NOCLAR Response Checklist — Seven Steps
NOCLAR RESPONSE WORKING PAPER — SECTION 360, ICAI CODE OF ETHICS
Entity: {{client_name}} · Year ended: {{period_end}} · Prepared by: __________ · Reviewed by: __________
Purpose: document the response to identified or suspected non-compliance with laws and regulations (NOCLAR) under Section 360 of the ICAI Code of Ethics. Applicability: audit engagements of listed entities (extended by the Code of Ethics, 2026 to material subsidiaries of listed entities). Under the ICAI modifications, disclosure to an authority that overrides confidentiality is made only where required by law — e.g. Sec 143(12) of the Companies Act 2013.
Part A — The matter
| Particulars | Details |
|---|
| Nature of the identified / suspected non-compliance | |
| Law or regulation involved | |
| How the matter came to attention | |
| Period covered and amounts involved (₹) | |
| Management / employees / TCWG involvement, if any | |
| Potential effect on the financial statements | |
Part B — The seven-step response
| Step | What Section 360 requires | Done (Y/N) | WP ref |
|---|
| 1 · Obtain an understanding | Nature of the act, the circumstances, and how the law or regulation applies | | |
| 2 · Discuss with management | Raise with the appropriate level of management and, where appropriate, those charged with governance | | |
| 3 · Advise timely action | Rectify, remediate or mitigate the consequences; deter future occurrence; disclose to an authority where required by law | | |
| 4 · Evaluate the response | Assess the appropriateness and timeliness of management’s and TCWG’s response | | |
| 5 · Determine further action | Consider whether further action is needed in the public interest — including the effect on the auditor’s report and continued association | | |
| 6 · Disclose where law requires | India modification: disclosure overriding confidentiality only where a law requires it — see the Sec 143(12) interface in Part C | | |
| 7 · Document | The matter, discussions held, responses received, and the judgments and conclusions reached | | |
Part C — Sec 143(12) Companies Act interface
Where the non-compliance involves fraud by officers or employees of the company, the reporting duty under Sec 143(12) read with Rule 13 of the Companies (Audit and Auditors) Rules 2014 operates alongside NOCLAR:
- Fraud involving ₹1 crore or more: report to the Board/Audit Committee seeking their reply within 45 days, then forward the report with their reply to the Central Government in Form ADT-4.
- Fraud below ₹1 crore: report to the Audit Committee or Board; the Board discloses it in the Board’s Report.
- The Sec 143(12) duty is statutory and cannot be displaced by the Code’s confidentiality provisions.
Part D — Conclusion
Conclusion on the matter (response adequate / further action taken / effect on the auditor’s report / withdrawal considered): ____________________________________________
| Prepared by | Reviewed by | Engagement partner |
|---|
| | |
