with governance are involved in managing the public interest entity, the auditor shall communicate, unless prohibited by law or regulation, with those charged with governance reportable matters that come to the auditor's attention during the course of the audit.

Responding When the Auditor Determines that a Reportable Matter Exists

17Where a reportable matter exists, the auditor shall report it in accordance with the relevant law, regulation or ethical requirement identified in accordance with paragraph 12.

18For audits of financial statements of public interest entities, the auditor shall:

  1. Report promptly to an appropriate authority outside the entity any information concerning that public interest entity of which the auditor has become aware while carrying out the audit and which may bring about any of the following: (Ref: Para. A57-A59)
    1. A material breach of the laws, regulations or administrative provisions which lay down, where appropriate, the conditions governing authorization or which specifically govern pursuit of the activities of such public interest entity; or (Ref: Para. A60)
    2. A material threat or doubt concerning the continuous functioning of the public interest entity; or (Ref: Para. A61-A62)
    3. A refusal to issue an audit opinion on the financial statements or the issuing of an adverse or qualified opinion. (Ref: Para. A63)
  2. Report any information referred to in paragraph 18(a)(i)–(iii) of which the auditor becomes aware in the course of carrying out the audit of an undertaking having close links6 with the public interest entity for which they are also carrying out the audit.

Reporting

Timing of Report

19The auditor shall report any reportable matter to an appropriate authority outside the entity on a timely basis. (Ref: Para. A64–A66)

20When the reportable matter casts doubt on the integrity of management or those charged with governance or their competence to conduct the business of the public interest entity, the auditor shall make the report to the appropriate authority outside the entity as soon as practicable and without informing management or those charged with governance in advance. (Ref: Para. A67–A68)

Contents of a Report by the Auditor to an Appropriate Authority Outside the Entity

21The auditor shall communicate with an appropriate authority outside the entity in writing. (Ref: Para. A69)

22Unless required by law or regulation to use a specific layout or wording, when making or confirming in writing a report to an appropriate authority outside the entity, the auditor shall:

  1. State the name of the public interest entity concerned;
  2. State the law, regulation or relevant ethical requirements under which the report is made;
  3. State that the report has been prepared in accordance with ISA (UK) 270, Special Considerations For Auditors of Public Interest Entities—Communicating And Reporting To An Appropriate Authority Outside The Entity;
  4. Describe the context in which the report is given; (Ref: Para. A70–A71)
  5. Describe the reportable matter giving rise to the report;
  6. Request the appropriate authority outside the entity to confirm that the report has been received; and
  7. State the name of the auditor, the date of the written report and, where appropriate, the date on which an oral report was made to the appropriate authority outside the entity and the name and title of the individual to whom the oral report was made.
Relationship With Other Reporting Responsibilities

23When issuing a report expressing an opinion on the financial statements of a public interest entity, the auditor shall: (Ref: Para. A72–A77)

  1. Consider whether there are consequential reporting issues affecting the auditor's opinion which arise from any report previously made to an appropriate authority outside the entity during the audit or in previous audits; and
  2. Assess whether any matters encountered in the course of the audit indicate a need for further reporting to an appropriate authority outside the entity.

Application and Other Explanatory Material

Responsibility for Compliance With Laws and Regulations

Responsibilities of Those Charged With Governance

A1Ensuring compliance with the requirements with which a public interest entity is required to comply in carrying out its business is the responsibility of those charged with governance. It requires adequate organization and systems of controls. Some public interest entities may be subject to a regulatory framework that requires that adequate procedures for compliance must be established and maintained. Those charged with governance of such entities may also be required to undertake regular reviews of compliance and to inform the appropriate authority outside the entity of any breach of the rules and regulations applicable to its regulated business.

A2Those charged with governance of a public interest entity have primary responsibility for ensuring that all appropriate information is made available to the appropriate authority outside the entity.

Responsibilities of Auditors

A3The auditor of a public interest entity generally has special reporting responsibilities in addition to the responsibility to report on financial statements. These special reporting responsibilities take two forms:

  • A statutory requirement, duty or right to report certain information, relevant to the functions of an appropriate authority outside the entity, that comes to the auditor's attention in the course of the audit. The auditor has no responsibility to carry out specific procedures to identify information relevant to the appropriate authority outside the entity; and
  • A responsibility to provide a report on matters specified in legislation or by an appropriate authority outside the entity. This form of report is often made on an annual or other routine basis and is not related to the audit of the financial statements. The auditor is required to carry out appropriate procedures sufficient to form an opinion on the matters concerned. These procedures may be in addition to those carried out to form an opinion on the financial statements. This form of reporting responsibilities is not covered by this ISA (UK).

A4The auditor of a public interest entity may have responsibilities for reporting on particular aspects of its compliance with regulatory requirements. However, the auditor has no responsibility for expressing an opinion on an entity's overall compliance with the requirements for the conduct of its business, nor does an audit provide any assurance that breaches of requirements which are not the subject of the auditor's report on the financial statements will be detected.

Communicating and Reporting to an Appropriate Authority Outside the Entity

A5An appropriate authority outside the entity may include a regulator, supervisory authority, law-enforcement body, government department or other authority having responsibilities relevant to matters that may come to the auditor's attention during the audit. The identity of the appropriate authority will depend on the nature of the matter and the applicable legal and regulatory framework.

