Fraud and going concern

What is the difference between fraud and error (per ISA UK 240 & Fraud Act 2006)?

• Fraud: Intentional deception leading to material misstatement — includes false representation, failure to disclose, or abuse of position.

• Error: Unintentional misstatement — e.g. calculation mistake, oversight, misinterpretation of facts.

• Key difference: Intent.

What are the two types of audit-relevant fraud?

• Fraudulent Financial Reporting (FFR)

  • Fictitious/late journal entries

  • Premature revenue recognition

  • Biased accounting estimates

  • High risk to “true and fair view”

• Misappropriation of Assets

  • Theft or misuse of company assets, hidden in records

  • Often smaller amounts, but can be material in total

What is the Expectation Gap in relation to fraud?

• Public belief: Auditors detect all fraud.

• Reality: Auditors provide reasonable assurance, not absolute certainty.

• Why it exists:

  • Sampling is used — not every transaction checked

  • Audit evidence is persuasive, not conclusive

  • Fraud often involves collusion or management override

  • Auditors focus on financial statements, not full fraud investigations

Who is responsible for preventing and detecting fraud?

• Primary responsibility: Management & Those Charged with Governance (TCWG)

  • Set tone at the top

  • Design, implement, and monitor internal controls

  • Establish audit committees and whistleblowing channels

• Auditor’s role:

  • Identify and assess fraud risks

  • Design procedures to respond to risks

  • Maintain professional scepticism

  • Report significant matters to TCWG

  • Not responsible for prevention — only evaluation and testing

What does ISA (UK) 240 require auditors to do regarding fraud?

• Team brainstorming: Discuss “how and where could fraud happen here?”

• Build unpredictability: Surprise tests, unannounced visits, changing sample methods

• Address management override (J-E-U):

  • Journal entries: Test unusual/late/top-side postings

  • Estimates: Review for bias, compare actual vs forecast

  • Unusual transactions: Check business purpose, related parties

• Document and communicate: Report findings to audit committee

What are common red flags for management override?

• Period-end manual journals (e.g. 23:57 postings)

• Memos saying “timing adjustment” or “everyone does this”

• Round-sum entries

• Income/expense moved between periods without business reason

• Profit rising but cash flow flat or falling

• Complex deals with no clear benefit

what is the fraud triangle

1. Pressure / Incentive: Financial targets, bonuses, debt covenants, poor performance

2. Opportunity: Weak controls, poor segregation of duties, complex structures, lack of oversight

3. Rationalisation: “It’s just timing”, “We’ll fix it next year”, “Everyone does it”

• All three present → high fraud risk

What are auditor obligations under ISA (UK) 250 (Laws & Regulations)?

• Direct-effect laws (tax, Companies Act): Obtain sufficient evidence of compliance

• NOCLAR (Non-Compliance):

  • Identify possible non-compliance

  • Escalate internally / to regulators where required

  • Communicate to TCWG

• Bribery Act 2010 red flags:

  • “Consultancy fees” to offshore entities

  • Facilitation payments

  • Unusual payments / unclear purpose

• Note: Confidentiality rules apply — no “tipping off”

What is the definition and time horizon for going concern?

• Definition: The assumption the company will continue in business for the foreseeable future, without liquidation or need to restructure.

• Timeframe: At least 12 months from the date the financial statements are approved.

Split of responsibilities: Management vs Auditor for Going Concern

• Management:

  • Assess going concern status

  • Disclose material uncertainties

  • Prepare accounts on going concern basis unless liquidation is planned

• Auditor:

  • Evaluate management’s assessment

  • Test assumptions and forecasts

  • Review post-balance sheet events

  • Form an opinion and report appropriately

What evidence do auditors review for going concern?

• Cash flow forecasts (monthly detail)

• Profit & loss / balance sheet projections

• Financing facilities / availability of funds

• Covenant compliance / headroom

• Supplier payment terms / ability to operate

• Post-year-end events that confirm or contradict forecasts

What testing approaches are used for going concern?

• Challenge assumptions: Margins, volumes, cost savings — are they realistic?

• Sensitivity / stress testing: What happens if sales fall X% or costs rise Y%?

• Post-balance sheet review: Check actual performance vs forecast

• Reverse stress testing: Work backwards — what would cause failure?

What are the 3 possible reporting outcomes under ISA (UK) 570?

• Going concern appropriate, NO material uncertainty

  • Unmodified opinion

  • Include UK standard paragraph: “Conclusions relating to Going Concern”

• Going concern appropriate, WITH material uncertainty

  • Unmodified opinion

  • Add MURGC paragraph (Material Uncertainty Related to Going Concern)

  • Not a qualification — just disclosure

• Going concern basis inappropriate OR disclosures inadequate

  • Modified opinion (Qualified or Adverse)

  • Adverse if basis is wrong (pervasive misstatement)

What is sustainability assurance?

An independent examination of sustainability information to enhance the credibility and reliability of reported data

What is the purpose of sustainability assurance?

• verify that sustainability disclosures are accurate

• check that reporting follows appropriate frameworks

• identify material misstatements

• build stakeholder confidence in reported information

“robust assurance processes over ESG data improves reliability of information reported”

Why do we need assurance over sustainability information?

Because there is a problem with greenwashing where companies may

• Overstate their environmental achievements

• pick favourable metrics

• use inconsistent measurement methods

• make dorward-looking claims without substance

Assurance therefore provides

• independent verification

• consistency reporting

• comparable information across companies

• Trust for decision-making