AU-C section 250, Consideration of Laws and Regulations in an Audit of Financial Statements, covers the auditor's responsibility to consider laws and regulations in a GAAS audit of a nonissuer. It came out of SAS No. 122 and replaced the older guidance on illegal acts. The auditor is not a lawyer and the audit is not a legal compliance review. The standard sets out a limited, risk-based set of procedures and a path to follow if noncompliance is found.
This page paraphrases the standard. The authoritative text is AU-C 250 in AICPA Professional Standards. For governmental audits that also follow Government Auditing Standards, see the Yellow Book (GAGAS) guide, which adds requirements.
What is the objective of AU-C 250?
The auditor's objectives are to obtain sufficient appropriate audit evidence about compliance with the provisions of those laws and regulations generally recognized to have a direct effect on the determination of material amounts and disclosures in the financial statements, to perform specified procedures to help identify instances of noncompliance with other laws and regulations that may have a material effect on the financial statements, and to respond appropriately to noncompliance or suspected noncompliance identified during the audit.
Who is responsible for compliance?
It is management's responsibility, with oversight by those charged with governance, to ensure the entity's operations comply with laws and regulations. The auditor does not take on that responsibility. The auditor's responsibility is to consider laws and regulations as the standard says, and to keep in mind that an audit conducted under GAAS provides reasonable assurance, not a guarantee, that noncompliance will be found. Detection is harder for laws with only a remote link to the financial statements, and noncompliance involving concealment, collusion or override is harder still.
"Noncompliance" here means acts of omission or commission by the entity, intentional or not, that are contrary to the prevailing laws or regulations, including acts by those charged with governance, management or employees on the entity's behalf. It does not cover personal misconduct unrelated to the entity's business.
The two categories of laws and regulations
The standard treats the two categories differently.
| Category | Examples | What the auditor does |
|---|---|---|
| Laws with a direct effect on the determination of material amounts and disclosures | Tax laws, pension laws, and for some entities laws on revenue recognition or funding | Obtain sufficient appropriate evidence of compliance with the provisions that have that direct effect |
| Other laws that do not directly affect the amounts and disclosures but compliance with which may be fundamental to the entity's ability to continue operating, to avoid material penalties or to comply with a license | Operating licenses, solvency requirements, environmental regulations, health and safety rules | Limited to specified procedures: inquiry of management and, where appropriate, those charged with governance about compliance, and inspection of correspondence with licensing or regulatory authorities |
For the second category, the auditor does not search for noncompliance. If the procedures happen to bring noncompliance to light, or the auditor suspects it, the rest of the standard applies.
General understanding and awareness during the audit
The auditor obtains a general understanding of the legal and regulatory framework that applies to the entity and its industry, and of how the entity is complying with it. Typical sources are discussions with management, knowledge of the industry from other engagements, and reading of agreements such as loan covenants and grant conditions.
During the audit the auditor stays alert to the possibility that other audit procedures may bring instances of noncompliance or suspected noncompliance to attention. Examples include reading minutes, inquiring of in-house or external counsel, and inspecting correspondence. Fraud-related procedures can do the same. See AU-C 240.
Written representations
The auditor requests written representations from management, and where appropriate those charged with governance, that they have disclosed to the auditor all known instances of noncompliance or suspected noncompliance whose effects should be considered when preparing the financial statements. This is part of the representation letter under AU-C 580. See the management representation letter template.
What if noncompliance is identified or suspected?
When the auditor becomes aware of information about identified or suspected noncompliance, the auditor must:
- Understand the matter. Obtain an understanding of the nature of the act and the circumstances in which it occurred, and further information to evaluate the possible effect on the financial statements.
- Discuss it with management. If management does not provide enough information that supports compliance, consider the effect on the audit, including the risk assessment and the reliability of management's representations, and evaluate whether legal advice is needed.
- Discuss it with those charged with governance when management is involved or if appropriate. If management is involved, consider whether more senior levels need to be told.
