ISA 250 and money laundering

A company that breaks the law can be fined, closed or sued, and any of these can change the numbers in its financial statements. The auditor is not the police, yet the auditor cannot ignore what the law says about the client. International Standard on Auditing (ISA) 250 sets out how far the auditor must look and what to do on finding a breach.

Money laundering is a special case, because the law makes the accountant a reporter of suspicion and even a criminal if the duty is ignored.

This topic covers the auditor’s duties under ISA 250, the action to take on non-compliance, management’s responsibilities for compliance, and the money laundering rules: the definition, the offences and defences, regulation in Nigeria, the obligations placed on firms, and the clash between confidentiality and reporting.

Examiners ask for lists of procedures and actions, and they like scenarios where the auditor suspects wrongdoing and must decide what to do without tipping off.

ISA 250: the auditor’s duties

ISA 250 deals with how the auditor treats laws and regulations in an audit of financial statements. The auditor must:

1. Understand the framework. Get a general understanding of the legal and regulatory framework that applies to the entity and how the entity complies with it. This is part of understanding the entity and its environment under ISA 315, and here the environment is the legal one.
2. Gather evidence on direct-effect laws. Get sufficient appropriate evidence of compliance with the laws and regulations that might be expected to have a direct effect on material amounts and disclosures in the financial statements.

The auditor also looks out for non-compliance with other laws that may have a material effect on the financial statements, and responds properly to any found or suspected. Laws with a direct effect are those that fix amounts and disclosures, such as the form and content of financial statements, or tax and pension rules. Other laws may not alter the figures directly but can bring sanctions and fines that do.

Procedures to identify non-compliance

• Ask management whether the entity is complying with the relevant laws and regulations.
• Inspect any correspondence with the relevant authorities.
• Stay alert during the audit, because other procedures may bring non-compliance to light.
• Obtain written representations from management that all known or suspected non-compliance has been disclosed to the auditor.
• Document all identified or suspected non-compliance and the results of discussions with management and others.

Action when non-compliance is found or suspected

If the auditor identifies or suspects material non-compliance, the following steps are required:

1. Understand the act. Find out its nature and the circumstances in which it happened.
2. Evaluate the effect. Judge the possible effect on the financial statements.
3. Discuss and take advice. For suspected non-compliance, discuss it with management. If management does not show compliance, take legal advice.
4. Consider the report. If there is not enough evidence about a suspected breach, consider the effect on the audit report. This is a limitation on scope, which modifies the opinion (a later topic covers this).
5. Consider other areas. Ask whether the non-compliance affects other parts of the audit, for example the overall risk assessment.
6. Decide how to report it. It may go to those charged with governance, to the shareholders, to the authorities, or to more than one of them.

Management’s responsibilities for compliance

Management and those charged with governance must make sure the company operates within the law. Some laws require disclosure in the financial statements of how far the company complied, and some non-compliance leads to sanctions or penalties that may also need disclosure.

The syllabus gives these examples: specifications for the directors’ report, the form and content of financial statements, industry-specific disclosures, the format of presentation, and the recognition of income tax and pension costs.

Companies often have an audit committee and units such as internal audit, internal control and compliance to monitor compliance. Their activities include:

• keeping an up-to-date register of the industry laws and regulations the organisation must follow;
• designing, monitoring and operating procedures to meet the legal requirements for setting up the company;
• setting up a good system of internal control;
• having a code of conduct and training staff on it;
• setting up monitoring and disciplinary procedures for breaches of the code; and
• engaging capable professionals where needed to put the machinery for compliance in motion.

Money laundering: meaning and offences

Money laundering is the process by which criminals try to hide the true origin and ownership of the proceeds of their crimes. The crimes include drug trafficking, terrorism, theft, tax evasion and other fraud. “Dirty money” is moved and changed so that it looks as if it came from a legitimate source and became “clean money”.

If the criminals succeed, they keep control of the proceeds and gain a lawful cover for their income.

