Many people think the auditor is there to catch thieves. The law and the standards say something more limited. Management must prevent and detect fraud. The auditor must obtain reasonable assurance that the financial statements are free from material misstatement, whether caused by fraud or by error.
That distinction explains much of the expectations gap, and International Standard on Auditing (ISA) 240 spells out what the auditor must do when fraud is suspected.
This topic covers the difference between fraud and error, who is responsible for what, the steps to take when fraud or error is suspected, and how scepticism applies to fraud. Examiners ask for the responsibilities of management and auditor, and for a plan of action on facts that suggest fraud. The topic on forensic auditing later in the course picks up the investigation side.
In 30 seconds
Fraud is intentional: fraudulent financial reporting (falsifying records or deliberately misapplying policies) or misappropriation of assets. Error is unintentional: misapplied policies, oversights, clerical mistakes and misreading of facts. The difference is whether the effect is deliberate. Management and those charged with governance have the primary responsibility to prevent and detect fraud.
The auditor must obtain reasonable assurance that the statements as a whole are free from material misstatement, whether from fraud or error, and is concerned only with material effects on the true and fair view. The audit may deter fraud but is not certain to find it.
When fraud or error is suspected, the auditor assesses extent and impact, considers the effect on other areas and on audit risk, discusses with management, decides what management should do (including legal advice), communicates formally, considers the audit report and considers reporting to the authorities. Scepticism and a team discussion on fraud are required.
Fraud and error
Fraud is an intentional act. ISA 240 identifies two types:
- fraudulent financial reporting, such as falsifying records or documents or deliberately applying accounting policies wrongly; and
- misappropriation of assets.
Both can cause material misstatement in the financial statements.
Error is unintentional. It includes misapplying accounting policies without meaning to, oversights, clerical mistakes and misinterpreting facts.
The key difference is whether the effect on the financial statements is deliberate (fraud) or not (error). For the audit, there may be little difference in impact, because either may affect the true and fair view. The main difference lies in national reporting rules: there may be a duty to report suspicion of fraud but not of error.
Background: ISA 240 describes three conditions that usually exist when fraud occurs, often called the fraud triangle: an incentive or pressure, an opportunity, and a way to rationalise the act. Fraud risk factors are signs of these conditions, and the audit team looks for them when assessing risk.
Who is responsible
Management
Management must prepare financial statements that give a true and fair view. Good governance requires it to set up suitable internal control and governance systems. Management is therefore responsible for preventing and detecting fraud and error.
The auditor
The auditor reports on whether the financial statements give a true and fair view, so is concerned only with fraud and error with a material effect on that view. The auditor must obtain reasonable assurance that the financial statements, taken as a whole, are free from material misstatement, whether caused by fraud or error.
It is not the auditor’s primary responsibility to prevent or detect fraud or error, although the audit may deter it. Auditors may find fraud or error in the course of the work, but they are certain to find it only if it is material and their procedures reach it. Some material misstatements may go undetected because of inherent limitations in any audit and because fraud may be deliberately concealed.
ISA 240 puts the split in two statements. The primary responsibility for preventing and detecting fraud lies with both those charged with governance and management. The auditor conducting an audit under ISAs is responsible for obtaining reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by fraud or error.
| Aspect | Management and those charged with governance | Auditor |
|---|---|---|
| Prevent and detect | Primary responsibility, through internal control | Not primary, though the audit may deter |
| Statements | Prepare them to give a true and fair view | Report on whether they do |
| Size of concern | Any fraud or error | Only material misstatement |
| Level of assurance | Not applicable | Reasonable, not absolute |
Procedures when fraud or error is suspected
- Find the extent and impact. Identify the extent and possible impact on the financial statements, and document the facts fully in the audit file. More testing may be needed to establish the likely extent of the misstatement.
- Consider the wider audit. Consider the possible impact on other areas and on the overall assessment of audit risk. The audit plan may need revising.
- Discuss with management. Discuss the findings with management, whatever the extent, and keep management informed of developments.
- Decide what management should do. Determine the action that management should take, including legal advice where fraud is suspected.
- Communicate formally. Normally at an appropriate level of management. For a company this means the board or the audit committee. If management itself is involved, the auditor should consider legal advice on the best course. In extreme cases, resignation may be appropriate.
- Consider the audit report. Think about the effect on the true and fair view and so on the report to shareholders.
- Consider reporting to the authorities. This must be weighed against the duty of confidentiality.
Scepticism and fraud
- The audit must be performed with a suitable degree of professional scepticism.
- The audit team should discuss the possibility of fraud in the light of the specific features of the engagement.
- Discussions should be held with management about the controls in place to prevent or detect fraud.
- The risks of possible fraud should be identified and their possible effect on the financial statements evaluated.
- Audit procedures should be designed to obtain evidence that fraud which may impair the financial statements has not occurred, or has been detected and corrected or disclosed.
Scepticism is especially important for fraud, because schemes may be sophisticated and well organised, and may involve collusion. ISA 240 requires a continuing questioning mind and alertness to the possibility of fraud. The topic on the expectations gap covers scepticism in more detail.
