Laws and regulations in a financial statement audit (AU-C 250)

In this lesson you will

Distinguish direct-effect laws from other laws under AU-C 250.06.
Perform the required procedures for each category.
Respond to identified or suspected noncompliance and communicate it.

Responsibility starts with management

AU-C 250.03 places responsibility for compliance with laws and regulations on management, with oversight from those charged with governance. You are not responsible for preventing noncompliance and are not expected to detect it for all laws (AU-C 250.04). Your responsibility is tied to material misstatement of the financial statements.

Two categories

AU-C 250.06 divides laws and regulations into two categories, with different responsibilities.

(a) Direct-effect laws. Provisions generally recognized to have a direct effect on the determination of material amounts and disclosures, such as tax and pension laws. AU-C 250.13 requires sufficient appropriate evidence regarding material amounts and disclosures determined by these provisions. You audit compliance with them the same way you audit any other assertion. Examples: income tax provisions, payroll tax, ERISA funding, sales tax collected, and grant terms that determine revenue.

(b) Other laws. Provisions that do not directly determine amounts and disclosures, but compliance with which may be fundamental to operations, to continuing the business, or to avoiding material penalties: operating licenses, environmental rules, regulatory solvency requirements. For these, AU-C 250.14 limits required procedures to:

inquiring of management and, when appropriate, those charged with governance about whether the entity complies; and
inspecting correspondence, if any, with relevant licensing or regulatory authorities.

AU-C 250.15 requires you to remain alert during the audit to whether other procedures bring noncompliance to your attention. AU-C 250.16 confirms that, absent identified or suspected noncompliance, you are not required to perform other procedures on compliance beyond those listed and the written representation.

Understanding the framework

AU-C 250.12 requires, as part of understanding the entity under AU-C 315, a general understanding of the legal and regulatory framework applicable to the entity and its industry, and how the entity is complying. In practice: ask what licenses, permits and regulators matter, read the regulatory correspondence file, and read minutes for legal matters. The legal letter also supports this work.

When you find or suspect noncompliance

AU-C 250.17 requires you to obtain an understanding of the nature of the act and circumstances, and further information to evaluate the possible effect on the financial statements. AU-C 250.18 requires discussion with management at a level above those involved, if possible, and with those charged with governance when appropriate. If management does not provide sufficient information that the entity is in compliance, consider the need for legal advice.

AU-C 250.20 requires you to evaluate the implications for other aspects of the audit, including risk assessment and the reliability of written representations.

Communication:

AU-C 250.21: communicate matters involving noncompliance to those charged with governance, other than clearly inconsequential matters, unless all of them are involved in management and already aware.
AU-C 250.22: if noncompliance is believed intentional and material, communicate as soon as practicable.
AU-C 250.23: if management or governance is involved, communicate to the next higher level of authority, such as an audit committee or supervisory board.
AU-C 250.27: determine whether you have a responsibility to report to parties outside the entity.

Reporting effects follow AU-C 250.24-.26: qualified or adverse opinions for unreflected material effects; qualified or disclaimed opinions for scope limitations. AU-C 250.28 requires documentation of the noncompliance and the results of discussions.

The AU-C 250 procedures guide has step-by-step response actions.

Worked example

An environmental permit issue

Clearwater Plating, Inc., a metal finishing company, reports pretax income of $1.9 million; materiality is $95,000. During inspection of regulatory correspondence under AU-C 250.14(b), the senior finds a state notice of violation for exceeding wastewater discharge limits, citing penalties of up to $10,000 per day for 21 days.

Maximum exposure: $10,000 x 21 = $210,000, more than twice materiality.

Under AU-C 250.17-.18, the team obtains the full notice and the company's response, and discusses the matter with the CFO and then the board chair, since the plant manager was involved. Management engaged environmental counsel. Counsel's response to the legal letter estimates a settlement of $60,000 to $90,000 and states a loss is probable.

Under ASC 450, the company accrues $60,000, the low end because no amount in the range is a better estimate, and discloses the possible additional $30,000. The team communicates the noncompliance to the board in writing under AU-C 250.21, documents the matter under AU-C 250.28, and adds the permit to next year's risk assessment.

Self-check

Answer each question before you open the answer.

What procedures does AU-C 250.14 require for laws without a direct effect on the financial statements?
Show answer
Inquiry of management and, when appropriate, those charged with governance about compliance, and inspection of correspondence with relevant licensing or regulatory authorities.
Give two examples of direct-effect laws.
Show answer
Tax laws and pension laws, as named in AU-C 250.06(a). They determine amounts and disclosures, so the auditor obtains sufficient appropriate evidence about them like any other assertion.
You suspect the CEO directed an illegal payment. Whom do you communicate with?
Show answer
Because management is involved, communicate with the next higher level of authority, such as the audit committee or board (AU-C 250.23). Also evaluate implications for the reliability of representations (AU-C 250.20) and any duty to report externally (AU-C 250.27).

Sources

AICPA Statements on Auditing Standards, currently effective (AU-C sections)

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error