A6Reporting certain information to an appropriate authority outside the entity may be required or appropriate in the circumstances because:

  • Law, regulation, or relevant ethical requirements require the auditor to report (see paragraphs A13–A18).
  • The auditor has determined reporting is an appropriate action in accordance with relevant ethical requirements (see paragraph A19).
  • Law, regulation or ethical requirements provide the auditor with the right to do so (see paragraph A20).

A7The precise matters which give rise to a legal requirement for or a statutory duty on auditors to make a report to an appropriate authority outside the entity derive from the relevant law or regulation. For example, the auditor may be required to report matters that relate to:

  • The financial position of the public interest entity.
  • Compliance with requirements for the management of its business.
  • The status of management and those charged with governance as fit and proper persons.

A8The requirement – or duty – to make a report to an appropriate authority outside the entity does not impose upon the auditor a responsibility to carry out specific work: it arises solely in the context of work carried out in the course of the audit.

A9Whilst the duty to make a report to an appropriate authority outside the entity does not impose upon the auditor a duty to carry out specific work, it will, however, be necessary for the auditor to take additional time in carrying out an audit to assess whether matters which come to the auditor's attention are reportable matters and should be reported to an appropriate authority outside the entity. These additional planning and follow-up procedures do not constitute an extension of the scope of an audit. They are necessary solely in order to understand and clarify the reporting responsibility and, where appropriate, to make a report.

Definition

Reportable Matter

A10Legislation sometimes refers to reportable matters as “matters of material significance". The term “material significance” requires interpretation in the context of the specific legislation applicable to the public interest entity and the appropriate authority outside the entity. A matter, or group of matters, is normally of material significance to an appropriate authority outside the entity's functions when, due either to its nature or its potential financial impact, it is likely of itself to require investigation by an appropriate authority outside the entity.

A11The auditor is required by paragraph 12 to obtain an understanding of whether law, regulation or relevant ethical requirements require the auditor to report to an appropriate authority outside the entity. The circumstances in which reporting to an appropriate authority outside the entity may be required or appropriate will vary depending on the nature of the entity and the applicable legal, regulatory and ethical framework. Accordingly, the auditor's understanding may include consideration of the entity's regulatory environment and any reporting obligations, responsibilities or rights applicable to the auditor.

A12In obtaining an understanding of the legal and regulatory framework applicable to the entity in accordance with ISA (UK) 250 (Revised September 2026), the auditor may identify that there are additional legal and regulatory requirements that are applicable to the auditor of the entity.

Law, Regulation, or Relevant Ethical Requirements Require the Auditor to Report

A13The auditor may be required by law, regulation or relevant ethical requirements to report certain information, or reportable matters, to an appropriate authority outside the entity. For example, entities which are subject to statutory regulation and which give rise to a requirement or statutory duty – for the auditor to report to an appropriate authority outside the entity include:

  • Public interest entities.
  • An individual, company or other type of entity which is authorized to carry on business in the financial sector which is subject to statutory regulation.

A14The auditor may also be subject to legislative requirements which require the auditor to report to an appropriate authority outside the entity in certain circumstances (e.g., when the auditor suspects an entity is involved in money laundering).

A15ISA (UK) 600 (Revised September 2022) requires the group auditor to inform the competent authority7 where the group auditor is unable to request or secure the agreement of a component auditor to the transfer of audit documentation for the purposes of the group audit.8

Money Laundering, Terrorist Financing and Proceeds of Crime Legislation

A16The auditor has additional responsibilities when auditing and reporting on financial statements that arise as a result of money laundering, terrorist financing and proceeds of crime legislation, collectively known as the "Anti-Money Laundering Legislation.” The Anti-Money Laundering Legislation is complex and in order to obtain a full understanding of the legal requirements, the auditor may need to refer to the relevant provisions of the legislation and, if necessary, obtain legal advice. 9

Entities in the Financial Sector Subject to Statutory Regulation

A17Some public interest entities are subject to legislation which exists in the principal areas of financial services to protect the interests of investors, depositors in banks and other users of financial services. Public interest entities operating in the financial sector are required to comply with legal and regulatory requirements concerning the way their business is conducted. Compliance with those rules is monitored in four principal ways:

  • Internal monitoring by those charged with governance of the public interest entity;
  • Submission of regular returns by the public interest entity to the appropriate authority outside the entity;
  • Monitoring and, in some cases, inspection of the entity by the appropriate authority outside the entity;
  • Reports by the auditor on its financial statements and other specified matters required by legislation or by the appropriate authority outside the entity.

A18In addition, the auditor is required by law to report to an appropriate authority outside the entity when the auditor concludes that there is reasonable cause to believe that a matter is or may be of material significance (and therefore a reportable matter) to the appropriate authority outside the entity. The precise matters which result in a statutory duty to make such a report vary, depending upon the specific requirements of relevant legislation and the rules of the appropriate authority outside the entity. In general, however, a duty to report to an appropriate authority outside the entity arises when the auditor becomes aware that:

  • The public interest entity is in serious breach of:
    • Requirements to maintain adequate financial resources; or
    • Requirements for those charged with governance to conduct its business in a sound and prudent manner (including the maintenance of systems of control over transactions and over any clients' assets held by the business); or
  • There are circumstances which give reason to doubt the status of those charged with governance or senior management as fit and proper persons.