The rules in more depth
Why the auditor looks only at material fraud
The audit is an opinion on the financial statements as a whole. A small theft that does not change the true and fair view is outside the auditor’s concern, though management should still deal with it. Materiality is the boundary. That is also why the audit cannot be a general fraud search.
Why management fraud is different
If the people to whom the auditor would normally report, management, are involved, the usual route fails. This is why the syllabus points to the board or audit committee, to legal advice and, in an extreme case, to resignation. It also shows why the audit committee is a protection for the auditor.
Why the suspicion steps start with the facts
The first step is to establish extent and impact, and to document it, before any discussion. The auditor needs a clear view of what happened before raising it with management, particularly if management may be involved. Documentation also protects the auditor if the decision is later challenged.
Numbers: only material fraud matters to the opinion
A company has paid ghost workers ₦3 million a year for three years: ₦3 million × 3 = ₦9 million in total. Materiality for the financial statements is ₦25 million. The total is below materiality, so on its own it would not change the opinion. But the auditor must still document it, discuss it with management, consider why controls failed, and ask whether the weakness hides larger frauds.
A fraud by a senior person is often treated as significant even if the amount is small, because it casts doubt on management integrity.
Worked example: a suspected misappropriation
Scenario. During the audit of Prime Steel Ltd, the audit senior finds that inventory records show ₦14 million of steel bars that cannot be located. The storekeeper has authority to adjust the stock records and the warehouse manager signs the counts. Materiality is ₦20 million. The managing director tells the team to treat it as a counting error. Advise on what the team should do.
- Extent and impact. ₦14 million is below materiality of ₦20 million but is 70% of it (₦14 million ÷ ₦20 million). More testing is needed to see whether other items are affected and whether the total could be material. Document the facts fully.
- Wider audit. Weak segregation of duties over stock records raises control risk and fraud risk. Consider revising the audit plan and the assessment of audit risk, with more stock testing.
- Discuss with management. Discuss the findings, but note that the managing director dismisses it without evidence, and a manager may be involved. This calls for caution and scepticism.
- Management action and legal advice. Decide what management should do: investigate, secure the stock. Take legal advice because fraud is suspected.
- Formal communication. Communicate to the board or audit committee in writing, not only to the managing director.
- Audit report and authorities. Consider the effect on the report if the loss is material or the evidence is insufficient, and whether there is a duty to report to the authorities, weighing it against confidentiality.
- Conclusion. The team should not accept the “counting error” explanation without evidence. It should extend testing, escalate to the audit committee, and keep thorough documentation.
How to score full marks
- For responsibility questions, use two columns. Management: prevent and detect, prepare the statements, design controls. Auditor: reasonable assurance on material misstatement, deterrent effect, not a guarantee. State both ISA 240 statements.
- Define the terms by intent. Fraud is intentional, error is not. Give the two types of fraud and the four types of error.
- For action questions, follow the seven steps in order. Link each to a fact. Show why each step is taken.
- Treat management involvement as a special case. Say board or audit committee, legal advice and possible resignation.
- Quote materiality. Show that the auditor is concerned with material effect, and calculate the proportion where figures are given.
- Time. Spend time in proportion to marks.
Common mistakes in the exam
- Saying the auditor is primarily responsible for preventing and detecting fraud.
- Saying the audit gives a guarantee that all fraud will be found.
- Defining fraud by size instead of intent.
- Forgetting that the auditor is concerned with material misstatements only.
- Omitting legal advice and the confidentiality point when considering reporting to authorities.
- Reporting only to the managing director where management may be involved.
- Forgetting to consider the effect on the audit report and on audit risk.
Quick revision
- Fraud: intentional; fraudulent financial reporting and misappropriation of assets. Error: unintentional.
- Management: primary responsibility to prevent and detect. Auditor: reasonable assurance on material misstatement; not primarily responsible.
- Steps: extent and impact; wider audit and risk; discuss; management action and legal advice; formal communication; audit report; authorities.
- Scepticism: team discussion on fraud, controls discussion with management, identify risks, design procedures.
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. The key difference between fraud and error is:
- The amount involved
- Whether the effect is deliberate
- Who finds it
- The year it happened
Show the answer
B. Fraud is intentional.
Question 2. The two types of fraud in ISA 240 are fraudulent financial reporting and:
- Clerical error
- Misappropriation of assets
- Oversight
- Misinterpretation
Show the answer
B. The others are errors.
Question 3. The primary responsibility for preventing and detecting fraud lies with:
- The external auditor
- Those charged with governance and management
- The tax authority
- Shareholders
Show the answer
B. The auditor obtains reasonable assurance about material misstatement.
Question 4. The auditor is concerned with fraud and error that:
- Is of any size
- Has a material effect on the true and fair view
- Is found by staff
- Occurred in earlier years only
Show the answer
B. Materiality limits the auditor’s concern.
Question 5. Which is the first step when fraud is suspected?
