EVALUATION AND RESPONSE TO RISK OF FRAUD
6.1 INTRODUCTION
According to SA 240, “The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements”, the objectives of the auditor are:
(a) To identify and assess the risks of material misstatement in the financial statements due to fraud
(b) To obtain sufficient appropriate audit evidence about the assessed risks of material misstatement due to fraud, through designing and implementing appropriate responses; and
(c) To respond appropriately to identified or suspected fraud. The purpose of SA 240 is to establish standards and provide guidance on the auditor’s responsibility to consider fraud in an audit of financial statements. The Standard also expands on how the standards and guidance in SA 315 “Identifying and Assessing the Risks of Material Misstatement Through Understanding the Entity and Its Environment”, and SA 330 “The Auditor’s Responses to Assessed Risks”, are to be applied in relation to the risks of material misstatement due to fraud. The standards and guidance in SA 240 are intended to be integrated into the overall audit process.
6.1.1 The Boundary of Audit Responsibility in Relation to Fraud
The auditor’s responsibility in relation to fraud must be understood within the broader framework of reasonable assurance and the inherent limitations of an audit. A statutory audit is designed to provide reasonable assurance that the financial statements, taken as a whole, are free from material misstatement, whether caused by fraud or error. It is not designed to establish whether fraud has occurred in a legal sense, nor to determine individual culpability or quantify loss for legal purposes.
The audit process is risk-based, materiality-driven, and reliant upon selective testing of transactions, evaluation of internal controls, and professional judgment. Sampling techniques, the persuasive rather than conclusive nature of audit evidence, the possibility of management override of controls, and the risk of collusion collectively create inherent limitations. Even when an audit is properly planned and performed in accordance with the Standards on Auditing, there remains an unavoidable risk that some material misstatements, particularly those arising from sophisticated fraud schemes, may not be detected.
The subsequent discovery of fraud, therefore, does not, by itself, indicate that the audit was deficient. The assessment of audit quality depends upon whether the auditor identified and assessed fraud risks appropriately, designed responsive procedures in accordance with SA 240, exercised professional skepticism, obtained sufficient and appropriate audit evidence, and discharged statutory reporting obligations where required.
It is equally critical to reiterate that primary responsibility for the prevention and detection of fraud rests with management and those charged with governance. The auditor’s role is not preventative but responsive. The auditor assessees risk, evaluates the adequacy of internal controls relevant to financial reporting, performs audit procedures designed to address assessed risks of material misstatement due to fraud, and reports identified or suspected fraud in accordance with the Companies Act, 2013 and applicable auditing standards.
This distinction between assurance and investigation is foundational. A statutory audit operates within defined professional boundaries. When circumstances indicate matters extending beyond those boundaries, different mechanisms, including internal investigation or forensic engagement, may become necessary.
6.2 CHARACTERISTICS OF FRAUD
Misstatements in the financial statements can arise from error or fraud. The distinguishing factor between error and fraud is whether the underlying action that results in the misstatement of the financial statements is “intentional or unintentional”. However, if a material error is detected but then remains uncorrected by the client, it is no longer unintentional!
The term ‘fraud’ refers to an intentional act by one or more individuals among management, those charged with governance, employees or third parties involving the use of deception to obtain an unjust or illegal advantage.
Explanation to Section 447 of the Companies Act, 2013 defines fraud as: (i) “fraud” in relation to affairs of a company or any body corporate, includes any act, omission, concealment of any fact or abuse of position
committed by any person or any other person with the connivance in any manner, with intent to deceive, to gain undue advantage from, or to injure the interests of, the company or its shareholders or its creditors or any other person, whether or not there is any wrongful gain or wrongful loss;
(ii) “wrongful gain” means the gain by unlawful means of property to which the person gaining is not legally entitled;
(iii) “wrongful loss” means the loss by unlawful means of property to which the person losing is legally entitled.