Relevant Ethical Requirements

A19In other cases, whilst there may be no legislative or regulatory requirement for the auditor to report, the auditor may determine that there may be circumstances that arise during the course of an audit that would result in the auditor making a report to an appropriate authority outside the entity. For example, where the auditor has identified or suspects non-compliance with laws and regulations, the relevant ethical requirements may require the auditor to determine whether reporting identified or suspected non-compliance with laws and regulations to an appropriate authority outside the entity is an appropriate action in the circumstances.10

Law, Regulation, or Relevant Ethical Requirements Establish Responsibilities or Rights for the Auditor to Report

A20The auditor may have a statutory right to bring information to the attention of an appropriate authority outside the entity in particular circumstances which lie outside those giving rise to a statutory duty to make a report. The auditor may use that right to make a report relevant to the appropriate authority outside the entity on a specific matter which comes to the auditor's attention when the auditor concludes that doing so is necessary to protect the interests of those for whose benefit the appropriate authority outside the entity is required to act.

Quality Management for an Audit of Financial Statements

Engagement Resources

A21When considering the appropriate competence and capabilities expected of the engagement team as a whole for the audit of a public interest entity, the engagement partner may take into consideration such matters as the team's understanding of:

  • The following aspects of the entity and its environment:
    • Regulatory factors, including those laws and regulations with which compliance may be fundamental to the operating aspects of the business or to an entity's ability to continue its business; 11
    • The applicable financial reporting framework, including those provisions of laws and regulations generally recognized to have an effect on the determination of material amounts and disclosures in the financial statements; 12
  • Any sector-specific regulatory requirements which apply to the auditor of a public interest entity.
  • Any rules and guidance issued by an appropriate authority outside the entity relevant to the audit of the public interest entity or the auditor of that public interest entity, including circumstances that may give rise to mandatory reporting obligations or rights to report to an appropriate authority outside the entity.
  • Indicators that may call into question the fitness and propriety, competence or integrity of management or those charged with governance.

The engagement team's understanding of such matters is appropriate to their role in the audit and sufficient (in the context of that role) to enable them to identify situations which may give reasonable cause to believe that a matter should be reported to an appropriate authority outside the entity.

A22The requirement to report to an appropriate authority outside the entity applies to information of which the auditor becomes aware in the auditor's capacity as such. It does not extend automatically to any information obtained by a firm regardless of its source. Consequently, partners and staff undertaking work in another capacity are not required to have detailed knowledge of the applicable regulatory requirements (unless necessary for that other work) nor to bring information to the attention of the engagement partner responsible for the audit on a routine basis. Firms undertaking audits of financial statements of public interest entities need, however, to establish lines of communication, commensurate with their size and organizational structure, sufficient to ensure that non-audit work undertaken which is likely to have an effect on the audit is brought to the attention of the engagement partner responsible for the audit and to establish procedures for the engagement partner responsible for the audit to make appropriate enquiries of those conducting such other work as part of the process of planning and completing the audit.

Using the Work of Component Auditors

A23Where the auditor uses the work of component auditors as part of the audit, the auditor of a public interest entity establishes reporting arrangements such that any component auditors bring to the attention of the auditor of the public interest entity reportable matters arising from their work.

A24Where the audit of a public interest entity is undertaken by joint auditors, knowledge obtained by one firm is likely to be deemed to be known by the other. Care will therefore be needed in agreeing and implementing arrangements to exchange information relating to matters which may give rise to a requirement to report to an appropriate authority outside the entity.

Remaining Alert Throughout the Audit for Information that May Relate to a Reportable Matter

A25Legislation imposing a duty to make a report to an appropriate authority outside the entity does not require the auditor to change the scope of the audit work, nor does it place on the auditor an obligation to conduct the audit work in such a way that there is reasonable certainty that the auditor will discover all matters which the relevant authority outside the entity might consider to be a reportable matter. Therefore, whilst the auditor of a public interest entity is required to be alert to matters which may require a report, the auditor is not expected to be aware of all circumstances which, had the auditor known of them, would have led the auditor to make such a report. It is only when the auditor becomes aware of such a matter during the audit that the auditor has an obligation to determine whether a report to an appropriate authority outside the entity is required or appropriate for other reasons.

A26Similarly, the auditor is not responsible for reporting on a public interest entity's overall compliance with rules with which it is required to comply nor is the auditor required to conduct the audit work in such a way that there is reasonable certainty that the auditor will discover breaches. Nevertheless, breaches of rules with which a public interest entity is required to comply may have implications for the financial statements and, accordingly, where the auditor has identified or suspects non-compliance with laws and regulations, the auditor complies with the relevant requirements in ISA (UK) 250 (Revised September 2026). Breaches of regulatory requirements may have consequences for other matters on which the auditor is required to express an opinion and, if such breaches represent criminal conduct, could give rise to the need to report to an additional authority outside the entity.