Offences

The criminal offences linked to money laundering include:

• possessing, dealing in any way with, or concealing the proceeds of any crime. The proceeds of crime can include saved costs from environmental or health and safety offences, retained overpayments from customers, and payments abroad that count as bribes and would be illegal in Nigeria;
• attempting, conspiring or inciting others to commit the offence;
• aiding, abetting, counselling or procuring the offence;
• an act that would be an offence if done in Nigeria;
• failure by a person in the regulated sector to tell the proper party of knowledge or suspicion that another person is laundering money; and
• making a disclosure that is likely to prejudice an investigation, which is called tipping off.

The last two are the ones that accountants may commit, even without meaning to, because accountants work in the regulated sector and must report suspicion. The law does not define “suspicion”. It lies somewhere between mere speculation and actual proof.

Defences

• a report was made to the proper party;
• there was an intention to report and a reasonable excuse for not doing so, which is likely to include fear of physical violence or other menaces; and
• the person acquired or used the property for adequate consideration in good faith.

Regulation

Inter-governmental bodies such as the Financial Action Task Force (FATF) have driven many countries to put in place laws to detect, report and prevent money laundering. They vary by country and include the United States (US) Patriot Act 2001 in the United States and the Money Laundering Regulations 2007 in the United Kingdom.

In Nigeria, the Money Laundering (Prohibition) Act 2011 puts FATF’s recommendations into effect for customer due diligence, record-keeping, reporting of suspicious transactions and compliance.

Background: The syllabus names the 2011 Act. A later statute, the Money Laundering (Prevention and Prohibition) Act 2022, is reported to have replaced it. Check Institute of Chartered Accountants of Nigeria (ICAN)’s current guidance, and use the Act named in the question.

Obligations placed on professional firms

Accountants, and auditors in particular, may meet money laundering when criminals set up companies and trade between them to launder money. Professional firms, such as lawyers and accountants, and financial institutions must therefore:

• put in place systems, controls and procedures so that the firm is not used to launder money;
• appoint a Money Laundering Reporting Officer (MLRO), who receives reports of suspected laundering from other employees and reports them to the proper authority;
• keep records of all transactions for at least five years, with controls so that they are not destroyed by accident;
• verify and keep records of client identity, using official documents. For an individual these are a passport or driving licence supported by recent utility bills, and for a company the certificate of incorporation;
• set up procedures for reporting any suspicion of money laundering by client companies; and
• train staff to detect and report suspected laundering.

The syllabus gives an international example. A solicitor was jailed for six months for failing to report his suspicion about money paid to his firm by a client later convicted of drug trafficking. He misunderstood his duty and committed the offence without meaning to.

Monitoring, penalties and guidance

ICAN’s Monitoring Unit checks, on its visits, whether practitioners understand their obligations by asking a series of questions. Besides ICAN’s disciplinary action, breaches can make a firm liable under criminal law to unlimited fines and expose its principals, usually the partners, to possible imprisonment. International Federation of Accountants (IFAC) has published a paper on the subject.

It covers the causes of money laundering and ways of preventing it, the signs of laundering activity, the vulnerability of banks, non-bank financial institutions and other entities, and governance issues about the relative responsibilities of directors and auditors for monitoring and reporting suspicion.

Confidentiality, tipping off and legal privilege

An accountant’s normal duty of confidentiality to a client is no defence where money laundering is concerned. In most countries, a person who reports in good faith to the proper authority has statutory protection against a claim for breach of confidence, even if the suspicion later proves wrong.

It can be hard to avoid tipping off, given the reporting that an auditor must do. Suppose an auditor strongly suspects laundering and wants to resign. Resignation means giving the shareholders the reasons in a statement of circumstances and passing professional matters to the successor in a professional clearance letter. Either may tip the client off.

The auditor may therefore be better placed not to resign at that time, and should take legal advice first. Advice from a solicitor is not tipping off because it is protected by legal privilege.