Although fraud is a broad concept, the auditor is concerned with fraud, be it alleged, suspected or proven, which results in a material misstatement in the financial statements. As such an auditor does not make a legal determination as to whether fraud has actually occurred.
The auditor is concerned with two types of intentional misstatements: (a) misstatements resulting from fraudulent financial reporting and (b) misstatements resulting from misappropriation of assets.
6.3 FRAUD TRIANGLE
The fraud triangle is a framework commonly used in auditing to explain the motivation behind an individual’s decision to commit fraud. The fraud triangle outlines three components that contribute to increasing the risk of fraud whether it relates fraudulent financial reporting or misappropriation of assets. The three components are: (1) opportunity, (2) incentive, and (3) rationalization.
To explain the fraud triangle:
Incentive or pressure to resort to fraudulent financial reporting (for example, overstatement of revenue) may exist when management is under pressure, from internal or external sources, to achieve an expected (and probably unrealistic) earnings target or financial outcome, particularly when the consequences to management for not achieving the target can be significant. Individuals may have an incentive to misappropriate assets if they are living beyond their means.
A perceived opportunity to conduct fraud may exist when an individual believes internal control can be overridden. For example, the individual may be in a position of authority or is aware of specific deficiencies in the internal control system.
Rationalization is the mindset of the fraudster that justifies him to commit fraud. When a wrongful act is justified, the fraudster is emboldened to carry out such acts.
6.4 TYPES OF FRAUD
As mentioned above, the auditor is concerned with two types of frauds:
u misstatements resulting from fraudulent financial reporting; and
u misstatements resulting from misappropriation of assets.
6.4.1 Fraudulent Financial Reporting
Fraudulent financial reporting involves intentional misstatements including omissions of amounts or disclosures in financial statements to deceive the users of the financial statements.
Fraudulent financial reporting often involves management override of controls that otherwise may appear to be operating effectively.
Intentional misstatement may be committed by:
u manipulation, falsification (including forgery), or alteration of accounting records or supporting documentation from which the financial statements are prepared; (example: recording fictitious sales)
u misrepresentation in, or intentional omission from, the financial statements of events, transactions or other significant information; (example: not disclosing significant demands/contingent liabilities)
u intentional misapplication of accounting principles relating to amounts, classification, manner of presentation, or disclosure. (example: disclosing significant current liabilities as non-current to depict a better position)
Management may override controls by:
u recording fictitious journal entries, particularly close to the end of an accounting period to manipulate operating results or achieve other objectives;
u inappropriately adjusting assumptions and changing judgments used to estimate account balances; (example: not recording appropriate provision for doubtful trade receivables in contravention of entity’s policy)
u omitting, advancing or delaying recognition in the financial statements of events and transactions that have occurred during the reporting period; (example: recording sales pertaining to next financial year)
u concealing, or not disclosing, facts that could affect the amounts recorded in the financial statements; (example: crystallization of a major demand)
u engaging in complex transactions that are structured to misrepresent the financial position or financial performance of the entity; and
u altering records and terms related to significant and unusual transactions.
6.4.2 Misappropriation of assets
Misappropriation of assets involves the theft of entity’s assets. While more often it is perpetrated by employees in relatively small amounts, it can also involve management.
Misappropriation of assets may be committed in a variety of ways:
u embezzling receipts (for example, misappropriation of collections from debtors or diverting receipts in respect of written off accounts to personal bank accounts);
u stealing physical assets or intellectual property (for example, stealing inventory for personal use or for sale, stealing scrap for resale, stealing customer lists or company research data, colluding with a competitor by disclosing bid details in return for payment);
u causing an entity to pay for goods and services not received (for example, payments made to fictitious vendors, kickbacks paid by vendors to the entity’s purchasing team in return for inflating prices, payments to ‘ghost’ employees); and
u using an entity’s assets for personal use (for example, using the entity’s assets as collateral for a personal loan or a loan to a related party).