A27In accordance with ISQM (UK) 1,13 the firm establishes adequate procedures to ensure that any matters which are discovered in the course of or as a result of audit work and may give rise to a requirement to report to an authority outside the entity are brought to the attention of the engagement partner on a timely basis.

A28Information that may relate to a reportable matter may be identified throughout the course of the audit. Audit procedures applied to form an opinion on the financial statements may bring such information to the auditor's attention. For example, such audit procedures may include those required by:

  • ISA (UK) 240 (Revised March 2026) to identify and assess the risks of material misstatement of the financial statements due to fraud. 14
  • ISA (UK) 250 (Revised September 2026) to identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, arising from non-compliance with laws and regulations.
  • ISA (UK) 570 (Revised March 2026) to conclude on whether a material uncertainty related to going concern exists.15

A29The circumstances in which the auditor is required to make a report to an appropriate authority outside the entity includes matters which may not necessarily be considered as part of the audit. For example, the duty to report would apply to information of which the auditor becomes aware in the course of the audit which is relevant to the Financial Conduct Authority's criteria for approved persons, although the auditor is not otherwise required to express an opinion on such matters.

A30Where the auditor has identified concerns about the competence, integrity, ethical values or diligence of management or those charged with governance, or about its commitment to or enforcement of these, such concerns may be relevant to the status of those individuals as fit and proper persons.

Responding to Information that May Relate to a Reportable Matter

Obtaining an Understanding

A31As explained in paragraph 7, the auditor is not required to plan or perform an audit to identify reportable matters. However, where information is identified as part of the audit that may relate to a reportable matter, the auditor is required to obtain an understanding of the nature of the matter and the circumstances in which it has occurred in order to determine whether the matter is a reportable matter.

Discussions With Those Charged With Governance

A32Except in the circumstances referred to in paragraph 20 the auditor seeks to reach agreement with those charged with governance on the circumstances giving rise to a report to an appropriate authority outside the entity. However, where law, regulation or relevant ethical requirements require the auditor to report to an appropriate authority outside the entity, 16 the auditor is required to make such a report regardless of:

  1. Whether the matter has been referred to the appropriate authority outside the entity by other parties (including the public interest entity, whether by those charged with governance or otherwise); and
  2. Any duty owed to other parties, including those charged with governance of the public interest entity and its shareholders (or equivalent persons).

Determining Whether a Matter is a Reportable Matter

A33In determining whether the matter is a reportable matter, the auditor takes into account the quantity and type of evidence concerning such a matter which may reasonably be expected to be available. If the auditor concludes that the auditor has been prevented from obtaining all such evidence concerning a matter which may give rise to a requirement to report, the auditor normally makes a report to the appropriate authority outside the entity as soon as practicable.

A34In determining whether a matter is a reportable matter under paragraph 15(c), the auditor exercises professional judgment within the scope of any established responsibilities or rights and considers whether reporting the matter would assist the appropriate authority outside the entity in the exercise of its statutory or regulatory functions.

A35In fulfilling the responsibility to report to an appropriate authority outside the entity, the auditor assesses both the significance of individual transactions or events and also considers whether a combination of such items over the course of the work undertaken for the audit may give the auditor reasonable grounds to believe that they constitute a reportable matter, and so give rise to the requirement to make a report to an appropriate authority outside the entity.

A36Where it is insufficiently clear for the auditor to determine whether a particular circumstance results in law, regulation or relevant ethical requirements either requiring the auditor to report to an appropriate authority outside the entity, or establishing responsibilities under which reporting to an appropriate authority outside the entity may be appropriate in the circumstances, it may be appropriate to take legal advice.

Entities in the Financial Sector Subject to Statutory Regulation

A37In some areas of the financial sector, conducting business outside the scope of the public interest entity's authorization is a serious regulatory breach, and therefore a reportable matter. In addition, it may result in fines, suspension or loss of authorization.

A38Where the auditor's review of the public interest entity's activities indicates that published guidance by the appropriate authority outside the entity may not be sufficiently precise to enable the auditor to identify circumstances in which it is necessary to initiate a report, the auditor considers whether it is necessary to discuss the matters specified in legislation with the appropriate authority outside the entity with a view to reaching agreement on its interpretation.

A39Where a group includes two or more entities separately regulated by different authorities outside the entity, the auditor may need to clarify the regulatory requirements in any overlapping areas of activity.

A40When a public interest entity is subject to provisions of two or more appropriate authorities outside the entity, the auditor needs to take account of the separate reporting requirements in planning and conducting the audit work. Arrangements may exist for one regulatory body to rely on financial monitoring being carried out by another body (the “lead regulator”). However, the auditor's statutory duty to report cannot be discharged by reliance on the lead regulator informing others. Therefore, where the auditor concludes that a matter is a reportable matter to more than one appropriate authority outside the entity, the auditor assesses the need for separate reports informing each authority outside the entity of reportable matters.

