Under AU-C 240, an auditor who identifies a misstatement evaluates whether it indicates fraud (paragraph .35), reassesses risk if senior management may be involved (.36), considers whether the audit can continue (.38), tells the appropriate level of management on a timely basis (.39), tells those charged with governance when management, employees with significant internal control roles, or others causing a material misstatement are involved (.40), and determines whether any duty exists to report outside the entity (.42). Under AS 2401 for issuers, fraud involving senior management, and fraud that causes a material misstatement, must be reported directly to the audit committee in a timely manner before the auditor's report is issued (.79).
The sequence below follows current AU-C 240. SAS 151 replaces AU-C 240 for audits of periods ending on or after December 15, 2028 and adds explicit requirements for responding to fraud or suspected fraud; see what SAS 151 amends and when.
Step 1: Is the misstatement indicative of fraud?
Paragraph .35 requires the auditor, on identifying a misstatement, to evaluate whether it indicates fraud. If so, the auditor evaluates the implications for other aspects of the audit, in particular materiality, management and employee integrity and the reliability of management representations, "recognizing that an instance of fraud is unlikely to be an isolated occurrence."
Paragraph A60 gives the reason: fraud involves incentive or pressure, a perceived opportunity and some rationalization, so numerous misstatements at one location may indicate a fraud risk even if their sum is not material. See uncorrected misstatements for accumulation.
Paragraph .03 says the auditor may suspect or, in rare cases, identify fraud but does not make legal determinations.
Step 2: Reassess when senior management may be involved
Paragraph .36 applies to any misstatement, material or not, that the auditor has reason to believe is or may be the result of fraud involving management, in particular senior management. The auditor reevaluates the assessment of fraud risks and the effect on the nature, timing and extent of procedures, and considers whether circumstances indicate possible collusion involving employees, management or third parties when reconsidering the reliability of evidence already obtained.
Paragraph A61 says an otherwise insignificant fraud may be significant if it involves senior management, because doubts arise about representations and the genuineness of records. Paragraph .37 adds that if the auditor concludes, or cannot conclude, that the statements are materially misstated due to fraud, the auditor evaluates the implications for the audit, with A62 pointing to AU-C 450 and AU-C 700 for the effect on the opinion.
Step 3: Can the audit continue?
Paragraph .38 applies when identified or suspected fraud brings the auditor's ability to continue into question. The auditor:
- determines the professional and legal responsibilities, including whether a requirement exists to report to the person who engaged the auditor or to regulators
- considers whether to withdraw, when withdrawal is possible under applicable law or regulation
- if withdrawing, discusses the withdrawal and its reasons with the appropriate level of management and those charged with governance, and determines whether a requirement exists to report the withdrawal and reasons to the engaging party or to regulators
Paragraph A64 gives examples: the entity does not take the action the auditor considers necessary even when the fraud is not material, the risk assessment and test results indicate a significant risk of material and pervasive fraud, or the auditor has significant concern about the competence or integrity of management or those charged with governance. A65 says withdrawal cannot be described definitively. A66 says the auditor may consider seeking legal advice when deciding whether to withdraw.
Step 4: Tell management
Paragraph .39 requires communicating a fraud, or information that indicates a fraud may exist, on a timely basis to the appropriate level of management. A68 says this applies even if the matter might be considered inconsequential, such as a minor defalcation by a low-level employee. The appropriate level is ordinarily at least one level above the persons who appear to be involved, and depends on the likelihood of collusion and the nature and size of the suspected fraud.
Step 5: Tell those charged with governance
Paragraph .40 requires communication to those charged with governance on a timely basis when the auditor has identified or suspects fraud involving (a) management, (b) employees with significant roles in internal control, or (c) others, when the fraud results in a material misstatement. If the auditor suspects fraud involving management, the auditor communicates the suspicions and discusses with them the nature, timing and extent of the audit procedures needed to complete the audit. It does not apply when all of those charged with governance are involved in managing the entity.
Paragraph A69 permits oral or written communication, and says that because of the nature and sensitivity of fraud involving senior management, or fraud that results in a material misstatement, the auditor communicates on a timely basis and may consider it necessary to also communicate in writing. A71 says legal advice may be appropriate when there are doubts about the integrity or honesty of management or those charged with governance. Paragraph .41 and A72 add other matters, such as management's response to a fraud. For format, see AU-C 260 required communications.
Step 6: Outside the entity
Paragraph .42 requires the auditor to determine whether a responsibility exists to report the occurrence or suspicion to a party outside the entity. A73 states that the duty of confidentiality may preclude outside reporting, but may be overridden by statute, regulation, courts of law or government financial assistance audit requirements, or waived by agreement. A74 says legal advice may be appropriate. For illegal acts more broadly, see AU-C 250 procedures and response steps.
How does AS 2401 compare for issuers?
AS 2401 paragraph .79 requires that evidence fraud may exist be brought to an appropriate level of management, even if inconsequential. Fraud involving senior management, and fraud by anyone that causes a material misstatement, should be reported directly to the audit committee in a timely manner and before the auditor's report is issued. The auditor also agrees with the audit committee how misappropriations by lower-level employees will be communicated.
- Paragraph .80: if fraud risks have continuing control implications, the auditor considers whether they are significant deficiencies to communicate to senior management and the audit committee, and evaluates whether absent or deficient fraud-risk controls are significant deficiencies or material weaknesses.
- Paragraph .81A: the auditor has a responsibility under certain conditions to disclose possible fraud to the SEC, including in connection with termination of the engagement when the fraud is a reportable event or source of disagreement under Item 304 of Regulation S-K, and reports required under Section 10A(b) of the Securities Exchange Act of 1934 for an illegal act with a material effect.
- Paragraph .82: the auditor also may have a duty to disclose possible fraud to a successor auditor making inquiries, in response to a subpoena, and to a funding agency for audits of entities receiving governmental financial assistance.
What goes in the file?
AU-C 240 paragraph .45 requires documenting communications about fraud made to management, those charged with governance, regulators and others. AS 2401 paragraph .83 requires documenting the nature of communications about fraud made to management, the audit committee and others. Record the facts, the evaluation under .35 to .37, the date and recipients of each communication, legal advice sought, and the effect on procedures and the opinion.
Frequently asked questions
Do small frauds need to be communicated?
To management, yes. Paragraph .39 and A68 apply even to a minor defalcation. Communication to those charged with governance is required for the categories in paragraph .40, and A70 permits it for other employee fraud, preferably agreed with them early in the audit.
Must the auditor withdraw when fraud is found?
No. Withdrawal is considered when fraud or suspected fraud brings the ability to continue into question (paragraph .38).
Should the auditor obtain legal advice?
It may be appropriate when deciding on withdrawal (A66), when integrity of management or governance is in doubt (A71), and when considering outside reporting (A74).
Sources
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit, paragraphs .03, .35 to .42, .45 and application material A60 to A75: https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- PCAOB, AS 2401, Consideration of Fraud in a Financial Statement Audit, paragraphs .79 to .83: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2401
- AICPA, "New Auditing Standard Clarifies and Enhances CPAs' Responsibilities Relating to Fraud in a Financial Statement Audit" (August 19, 2026), on SAS 151 and the effective date for periods ending on or after December 15, 2028: https://www.aicpa-cima.com/news/article/new-auditing-standard-clarifies-and-enhances-cpas-responsibilities-relating-to-fraud-in-a-financial-statement-audit
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error