6.5 RESPONSIBILITY FOR THE PREVENTION AND DETECTION OF FRAUD
The primary responsibility for the prevention and detection of fraud rests with Those Charged With Governance (‘TCWG’) and the management of
the entity. It is important that the management with the oversight of TCWG place a strong emphasis on fraud prevention and detection. This can be achieved by:
u Creating, maintaining, communicating, and demonstrating a culture of honesty and ethical behaviour, which includes setting the proper tone; creating a positive workplace environment; hiring, training and promoting appropriate employees; requiring periodic confirmation by employees of their responsibilities and taking appropriate action in response to actual, suspected or alleged fraud;
u Establish a system of internal control and maintain policies and procedures to assist in achieving the orderly and efficient conduct of the entity’s business;
u Establishing and maintaining controls:
n to ensure that the financial statements give a true and fair view in accordance with the applicable financial reporting framework and managing risks that may give rise to material misstatements in those financial statements;
n to provide reasonable assurance with regard to reliability of financial reporting, effectiveness and efficiency of operations and compliance with applicable laws and regulations;
u install an effective accounting system;
6.6 RESPONSIBILITIES OF THE AUDITOR
An auditor is responsible for obtaining reasonable assurance that the financial statements taken as a whole are free from material misstatement, whether caused by fraud or error. However, as described in SA 200, due to inherent limitations of an audit, there is an unavoidable risk that some material misstatements of the financial statements will not be detected.
An audit properly planned and performed in accordance with the standards of auditing may still fail to detect a material misstatement particularly those resulting from fraud involving forgery, deliberate failure to record transactions, intentional misrepresentations to the auditor or collusion.
The auditor’s ability to detect a fraud depends on factors such as:
u the skillfulness of the perpetrator;
u the frequency and extent of manipulation;
u the degree of collusion involved;
u the relative size of individual amounts manipulated; and
u the seniority of those individuals involved.
An auditor may be able to identify potential opportunities for fraud to be perpetrated; however, it is difficult for an auditor to determine whether
misstatements in judgment areas such as accounting estimates are caused by fraud or error. Furthermore, the risk of the auditor not detecting a material misstatement resulting from management fraud is greater than for employee fraud, because management is frequently in a position to directly or indirectly manipulate accounting records or override control procedures to present fraudulent financial information.
6.7 PLANNING TO DETECT FRAUD
(a) Professional Skepticism
The auditor, when obtaining reasonable assurance, is responsible for maintaining an attitude of professional skepticism throughout the audit. Professional skepticism is an attitude that includes a questioning mind and a critical assessment of audit evidence.
SA 240, requires the auditor to maintain an attitude of professional skepticism throughout the audit, recognizing the possibility that a material misstatement due to fraud could exist, notwithstanding the auditor’s past experience with the entity about the honesty and integrity of management and those charged with governance. The auditor is not expected to fully disregard past experience with the entity but should maintain an attitude of professional skepticism, as there may have been changes in circumstances in the entity. When making inquiries and performing audit procedures, the auditor should exercise professional skepticism and should not be satisfied with less than persuasive audit evidence based on a belief that management and those charged with governance are honest and have integrity. During the audit, the auditor considers the reliability of the information to be used as audit evidence and unless the auditor’s work reveals evidence to the contrary, the auditor may accept records and documents as genuine. However, if conditions identified during the audit causes the auditor to believe that a document may not be authentic or that terms in a document have been modified, the auditor should investigate further, for example confirming directly with the third party.
(
b) Audit Team Discussions
An important part of gathering information about fraud risk factors and effectively utilising the firm’s knowledge of the entity is sharing that information with the other members of the audit team. In conducting risk assessment procedures, the audit team members may identify a fraud risk factor that relates to one of the fraud triangle elements. However, it is less likely that any one team member will identify all fraud risk factors. For this reason, it is very important for the audit team to continually discuss their findings throughout the audit. The discussion should occur setting aside beliefs that the audit team members may have that management and those charged with governance are honest and have integrity.