A41An apparent breach of statutory or regulatory requirements may not of itself give rise to a legal or regulatory requirement to report to an appropriate authority outside the entity. There will normally be a need for the auditor to investigate further and discuss the circumstances surrounding the apparent breach with management, or where appropriate those charged with governance, in order to obtain sufficient information to determine whether a matter is a reportable matter. For example, a minor breach which has been corrected by the public interest entity and reported (if appropriate) to an appropriate authority outside the entity, and which from the evidence available to the auditor appears to be an isolated occurrence, would not normally give the auditor reasonable cause to believe that it is a reportable matter. However, a minor breach that results in a criminal offence that gives rise to criminal property would be reportable to an appropriate authority under the anti-money laundering legislation.

A42When determining whether a breach of statutory or regulatory requirements gives rise to a legal or regulatory requirement to report to an appropriate authority outside the entity, the auditor considers factors such as:

  • Whether the breach, though minor, is indicative of a general lack of compliance with the regulatory requirements or otherwise casts doubt on the status of management and those charged with governance as fit and proper persons.
  • Whether the breach otherwise raises concerns about the competence, integrity, ethical values or diligence of management and those charged with governance, or about its commitment to or enforcement of the regulatory requirements.
  • Whether a breach which occurred before the auditor's visit to the public interest entity was reported by the public interest entity itself and has since been corrected, such that, at the date of the auditor's discovery, no breach exists.
  • Whether the circumstances giving rise to a breach which occurred before the auditor's visit to the public interest entity continue to exist, or those charged with governance have not taken corrective action, or the breach has re-occurred.
  • Whether the circumstances suggest that an immediate report to the appropriate authority outside the entity is necessary to protect the interests of those for whose benefit the appropriate authority outside the entity is required to act.

A43The auditor would normally seek evidence to assess the implications of a suspected breach before reporting a matter to an appropriate authority outside the entity. However, the auditor's responsibility to make a report does not require the auditor to determine the full implications of a matter before reporting: the auditor is required to exercise professional judgment as to whether or not there is reasonable cause to believe that a matter is a reportable matter. In forming that judgment, the auditor undertakes appropriate investigations to determine the circumstances but does not require the degree of evidence which would be a normal part of forming an opinion on financial statements. Such investigations may include:

  • Enquiry of appropriate level of staff.
  • Review of correspondence and documents relating to the matter.
  • Discussion with management, or, where appropriate, those charged with governance.

A44The potential gravity of some apparent breaches may be such that an immediate report to an appropriate authority outside the entity is essential in order to enable appropriate action to be taken. For example, prompt reporting of a loss of client assets may be necessary to avoid further loss to investors or others in whose interests the appropriate authority outside the entity is required to act. The auditor therefore balances the need for further investigation of the matter with the need for prompt reporting.

A45On completion of the auditor's investigations, the auditor ensures that the facts and the basis for the auditor's decision (whether to report or not) is adequately documented such that the reasons for that decision may be clearly demonstrated.

Relevant Ethical Requirements

A46ISA (UK) 250 (Revised September 2026) explains that where there is identified or suspected non-compliance with laws and regulations, relevant ethical requirements may require the auditor to determine where such breaches should be reported to an appropriate authority outside the entity. 17

Reporting Identified or Suspected Non-Compliance with Laws and Regulations in the Public Interest

A47Where the auditor has identified or suspects non-compliance with laws and regulations which does not give rise to a responsibility under law, regulation or relevant ethical requirements to report to an appropriate authority outside the entity, the auditor considers whether the matter may be one that ought to be reported in the public interest to an appropriate authority outside the entity and, where this is the case, except in the circumstances covered in paragraph A49, discusses the matter with management, and, where appropriate, those charged with governance. 18

A48If, having considered any views expressed on behalf of the public interest entity and in the light of any legal advice obtained, the auditor concludes that the matter ought to be reported in the public interest to an appropriate authority outside the entity, the auditor notifies those charged with governance in writing of the auditor's conclusion and, if the public interest entity does not voluntarily do so itself or is unable to provide evidence that the matter has been reported, the auditor reports the matter to an appropriate authority outside the entity.

A49The auditor reports in the public interest a matter to an appropriate authority outside the entity and without discussing the matter with the entity if the auditor concludes that the identified or suspected non-compliance with laws and regulations has caused the auditor no longer to have confidence in the integrity of those charged with governance. Such a conclusion may arise in the circumstances identified in ISA (UK) 250 (Revised September 2026)19 or as a result of other audit procedures.

A50Determination of where the balance of public interest lies requires careful consideration. An auditor whose suspicions have been aroused uses professional judgment to determine whether the auditor's misgivings justify the auditor in carrying the matter further or are too insubstantial to deserve reporting. The auditor is protected from the risk of liability for breach of confidence or defamation provided that:

  • In the case of breach of confidence, disclosure is made in the public interest, and such disclosure is made to an appropriate body or person, 20 and there is no malice motivating the disclosure; and
  • In the case of defamation, disclosure is made in the auditor's capacity as auditor of the entity concerned, and there is no malice motivating the disclosure.

In addition, the auditor is protected from such risks where the auditor is expressly permitted or required by legislation to disclose information.21

A51'Public interest' is a concept that is not capable of general definition. Each situation must be considered individually. UK legal precedent indicates that matters to be taken into account when considering whether disclosure is justified in the public interest may include:

  • The extent to which the identified or suspected non-compliance with laws and regulations is likely to affect members of the public.
  • Whether those charged with governance have rectified the matter or are taking, or are likely to take, effective corrective action.
  • The extent to which non-disclosure is likely to enable the identified or suspected non-compliance with laws and regulations to recur with impunity.
  • The gravity of the matter.
  • Whether there is a general ethos within the entity of disregarding laws and regulations.
  • The weight of evidence and the degree of the auditor's suspicion that there has been non-compliance with laws and regulations.