- Resign
- Identify the extent and possible impact and document the facts
- Tell the press
- Dismiss the directors
Show the answer
B. More testing may be needed.
Question 6. If management is involved in the suspected fraud, the auditor should consider:
- Ignoring it
- Legal advice, and in extreme cases resignation
- Telling management first
- Altering the audit plan only
Show the answer
B. Formal communication goes to the board or audit committee.
Question 7. Reporting suspicion of fraud to the authorities must be considered in the context of the auditor’s:
- Fees
- Duty of confidentiality
- Holiday plans
- Staffing
Show the answer
B. Confidentiality is weighed against any duty to report.
Question 8. Which is NOT an example of error?
- Unintentional clerical mistake
- Oversight
- Falsifying records
- Misinterpreting facts
Show the answer
C. Falsifying records is deliberate.
Question 9. The audit may act as a:
- Guarantee against fraud
- Deterrent to fraud
- Cause of fraud
- Substitute for controls
Show the answer
B. But it is not certain to find fraud.
Question 10. Why might material fraud go undetected?
- The auditor never tests
- Inherent audit limitations and deliberate concealment
- Auditors are not independent
- Standards forbid testing
Show the answer
B. Collusion and concealment make detection hard.
Written questions
Question 11 (10 marks). Distinguish between fraud and error, and explain the responsibilities of management and auditors for each.
Question 12 (20 marks). (a) Describe the steps an auditor should take when fraud or error is suspected. (10 marks) (b) Explain how professional scepticism applies to fraud. (5 marks) (c) Explain why some material fraud may go undetected in an audit. (5 marks)
Question 13 (10 marks). During the audit of Tanko Foods Ltd, the team finds ₦8 million of cash receipts from credit customers that were not banked. The cashier also keeps the receivables ledger. Materiality is ₦12 million. The finance director says it is a timing difference. Evaluate the position and advise the team. (10 marks)
Model answers
Show the model answer to Question 11
Fraud and error. Fraud is intentional: fraudulent financial reporting, such as falsifying records or deliberately misapplying policies, or misappropriation of assets. (2.5) Error is unintentional: misapplied policies, oversights, clerical mistakes and misinterpreted facts. (2) The key distinction is whether the effect is deliberate. The audit impact may be similar, but there may be national requirements to report suspicion of fraud and not error. (1.5)
Responsibilities. Management is responsible for the financial statements and internal control, and so for preventing and detecting fraud and error, with those charged with governance. (2) The auditor reports on the true and fair view and is concerned only with material fraud and error.
The auditor must obtain reasonable assurance that the statements are free from material misstatement, but is not primarily responsible for prevention or detection, and some misstatements may go undetected. (2)
Show the model answer to Question 12
(a) Steps (10 marks). Identify the extent and possible impact and document it, with more testing if needed (2). Consider the effect on other areas, audit risk and the plan (1.5). Discuss the findings with management and keep it informed (1.5). Decide the action management should take, including legal advice (1.5). Communicate formally to the board or audit committee, and consider legal advice and resignation if management is involved (1.5).
Consider the effect on the audit report (1). Consider reporting to authorities against the duty of confidentiality (1).
(b) Scepticism (5 marks). Perform the audit with suitable scepticism (1); hold a team discussion on fraud for the specific engagement (1); discuss with management the controls to detect or prevent fraud (1); identify fraud risks and evaluate their effect (1); design procedures to obtain evidence that fraud has not occurred or has been corrected or disclosed (1).
(c) Why fraud may be missed (5 marks). The audit has inherent limitations: testing is selective and based on judgement (1.5). Fraud may be sophisticated and well organised (1), may involve collusion (1) and may be deliberately concealed from the auditor (1). The auditor’s duty is reasonable assurance on material misstatement, not detection of all fraud (0.5).
Show the model answer to Question 13
Evaluation (4 marks). ₦8 million is below materiality of ₦12 million, but it is 67% of it (₦8 million ÷ ₦12 million). The cashier controls both cash and the ledger, so segregation of duties is absent and misappropriation, perhaps with lapping, is likely. The finance director’s explanation of timing is unsupported. (4)
Advice (6 marks). Extend testing, with customer confirmations and a cut-off review of receipts, to see whether the total is larger and could be material (1.5). Revise the risk assessment and the audit plan, with higher control risk on cash and receivables (1). Discuss with management, keeping the facts documented (1). Ask management to investigate and secure the cash, and take legal advice (1).
Communicate in writing to the board or audit committee, because the finance director may be involved (1). Consider the effect on the report and any duty to report to authorities, weighing confidentiality (0.5).
Pathfinder on fraud and error, ISA 240
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
Perceived auditor responsibility for fraud is part of the expectation gap in this question. This topic gives the actual responsibilities of management and auditor.
Revise first: Who is responsible
Section A is a single compulsory case with several requirements. It has drawn on ethics, quality management, group audits and reporting. Practise the scenario method in this topic before you attempt it.
Revise first: How to score full marks
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
