The nature of the act and the circumstances in which it occurred, and how the relevant law or regulation applies. You cannot respond to what you have not sized: which statute, which periods, which amounts, who is involved.
Raise the matter at least one level above the people involved; where the matter involves senior management or is significant, take it to those charged with governance. The discussion itself is a required response, not a courtesy.
Advise management to rectify or remediate the non-compliance, mitigate its consequences, deter recurrence — and disclose the matter to an authority where a law requires disclosure.
Judge whether management’s and TCWG’s response is appropriate and timely: was it investigated, corrected, disclosed where required? An acknowledgment without action fails this step.
In the public interest, considering the urgency, pervasiveness and credibility of the parties: the effect on the auditor’s report, communication to a group auditor, and whether continued association with the client is tenable.
The India modification that matters most: under the ICAI Code, disclosure that overrides confidentiality is made where required by law — the prime route being fraud reporting under Sec 143(12) in Form ADT-4. The IESBA-style voluntary public-interest disclosure was not adopted as a free-standing right.
The matter, the discussions held, the responses received, and the judgments and conclusions reached. Under SA 230 discipline: if the response is not in the file, it did not happen.
Applicability in one line: listed-entity audits from 1 October 2022, extended to material subsidiaries of listed entities by the Code of Ethics, 2026 (effective 1 April 2026). Members in service have a parallel, lighter ladder under Section 260.
The response checklist puts Section 360 into a signable working paper: matter identification, the seven-step table with WP references, the Sec 143(12) / ADT-4 interface, and a partner conclusion.
CORAA’s journal-entry testing and scrutiny surface the anomalies that start these conversations — start free: your first audit is on us.
NOCLAR — Responding to Non-Compliance with Laws and Regulations — comprises Sections 260 (members in service) and 360 (members in practice) of the ICAI Code of Ethics, adopted from the IESBA Code with India-specific modifications. It prescribes a structured response when an auditor identifies or suspects a client’s non-compliance with any law that bears on the financial statements or is otherwise significant.
From 1 October 2022, to audit engagements of listed entities. The Code of Ethics, 2026 (effective 1 April 2026) extends it to material subsidiaries of listed entities as well. Other engagements remain governed by SA 250 and the statutory duties in the Companies Act — the seven-step ladder is not compulsory there.
They run in parallel. Where the non-compliance is a fraud by officers or employees: ₹1 crore or more requires reporting to the Board or Audit Committee (45-day reply window) and onward to the Central Government in Form ADT-4; below ₹1 crore, to the Audit Committee or Board with disclosure in the Board’s Report. Sec 143(12) is statutory — the Code’s confidentiality provisions cannot displace it, which is exactly why NOCLAR step 6 in India points at disclosure "where required by law".
No. SA 250 is an auditing standard about obtaining evidence and responding to identified non-compliance within the audit; NOCLAR is an ethical framework about the member’s professional responsibilities, including escalation and the decision to stay or go. In a listed-entity audit both apply — SA 250 drives the audit response, Section 360 drives the ethical one, and the documentation should show each.
Yes. NOCLAR was part of the 2019 (12th edition) Code effective 1 July 2020, but its provisions were deferred — along with Fees-Relative-Size and Tax Services to Audit Clients — and made applicable from 1 October 2022 with the India modifications, notably restricting authority disclosure to what law requires and limiting applicability to listed-entity audits.