A52An auditor who can demonstrate having acted reasonably and in good faith in informing an appropriate authority outside the entity of non-compliance with laws and regulations which the auditor suspects has been committed would not be held by the court to be in breach of duty to the client even if, an investigation or prosecution having occurred, it were found that there had been no offence.

A53The auditor needs to remember that the auditor's decision as to whether to report, and if so to whom, may be called into question at a future date, for example on the basis of:

  • What the auditor knew at the time;
  • What the auditor ought to have known in the course of the audit;
  • What the auditor ought to have concluded; and
  • What the auditor ought to have done.

The auditor may also wish to consider the possible consequences if financial loss is occasioned by non-compliance with laws and regulations which the auditor suspects (or ought to suspect) has occurred but decided not to report.

A54The auditor may need to take legal advice before making a decision on whether identified or suspected non-compliance with laws and regulations needs to be reported to an appropriate authority in the public interest.

The Auditor's Right to Report to an Appropriate Authority Outside the Entity

A55If the auditor determines that a reportable matter does not give rise to a legal or regulatory requirement to report to an appropriate authority outside the entity but nevertheless may be relevant to an appropriate authority outside the entity's exercise of its functions, the auditor:

  1. Considers whether the reportable matter may be one that ought to be brought to the attention of an appropriate authority outside the entity under the terms of the appropriate legal provisions enabling the auditor to report to an appropriate authority outside the entity; and, if so
  2. Informs management, and, where appropriate, those charged with governance that in the auditor's professional judgment the reportable matter should be reported to an appropriate authority outside the entity.

Where the auditor is unable to obtain, within a reasonable period, adequate evidence that those charged with governance have properly informed an appropriate authority outside the entity of the reportable matter, the auditor reports to an appropriate authority outside the entity as soon as practicable.

A56Where the auditor considers that a reportable matter which does not give rise to a statutory duty to report is nevertheless, in the auditor's professional judgment, such that it should be brought to the attention of an appropriate authority outside the entity, it is normally appropriate for the auditor to request in writing that those charged with governance draw it to the attention of an appropriate authority outside the entity.

Responding When the Auditor Determines that a Reportable Matter Exists

Public Interest Entities

A57Reports are generally made to the appropriate authority outside the entity that has the statutory powers to be able to act on the information provided in the report from the auditor. For example:

  • For public interest entities – the Financial Reporting Council.
  • For entities in the financial sector – the Financial Conduct Authority or the Prudential Regulation Authority.
  • Reporting on non-compliance with Listing Rules – the Financial Conduct Authority.
  • For entities in the telecommunications sector - Office of Communications (OFCOM).

A58In determining which authority outside the entity is the most appropriate to report, the auditor takes into consideration the understanding obtained in accordance with paragraph 12 and the relevant regulatory factors including the regulatory environment obtained in accordance with ISA (UK) 250 (Revised September 2026). Different authorities may have different reporting thresholds, confidentiality requirements and reporting procedures. In some cases, the auditor may be required to report to more than one appropriate authority outside the entity.

A59There may be occasions where there is no readily identifiable appropriate authority outside the entity to which the auditor can make a report. In that case, the auditor makes a report to the auditor's competent authority. 22

Material Breach of Laws, Regulations or Administrative Provisions

A60ISA (UK) 250 (Revised September 2026) establishes requirements and provides guidance for the auditor's responsibility to consider laws and regulations in an audit of financial statements.

Material Threat or Doubt Concerning the Continuous Functioning

A61A material threat or doubt concerning the continuous function of an entity could arise as a result of many factors. For example, the auditor considers matters relevant to going concern as well as threats or doubts arising from principal or emerging risks facing the entity, including those that would threaten the entity's business model, future performance, solvency or liquidity. ISA (UK) 570 (Revised March 2026) establishes requirements and provides guidance in respect of the auditor's responsibilities relating to going concern.

A62As discussed in paragraph A64, the auditor considers the timing of any reports to an appropriate authority outside the entity. For example, statutory requirements may exist that provide early warning procedures for the auditor to report to an appropriate authority outside the entity when a material uncertainty exists to enable an appropriate authority outside the entity to investigate the matter and take action. The early warning procedures may include reporting to an appropriate authority outside the entity at the point in time when the auditor identifies a material uncertainty related to events or conditions that may cast significant doubt on the entity's ability to continue as a going concern.

Qualified, Adverse or Disclaimers of Opinion

A63ISA (UK) 705 (Revised June 2016)23 establishes requirements and provides guidance in determining where there is a need for the auditor to express a qualified or adverse opinion or disclaim an opinion.

Reporting

Timing of Report

A64The appropriate timing for reporting any reportable matters to an appropriate authority outside the entity will vary with the circumstances of the engagement and the requirements established by the appropriate authority outside the entity. For example, the auditor may be required by law, regulation or relevant ethical requirements to consider the timing of reporting of reportable matters prior to the issuance of the auditor's report.