This discussion amongst audit team members should place particular emphasis on how and where the entity’s financial statements might be susceptible to fraud.
Audit team discussions may include matters such as:
u How management could perpetrate and conceal fraudulent financial reporting, for example earnings management;
u How the entity’s assets could be misappropriated;
u Fraud Triangle in the context of the entity;
u Any allegations of fraud that have come to the auditor’s attention
u Specific areas of vulnerability such as management estimates, revenue recognition, use of journal entries, transactions with related parties, etc.
u Consideration of fraud risk factors.
(
c) Risk Assessment Procedures
The auditor should perform the following procedures for identifying risks of material misstatement due to fraud, at the financial statement and the assertion level:
u making inquiries of management, of those charged with governance, internal auditor, and of others within the entity as appropriate:
n to determine if they have knowledge of any actual, suspected, or alleged fraud affecting the entity and their assessment of the risk of fraud;
n management’s assessment of the risk that the financial statements may be materially misstated as a result of fraud;
n management’s process for identifying and responding to the risks of fraud in the entity, including any particular risks of fraud that management has identified or account balances, classes of transactions or disclosures for which a risk of fraud is likely to exist.
n management’s communication, if any, to those charged with governance regarding its processes for identifying and responding to the risks of fraud in the entity;
n management’s communication, if any, to employees regarding its views on business practices and ethical behaviour;
u obtaining an understanding of how those charged with governance exercise oversight of management’s processes for identifying and responding to the risks of fraud and the internal control that management has established to mitigate these risks;
u considering whether one or more potential fraud risks are present; u considering any unusual or unexpected relationships that have been identified in performing analytical procedures, including those related to revenue accounts;
u considering other information (such as interim financial information or information gained from client acceptance and reacceptance procedures) that may be helpful in identifying the risks of material misstatement due to fraud; and
u evaluating whether the information obtained from the other risk assessment procedures and related activities performed indicates that one or more fraud risk factors are present. While fraud risk factors may not necessarily indicate the existence of fraud, they have often been present in circumstances where frauds have occurred and therefore may indicate potential risks of material misstatements due to fraud.
An illustrative questionnaire to identify and assess the risk of fraud is given in Appendix 2 to this Chapter. Further, questionnaire as suggested in Guidance Note on Reporting on Fraud under section 143(12) of the Companies Act, 2013 issued by the ICAI is given in Appendix 1 to this Chapter.
(
d) Evaluation of Fraud Risk Factors
The auditor should evaluate whether the risk assessment procedures and related activities (such as preliminary analytical procedures, client acceptance/continuance procedures, etc.) performed indicate presence of one or more fraud risk factors. Existence of fraud risk factors may not necessarily indicate existence of fraud but they have often been present in circumstances where frauds have occurred. The presence of fraud risk factors may affect auditor’s assessment of the risk of material misstatements.
Appendix I to SA 240 provides examples of fraud risk factors related to fraudulent financial reporting and misappropriation of assets. The fraud risk factors in Appendix I to SA 240 have been classified based on the fraud triangle:
u Incentive/pressure
u Opportunities
u Attitudes/rationalization
While the examples of fraud risk factors given in the Appendix I to SA 240 cover a broad range of situations, these are only examples and the auditor may identify additional or different risk factors. Some examples of fraud risk factors are given below:
Fraudulent Financial Reporting
Incentives/Pressure
u Excessive pressure exists for management to meet the requirements or expectations of third parties:
n Marginal ability to meet exchange listing requirements or debt repayment or other debt covenant requirements
n Need to obtain additional debt or equity financing to stay competitive
Opportunities
u Significant related-party transactions not in the ordinary course of business or with related entities not audited or audited by another firm.
u Assets, liabilities, revenues, or expenses based on significant estimates that involve subjective judgment or uncertainties that are difficult to corroborate;
Rationalization
u Excessive interest by management in maintaining or increasing the entity’s stock price or earnings trend;
u Recurring attempts by management to justify marginal or inappropriate accounting on the basis of materiality.
