What is the responsibility of an auditor on non compliance?

This article takes a look at AU-C 250, Consideration of Laws and Regulations in an Audit of Financial Statements. The applicable laws and regulations constitute the legal and regulatory framework of an entity—even while the impact of laws and regulations on financial statements varies considerably.

Some laws or regulations have provisions with a direct effect on the financial statements because they determine the reported amounts and disclosures required in an entity’s financial statements. There are other laws or regulations management has to comply with, and they may also set the provisions under which the entity is allowed to conduct its business, but they do not have a direct effect on an entity’s financial statements.

Some entities operate in heavily regulated industries (such as banks and chemical companies) while others are subject only to the many laws and regulations that relate generally to the operating aspects of the business (such as those related to occupational safety and health and equal employment opportunity).

Noncompliance with laws and regulations may result in fines, litigation, or other consequences for the entity that may have a material effect on the financial statements.

Responsibility for Compliance with Laws and Regulations

Responsibility of Management: Management’s responsibility, with the oversight of those charged with governance, is to ensure that the entity’s operations are conducted in accordance with the provisions of laws and regulations, including compliance with the provisions of laws and regulations that determine the reported amounts and disclosures in an entity’s financial statements.

Responsibility of the Auditor: The requirements in this SAS are designed to assist the auditor in identifying material misstatement of the financial statements due to noncompliance with laws and regulations. The auditor is not responsible for preventing noncompliance and cannot be expected to detect noncompliance with all laws and regulations.

The auditor is responsible for obtaining reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by fraud or error. The auditor is responsible for taking into account the applicable legal and regulatory framework during the planning and execution of the audit procedures.

In the context of laws and regulations, the potential effects of inherent limitations on the auditor’s ability to detect material misstatements are greater for the following reasons:

  • Many laws and regulations (relating principally to the operating aspects of an entity) typically do not affect the financial statements and are not captured by the entity’s information systems relevant to financial reporting.
  • Noncompliance may involve acts designed to conceal it, such as collusion, forgery, deliberate failure to record transactions, management override of controls, or intentional misrepresentations made to the auditor.
  • Whether an act constitutes noncompliance is ultimately a matter for legal determination, such as by a court of law.

This SAS distinguishes the auditor’s responsibilities in relation to compliance with the following two categories of laws and regulations that may have a material effect on the financial statements of the company:

  1. The provisions of those laws and regulations generally recognized to have a direct effect on the determination of material amounts and disclosures in the financial statements, such as tax and pension laws and regulations.
  2. The provisions of other laws and regulations that do not have a direct effect on the determination of the amounts and disclosures in the financial statements, but compliance with which may be:
    1. fundamental to the operating aspects of the business, or
    2. fundamental to an entity’s ability to continue its business, or necessary for the entity to avoid material penalties (for example, compliance with the terms of an operating license, regulatory solvency requirements, or environmental regulations).

Differing requirements are specified for each of the previously mentioned categories of laws and regulations:

  1. The auditor’s responsibility for direct effect laws and regulations is to obtain sufficient appropriate audit evidence regarding material amounts and disclosures in the financial statements that are determined by the provisions of those laws and regulations.
  2. The auditor’s responsibility for indirect effect laws and regulations is limited to performing specified audit procedures that may identify noncompliance with those laws and regulations that may have a material effect on the financial statements.

The auditor is required to remain alert to the possibility that other audit procedures applied for the purpose of forming an opinion on financial statements may bring instances of identified or suspected noncompliance with laws and regulations to the auditor’s attention.

Practical Considerations

This SAS requires determination and consideration of direct and indirect laws and regulations during the planning and performance phases of an audit engagement. A section of a planning document, as well as other documentation created during engagement performance, should include evidence of compliance with these requirements.

Reference to the sources of requirements of applicable direct and indirect laws and regulations, as well as any necessary computations demonstrating compliance, should be included in engagement documentation. In the case of pension costs or income taxes for example, calculations supporting recorded amounts should be included. When non-compliance of indirect effect laws and regulations is discovered, calculations of any penalty amounts should be included.

My exclusive presentation of webcasts on CPE Credit.com and self-study courses covering various applications of auditing standards can be accessed by clicking the appropriate box on the left side of my home page, www.cpafirmsupport.com. Registered users on my website receive a 20 percent discount on CPE materials presented by myself and numerous other authors on a variety of professional topics.

My assistance in CPA firm quality control consulting, audit planning and peer review preparation can be obtained by sending an email using the “Contact Us” tab on my home page.

What is the auditor responsibility when noncompliance?

The auditor's responsibility regarding mis- statements resulting from noncompliance with laws and regulations having a direct effect on the determination of material amounts and disclosures in the financial statements is the same as that for misstatements caused by fraud or error, as described in section 200.

When an auditor becomes aware of possible noncompliance?

When the auditor becomes aware of information concerning a possible instance of noncompliance, the auditor should obtain an understanding of the nature of the act and the circumstances in which it has occurred, and sufficient other information to evaluate the possible effect on the financial statements.

How will an auditor respond to the discovery of non

If the auditor identifies or suspects non-compliance, the auditor will need to consider whether law, regulation and ethical requirements either require the auditor to report to an appropriate authority outside the entity, or establish responsibilities under which this may be appropriate.

What happens if non

Non-compliance leaves you at risk for financial losses, security breaches, license revocations, business disruptions, poor patient care, erosion of trust, and a damaged reputation. Here is a quick overview of the impact of non-compliance.