The content on this page has been converted from PDF to HTML format using an artificial intelligence (AI) tool as part of our ongoing efforts to improve accessibility and usability of our publications. Note:
- No human verification has been conducted of the converted content.
- While we strive for accuracy errors or omissions may exist.
- This content is provided for informational purposes only and should not be relied upon as a definitive or authoritative source.
- For the official and verified version of the publication, refer to the original PDF document.
If you identify any inaccuracies or have concerns about the content, please contact us at [email protected].
Mythbuster: Revisions to ISAs (UK) on Laws and Regulations and Reporting to Regulators
| What has changed? | How does the revised approach work? | When do the revised standards apply? |
|---|---|---|
| The FRC has revised ISA (UK) 250 'Consideration of Laws and Regulations in an Audit of Financial Statements' and ISA (UK) 270 'Special Considerations for Audits of Public Interest Entities—Communicating and Reporting to an Appropriate Authority Outside the Entity' to strengthen the auditor's consideration of laws and regulations and to clarify responsibilities for communicating and reporting matters to appropriate authorities outside the entity. | The revised standards build on the auditor's existing risk-based responsibilities. They reinforce the need to identify and assess risks of material misstatement arising from non-compliance with laws and regulations and to respond appropriately when information indicating actual or suspected non-compliance is identified. The standards also clarify the auditor's responsibilities for considering whether matters should be communicated or reported to an appropriate authority outside the entity. | The revised standards are effective for audits of financial statements for periods commencing on or after 15 December 2027. |
During consultation, a number of misconceptions emerged about what the revised standards would require in practice.
This Mythbuster addresses some of the most common questions and concerns, explaining what the revised standards do, and do not, require of auditors.
Are auditors expected to identify every law and regulation that applies to an entity?
No. Auditors are not expected to identify all laws and regulations applicable to the entity. Their understanding is limited to what is necessary to identify and assess risks of material misstatement to the financial statements arising from non-compliance. Management remains responsible for identifying applicable laws and regulations.
Does revised ISA (UK) 250 turn the audit into a compliance review?
No. The auditor's responsibility is not to perform a comprehensive compliance review. The focus is on identifying, assessing and responding to risks of material misstatement arising from non-compliance with laws and regulations. Auditors are not responsible for preventing non-compliance or detecting every instance of it.
Will revised ISA (UK) 250 result in more risks of material misstatement being identified?
Not necessarily. The revised standard does not create new risks of material misstatement. Risks arising from non-compliance with laws and regulations have always existed. The revisions are intended to improve the consistency and appropriateness of the auditor's identification and assessment of these risks. While additional risks may be identified in some audits, this reflects improved identification of existing risks rather than the creation of new ones, and will depend on the particular facts and circumstances of the entity.
Does removing the direct/indirect distinction mean auditors must perform more work over all laws and regulations?
No. The revised standard replaces that distinction with a risk-based approach focused on laws and regulations that may reasonably be expected to give rise to risks of material misstatement. Auditors are expected to apply professional judgement and focus their work where it matters most. The revised standard also includes factors and examples to help auditors identify laws and regulations that may be fundamental to the entity's operations, such as those necessary to maintain licences, access markets or continue operating.
If a breach of law or regulation is discovered after the audit, will auditors be judged with the benefit of hindsight?
No. The appropriateness of the auditor's work and judgements is assessed based on the information reasonably available at the time of the audit, not by reference to events or information that emerge later with the benefit of hindsight.
Does revised ISA (UK) 250 require auditors to be legal experts or involve legal specialists on most audits?
No. Auditors are not expected to possess the expertise of legal practitioners, nor is specialist legal expertise expected to be routinely required. Auditors need sufficient understanding to identify and assess risks of material misstatement and determine whether specialist expertise is needed in particular circumstances. Legal specialists may be appropriate only in limited circumstances, such as complex regulatory investigations or significant legal uncertainty.
Will Revised ISA (UK) 250 create a significant increase in audit work and costs?
No, not in most cases. The revisions are intended to operate within the existing risk assessment framework and are designed to be proportionate and scalable. They do not require auditors to identify every applicable law, perform a comprehensive compliance review, or routinely involve legal specialists. While some audits may require additional work where risks relating to non-compliance are identified, any increase in effort will depend on the entity’s particular facts and circumstances and the auditor’s existing processes.
Do group auditors need to understand every law and regulation in every jurisdiction where the group operates?
No. The revised standard does not require a comprehensive review of all laws and regulations across every component and jurisdiction. The group auditor’s understanding is limited to what is necessary to assess risks of material misstatement for the group financial statements and is intended to operate through the existing framework of ISA (UK) 600 and ISA (UK) 315.
Does ISA (UK) 270 require auditors to report matters simply because they may be in the public interest?
No. The proposed public-interest-only reporting requirement was removed. Reporting under ISA (UK) 270 is linked to legal, regulatory or ethical obligations, or circumstances where an existing framework gives the auditor the right or responsibility to report.
Does ISA (UK) 270 apply only to breaches of laws and regulations?
No. ISA (UK) 270 has a wider scope. Reportable matters may include issues such as going concern, modified audit opinions, or concerns about the integrity or competence of management or those charged with governance, depending on the circumstances and the legal, regulatory or ethical obligations that apply.
Do auditors need to perform additional audit procedures to find matters to report under ISA (UK) 270?
No. ISA (UK) 270 applies to information that comes to the auditor’s attention during the audit. It does not require auditors to perform additional procedures beyond those already undertaken as part of the audit.
Do matters identified under ISA (UK) 270 only need to be reported to one regulator?
No. Depending on the circumstances, an auditor may need to report to more than one authority outside the entity in order to meet legal, regulatory or ethical obligations.
If there is no obvious regulator, does the auditor have no reporting obligation?
No. Where there is no readily identifiable authority outside the entity, the auditor should report the matter to the FRC, as the competent authority.