Misappropriation of Assets
Incentives/Pressure
u Personal financial obligations may create pressure on management or employees with access to cash or other assets susceptible to theft to misappropriate those assets.
Opportunities
u Large amounts of cash on hand or processed
u Inadequate internal control over assets
Rationalization
u Behaviour indicating displeasure or dissatisfaction with the entity or its treatment of the employee
u Tolerance of petty theft
u Disregard for the need for monitoring or reducing risks related to misappropriation of assets.
Fraud risk factors cannot be ranked in order of importance. The significance of fraud risk factors varies widely. Not all examples are relevant in all
circumstances, and some may be of greater or lesser significance in entities of different size or with different ownership characteristics or circumstances. Accordingly, the determination of whether a fraud risk factor is present and whether it is to be considered in assessing the risks of material misstatement of financial statements due to fraud requires the exercise of professional judgment.
(
e) Examples of warning signs
Some of the warning signs that an auditor should be aware of that may indicate the possibility of a material misstatement in the financial statement are:
u Transactions are not recorded in a complete or timely manner or are improperly recorded as to amount, accounting period, classification, or entity policy.
u Unsupported or unauthorized balances or transactions.
u Last minute adjustments that significantly affect financial results.
u Evidence of employees’ access to systems and records inconsistent with that necessary to perform their duties as per delegation of authority.
u Missing documents.
u Documents that appear to have been altered.
u Unavailability of documents other than photocopied documents when original documents are expected to exist.
u Significant unexplained items on reconciliations (example with vendors, customers)
u Unusual balance sheet changes or changes in trends or important financial statement ratios or relationships, for example receivables growing faster than revenues.
u Inconsistent, vague, or implausible responses from management or employees arising from inquiries or analytical procedures.
u Missing inventory or physical assets of significant magnitude.
u Denial of access to records, facilities, certain employees, customers, vendors, or others from whom audit evidence might be sought.
u Undue time pressures imposed by management to resolve complex or contentious issues.
u Unusual delays by the entity in providing requested information.
u Unwillingness to provide access to key electronic files for testing through the use of Computer Assisted Audit Techniques (CAATs).
u An unwillingness to add or revise disclosures in the financial statements to make the financial statements more complete and understandable.
u An unwillingness to address identified deficiencies in internal control on a timely basis.
u Unwillingness by management to permit auditors to meet privately with those charged with governance (example chairman of the audit committee).
u Aggressive accounting policies or accounting policies that appear to be at variance with industry practice.
u Frequent changes in accounting estimates that do not appear to result from changes in circumstances.
Examples of warning signs that an auditor should be aware of that may indicate employee fraud
u Known financial pressures, alcohol or drug addictions
u Sudden change in lifestyle not commensurate with the salary or designation (living beyond means)
u Refusal to take leaves or work with other colleagues
u Employees working outside of normal hours even when not required
u Unusually close association with vendors or customers
(f) Revenue Recognition
Material misstatements due to fraudulent financial reporting often results from an overstatement of revenue (for example, through premature revenue recognition or recording fictitious revenues) or an understatement of revenues (for example, through improperly shifting revenues to a later period). Therefore, auditor shall presume that there is risk of fraud in revenue recognition and consider which types of revenue, revenue transactions or assertions give rise to such risks. The risk of fraud in revenue recognition may be greater in some entities than others. If the auditor does not identify revenue recognition as risk of material misstatement due to fraud, SA 240 requires the auditor to document the reasons supporting such conclusion.
(g) Management override of Controls
Management is in a unique position to perpetrate fraud because of management’s ability to manipulate accounting records and prepare fraudulent financial statements by overriding controls that otherwise appear to be operating effectively. Although the level of risk of management override of controls varies from entity to entity, the risk is nevertheless present in all entities. Due to the unpredictable way in which such override could occur, management override of controls is a risk of material misstatement due to fraud.