A65In normal circumstances, the auditor would wish to communicate with an appropriate authority outside the entity with the knowledge and agreement of those charged with governance of the public interest entity. However, in some circumstances immediate notification of the discovery of a matter giving reasonable grounds to believe that a reportable matter exists will be necessary.

A66In determining the timing and manner of reporting, the auditor may need to consider confidentiality obligations, legal privilege, data protection requirements, and statutory restrictions on disclosure. Certain legislation may prohibit informing management or those charged with governance that a report has been made to an authority outside the entity. The auditor may consider obtaining legal advice where there is uncertainty regarding such obligations.

A67Speed of reporting is essential where the circumstances cause the auditor no longer to have confidence in the integrity of those charged with governance. In such circumstances, there may be a serious and immediate threat to the interests of those for whose benefit the appropriate authority outside the entity is required to act (e.g., where the auditor believes that a fraud may have been committed by, or with the knowledge of, those charged with governance, or have evidence of the intention of those charged with governance to commit or condone a suspected fraud).

A68In circumstances where the auditor no longer has confidence in the integrity of those charged with governance, it is not appropriate to provide those charged with governance with copies of the written report by the auditor to an appropriate authority outside the entity. Since such circumstances will be exceptional and extreme, the auditor may wish to seek legal advice as to the auditor's responsibilities and the appropriate course of action.

Contents of a Report by the Auditor to an Appropriate Authority Outside the Entity

Communicating in Writing

A69Except in the circumstances set out in paragraph 20, the auditor sends a copy of the written report by the auditor to an appropriate authority outside the entity to those charged with governance.

Context

A70The report by the auditor to an appropriate authority outside the entity is a by-product of other work undertaken by the auditor. As a result, it is not possible for the auditor or an appropriate authority outside the entity to conclude that all matters relevant to an appropriate authority outside the entity were encountered in the course of the auditor's work. The report by the auditor to an appropriate authority outside the entity therefore sets out the context in which the reportable matter was identified and indicates the extent to which the reportable matter has been investigated and discussed with those charged with governance.

A71Matters to which the auditor may wish to refer when describing the context in which a report is made to an appropriate authority outside the entity include:

  • An explanation that the reportable matter was identified in the course of an audit of financial statements.
  • The applicable legislative requirements and interpretations of those requirements which have informed the auditor's judgment.
  • The extent to which the auditor has investigated the circumstances giving rise to the reportable matter.
  • Whether the reportable matter has been discussed with those charged with governance.
  • Whether steps to rectify the reportable matter have been taken.

Relationship With Other Reporting Responsibilities

A72The circumstances which give rise to a report to an appropriate authority outside the entity may involve an uncertainty or other matter which requires disclosure in the financial statements. The auditor therefore considers whether the financial statements provide adequate disclosures about such matters in a manner that achieves fair presentation. In considering the relationship between reporting to an appropriate authority outside the entity and reporting in the auditor's report, the auditor considers, for example:

  • Where the auditor has concluded that a material uncertainty exists related to events or conditions that may cast significant doubt on the entity's ability to continue as a going concern, whether the disclosures required by the applicable financial reporting framework have been adequately made and the implications for the auditor's report, including the requirement to include a separate section headed “Material Uncertainty Related to Going Concern” when appropriate.24
  • Whether it is necessary to draw users' attention to a matter appropriately presented or disclosed in the financial statements that, in the auditor's judgment, is of such importance that it is fundamental to users' understanding of the financial statements, through the inclusion of an Emphasis of Matter paragraph in the auditor's report. 25

Communication of Information by Appropriate Authorities Outside the Entity

A73The precise circumstances in which an appropriate authority outside the entity may disclose confidential information to another party varies, but in general they may do so if considered necessary to fulfil their own obligations under legislation, or, in some cases, to enable the auditor to fulfil the auditor's duties either to the public interest entity or, in other cases, to the appropriate authority outside the entity. Confidential information remains confidential in the hands of the recipient.

A74In so far as the law permits, an appropriate authority outside the entity may bring a matter to the attention of the auditor of a public interest entity in circumstances where:

  1. They believe the matter is of such importance that the auditor's knowledge of it could significantly affect the form of the auditor's report on the entity's financial statements or other matters on which the auditor is required to report, or the way in which the auditor discharges the auditor's reporting responsibilities; and
  2. The disclosure is for the purpose of enabling or assisting an appropriate authority outside the entity to discharge its functions.

However, the auditor needs to be aware that there may be circumstances in which an appropriate authority outside the entity is unable to disclose confidential information and accordingly may be unable to disclose such matters. In the absence of any disclosure by an appropriate authority outside the entity, the auditor can only form a judgment in the light of evidence to which the auditor has access.

A75For audits of public interest entities, UK legislation requires an effective dialogue to be established between the supervising credit institutions and insurance undertakings, on the one hand, and the auditor carrying out the audit of those institutions and undertakings, on the other hand. The responsibility for compliance with this requirement rests with both parties to the dialogue.