- Evaluate the implications. Consider the effect on the financial statements, including the possible need for financial statement disclosure of contingent liabilities, penalties, or the risk of going concern doubts. If the auditor cannot obtain enough information, evaluate the effect on the opinion.
Where the noncompliance is a possible fraud, AU-C 240 applies too.
Communicating with those charged with governance
Unless all of those charged with governance are involved in managing the entity, and so already aware, the auditor communicates matters involving noncompliance or suspected noncompliance that come to the auditor's attention, other than matters that are clearly inconsequential. If the auditor believes the noncompliance is intentional and material, the auditor communicates it to those charged with governance as soon as practicable. If the auditor suspects that management or those charged with governance are involved, the standard directs the matter to the next higher level of authority where one exists, and the auditor considers legal advice where none does. See AU-C 260.
Reporting consequences
If the auditor concludes that the noncompliance has a material effect on the financial statements and has not been properly reflected, the auditor expresses a qualified or adverse opinion under AU-C 705. If management or those charged with governance prevent the auditor from obtaining sufficient evidence to evaluate whether noncompliance that may be material has occurred, the auditor expresses a qualified opinion or disclaims, based on a scope limitation. If the auditor cannot determine whether noncompliance occurred because of a limitation imposed by circumstances, the auditor evaluates the effect on the opinion in the same way.
If the auditor concludes that circumstances call into question the ability to continue, the auditor considers withdrawing where the law permits, and the professional and legal responsibilities that apply.
Reporting outside the entity
The standard does not itself require the auditor to report identified or suspected noncompliance to an authority outside the entity. The auditor considers whether a responsibility to do so exists. It can arise from law or regulation, from a regulator or funder (for example, in a government audit), or from an inquiry by a successor auditor. The auditor's duty of confidentiality under the AICPA Code of Professional Conduct and state rules may limit what can be disclosed, so legal advice is usually appropriate before disclosing.
The AICPA Code of Professional Conduct includes ethics guidance on responding to noncompliance with laws and regulations. That guidance sits alongside the confidentiality rule in the Code.
Predecessor and successor inquiries
When taking on an initial audit, SAS No. 147 requires the successor auditor to inquire of the predecessor about identified or suspected fraud and about identified or suspected noncompliance with laws and regulations. That requirement sits in AU-C 210.
Documentation
The auditor documents the identified or suspected noncompliance and the results of discussion with management, those charged with governance and others outside the entity. The file should show what was found, what was asked, what was said, and how the auditor decided on the effect on the statements and the report. See AU-C 230.
Looking ahead
SAS No. 151 supersedes AU-C 240 and applies to audits of periods ending on or after December 15, 2028, with early implementation permitted. SAS 151 also amends various other sections of the AU-C literature. Until a firm adopts it, AU-C 250 and AU-C 240 apply as described on this page.
File checks on laws and regulations
These are practice checks, not requirements of the standard. Weaknesses to look for:
- Planning memos that list "laws and regulations" generically without naming the ones that matter for this client
- No inquiry of management about compliance documented for the second category of laws
- Legal letters (see AU-C 501) used as the only source of information on noncompliance
- Representation letters that omit the noncompliance representation
- Noncompliance noted by the team but with no record of whether it was raised with those charged with governance
Related
- AU-C 240 fraud
- AU-C 260 communication with those charged with governance
- Yellow Book (GAGAS) guide
- Management representation letter template
Sources
- AICPA, AU-C Section 250, Consideration of Laws and Regulations in an Audit of Financial Statements (AICPA Professional Standards)
- AICPA, SAS No. 147, Inquiries of the Predecessor Auditor Regarding Fraud and Noncompliance With Laws and Regulations (periods beginning on or after June 30, 2023)
- AICPA, SAS No. 151 (supersedes AU-C 240; periods ending on or after December 15, 2028)
- AICPA, AU-C Sections 210, 230, 240, 260, 501, 580 and 705 (cross-referenced sections)
- AICPA Code of Professional Conduct, confidentiality rule and guidance on responding to noncompliance with laws and regulations
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error