AUDIT OF FINANCIAL STATEMENTS
AUTHOR : Pranav Jain
PUBLISHER : Taxmann
DATE OF PUBLICATION : April 2026
EDITION : 5th Edition | 2026
ISBN NO : 9789371268721
NO. OF PAGES : 1280
BINDING TYPE : Paperback
Rs. 2,995
DESCRIPTION
Audit of Financial Statements is a structured practitioner's manual that translates the Standards on Auditing, the Companies Act 2013, CARO 2020 and Indian Accounting Standards into a single, end-to-end audit methodology. Written from the standpoint of an inspection-aware practising auditor, it positions the statutory audit as a documented, risk-driven engagement whose quality must be defensible before NFRA, QRB, FRRB and audit committees.
The 5th Edition reflects the regulatory shift from broad supervisory oversight to detailed practice-oriented guidance—mapping AQMM Version 2 expectations to engagement-level documentation, and operationalising NFRA's audit practice toolkits, structured RoMM templates and Auditor–Audit Committee Interaction Series circulars into procedures, checklists and working papers. This book is intended for the following audience:
• Practising Chartered Accountants
• Audit Firm Partners and Engagement Quality Reviewers
• Engagement Teams, Managers and Articled Assistants
• Audit Committee Members
• Internal Auditors, Technical Reviewers, Peer Reviewers and Concurrent Auditors
• Finance Controllers and CFOs
• Regulatory and Oversight Personnel
The Present Publication is the 5th Edition | 2026, amended up to 15th April 2026. It is authored by CA. Pranav Jain with the following noteworthy features:
• [Operational Risk-Based Methodology] Inherent risk, control risk, detection risk, RoMM and audit response are linked through the SA 315 → SA 330 chain so that every documented procedure traces back to an identified risk and a designed response
• [AQMM v2 Documentation Mapping] Approximately 210 documentation points under AQI 1.10 are mapped through expanded checklists and templates spanning client acceptance, engagement letters, planning, testing, journal entry review, completion and file archival
• [NFRA Practice-Oriented Insights] Integrated throughout, including the Circular dated 7th January 2026 on SA 260 and SA 265 implementation, the Audit Practice Toolkits, the illustrative Audit Strategy Memorandum format, the structured RoMM templates and the Auditor–Audit Committee Interaction Series
• [Statutory Reporting Integration] CARO 2020 clauses, Companies Act 2013 requirements and audit trail reporting are linked to the corresponding audit procedures within each substantive chapter rather than treated as a separate compliance silo
• [Disclosure-Led Architecture] Schedule III (Division 1) requirements and the relevant Accounting Standard are presented alongside audit procedures for each balance sheet and profit and loss item, so that recognition, measurement and presentation are evaluated together
• [Model Accounting Policies] Aligned with the Companies (Accounting Standards) Rules 2021 and Schedule III (Division 1)—drafted as illustrative rather than mechanical templates to preserve entity-specific professional judgment
• [New Labour Codes] Recognition, measurement, classification and disclosure implications addressed substantively for payroll, social security contributions, gratuity and contingent liabilities, drawing on FAQs issued by the ASB and guidance issued by the AASB
• [Engagement-Grade Working Papers] Overall Audit Strategy Memorandum, materiality calculation template, fraud risk assessment, IT general controls questionnaire, walkthrough templates, engagement quality control review forms, going concern evaluation checklist, written representation templates and management letter formats
• [Inspection-Driven Deficiency Areas] Weak SA 315–SA 330 linkage, journal entry testing, ledger scrutiny, related party evaluation, accounting estimates documentation and the use of standardised or boilerplate working papers are addressed directly
• [Illustrative Audit Reports] Independent auditor's report, audit report on consolidated financial statements, audit report for trusts, CARO report, CARO checklist and reporting on the audit trail rule—drafted for direct adaptation
• [Concept-Led Explanations] Auditing standards requirements, key concepts and procedures explained through structured worked illustrations and examples rather than abstract restatement