Statement By Auditor on Ceasing to Hold Office

A76On ceasing to hold office, the auditor may be required by statute or by regulation to make specific reports concerning the circumstances relating to that event, and would also follow the procedures identified in the ethical guidance issued by the relevant professional body.

A77In addition, the auditor of a public interest entity assesses whether it is appropriate to bring any matters of which the auditor is aware to the notice of the appropriate authority outside the entity. This may be done either before or after ceasing to hold office, as the auditor's statutory right to disclose to an appropriate authority outside the entity information obtained in the course of the auditor's appointment is not affected by the auditor's removal, resignation or otherwise ceasing to hold office.

Financial Reporting Council

London office: 13th Floor, 1 Harbour Exchange Square, London, E14 9GE

Birmingham office: 5th Floor, 3 Arena Central, Bridge Street, Birmingham, B1 2AX

+44 (0)20 7492 2300

www.frc.org.uk

Footnotes

  1. For example, the National Crime Agency. ↩

  2. UK auditors are subject to the ethical pronouncements established by the auditor's relevant professional body which include ethical requirements to respond to identified or suspected non-compliance with laws and regulations. ↩

  3. ISA (UK) 250 (Revised September 2026), Consideration of Laws and Regulations in an Audit of Financial Statements, paragraph 4-1. ↩

  4. In the UK, Section 494A of the Companies Act 2006. ↩

  5. In the UK, "issuer" and "regulated market" have the same meaning as in Part 6 of the Financial Services and Markets Act 2000. ↩

  6. "Close links" means a situation in which two or more natural or legal persons are linked in any of the following ways: (a) Participation in the form of ownership, direct or by way of control, of 20% or more of the voting rights or capital of an undertaking; (b) Control; (c) A permanent link of both or all of them to the same third person by a control relationship. ↩

  7. The competent authority designated by law is the Financial Reporting Council or the Recognized Supervisory Body to whom the Financial Reporting Council has delegated regulatory tasks, as applicable. ↩

  8. ISA (UK) 600 (Revised September 2022), paragraph 51-1(b). ↩

  9. Detailed guidance by the National Crime Agency is available at: https://www.nationalcrimeagency.gov.uk/what-we-do/crime-threats/money-laundering-and-illicit-finance/suspicious-activity-reports ↩

  10. ISA (UK) 250 (Revised September 2026), paragraph A30. ↩

  11. ISA (UK) 250 (Revised September 2026), paragraph 12-2(a). ↩

  12. ISA (UK) 250 (Revised September 2026), paragraph 12-2(b). ↩

  13. ISQM (UK) 1, Quality Management For Firms That Perform Audits or Reviews of Financial Statements, Or Other Assurance Or Related Services Engagements. ↩

  14. ISA (UK) 240 (Revised March 2026), The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements. ↩

  15. ISA (UK) 570 (Revised March 2026), Going Concern. ↩

  16. As determined in paragraph 15(c) of this ISA (UK). ↩

  17. ISA (UK) 250 (Revised September 2026), paragraph A30. ↩

  18. In rare circumstances, according to common law, disclosure might also be justified in the public interest where there is no instance of non-compliance with laws and regulations, e.g. where the public is being misled or their financial interests are being damaged; where a miscarriage of justice has occurred; where the health and safety of members of the public or the environment is being endangered – although such events may well constitute breaches of laws and regulations. ↩

  19. ISA (UK) 250 (Revised September 2026), paragraph A24. ↩

  20. Appropriate authorities outside the entity could include the Serious Fraud Office, the Crown Prosecution Service, police forces, the Financial Conduct Authority, the Prudential Regulation Authority, the Panel on Takeovers and Mergers, the Society of Lloyd's, local authorities, the Charity Commission for England and Wales, the Office of the Scottish Charity Regulator, the Charity Commission for Northern Ireland, HM Revenue and Customs, the Department of Business, Energy and Industrial Strategy and the Health and Safety Executive. ↩

  21. The Employments Rights Act 1996 would provide similar protection to an individual member of the engagement team who made an appropriate report in the public interest. However, ordinarily a member of the engagement team who believed there was a reportable matter would follow the firm's policies and procedures to address such matters. ISA (UK) 220 (Revised July 2021) paragraph 35 requires that the engagement partner shall take responsibility for the engagement team undertaking appropriate consultation on difficult or contentious matters. If differences of opinion arise within the engagement team, ISA (UK) 220 (Revised July 2021) paragraph 37 requires that the engagement team shall follow the firm's policies and procedures for dealing with and resolving differences of opinion. ↩

  22. The competent authority designated by law is the Financial Reporting Council or the Recognized Supervisory Body to whom the Financial Reporting Council has delegated regulatory tasks, as applicable. ↩

  23. ISA (UK) 705 (Revised June 2016), Modifications to the Opinion in the Independent Auditor's Report. ↩

  24. ISA (UK) 570 (Revised March 2026), paragraph 35. ↩

  25. ISA (UK) 706 (Revised June 2016), Emphasis of Matter Paragraphs and Other Matter Paragraphs in the Independent Auditor's Report, paragraph 6. ↩

File

Name ISA (UK) 270 (September 2026)
Publication date 29 October 2026
Type Standard
Format PDF, 673.4 KB
Download original
Back to top