Sometimes an accountant receives information under legal privilege and so cannot report it. This is rare.

The rules in more depth

Why ISA 250 splits laws into two groups

Some laws feed straight into the numbers: a tax law fixes a charge, and a companies law fixes a disclosure. For these the auditor must obtain evidence, because a breach is a misstatement. Other laws, such as environmental or health and safety rules, do not fix any figure, but breaking them may bring fines or closure. For these the auditor does not test everything.

The auditor stays alert, asks, inspects letters from regulators and reacts to what turns up. This keeps the duty proportionate: the auditor is not expected to know every law, but must not look away when the signs are there.

How the steps connect

The first two steps, understanding the act and evaluating its effect, decide whether the matter is material. Discussion with management tests whether there is an innocent explanation. Legal advice protects the auditor, particularly where reporting could amount to tipping off. A lack of evidence about a suspected breach is treated as a scope limitation, which leads to a modified opinion.

Considering other areas matters because one breach may reveal weak controls or a dishonest tone from the top, which affects the risk assessment for the whole audit.

Numbers: record-keeping

A transaction recorded on 12 March 2025 must be kept for at least five years, until 12 March 2030. Identity records are kept with the same care, so that they can be produced if an investigation starts.

Why resignation is a trap

The ordinary auditor who suspects a client of dishonesty may well wish to resign. With money laundering, the formal acts that follow resignation are exactly the disclosures that can tip off the client. The safe route is legal advice, a report through the MLRO to the proper authority, and no hint to the client.

Worked example: a suspicious payment

1. Understand the act. Payments abroad with no contract may be bribes that would be illegal in Nigeria, which are proceeds of crime for money laundering purposes. The pattern of banked receipts then moved abroad may be an attempt to conceal origin.
2. Evaluate the effect. ₦95 million may be material, and there may be fines, loss of licences or loss of customers. The effect on the financial statements and on other audit areas, such as the risk assessment and management integrity, must be judged.
3. Discuss with management, carefully. ISA 250 says to discuss suspected non-compliance with management. Here the discussion has produced no proof of compliance, so legal advice should be taken. The discussion must not reveal that a suspicion report is being made.
4. Report internally. Staff must pass the suspicion to the firm’s Money Laundering Reporting Officer, who decides on a report to the proper authority. A report made in good faith is protected from a claim for breach of confidentiality even if the suspicion proves wrong.
5. Do not tip off. Telling the client about the report, or doing something that is likely to prejudice an investigation, is an offence.
6. Do not resign at once. Resigning means a statement of circumstances to shareholders and a clearance letter to a successor, which may tip the client off. Take legal advice first, since advice from a solicitor is protected by legal privilege and is not tipping off.
7. Audit consequences. If the auditor cannot get enough evidence about the payments, this is a scope limitation and the opinion must be modified. The auditor should also tell those charged with governance when that is safe, and consider the effect on the risk assessment.
8. Conclusion. Do not resign yet. Document everything, take legal advice, report through the MLRO, and carry on the audit with heightened scepticism.

How to score full marks

• Use the syllabus’s sequences. For “auditor’s procedures”, give the five procedures. For “action on non-compliance”, give the six steps in order. Each step is a mark.
• Apply, do not recite. In a scenario, put each step against a fact: “The payments have no contract (understand the act); they total ₦95 million (evaluate effect)”.
• Separate management’s duty from the auditor’s. Management complies and discloses. The auditor identifies, evaluates and reports.
• For money laundering offences, name the two that catch accountants. Failure to report knowledge or suspicion, and tipping off. Say that suspicion is undefined, between speculation and proof.
• List all six obligations of firms. Systems and controls, MLRO, five-year records, client identification, internal reporting procedures, and training.
• For confidentiality questions, state the rule and the exception. Confidentiality is no defence, good-faith reports are protected, and legal privilege is the rare exception.
• Link resignation to tipping off. This connection is the point the examiner is looking for in a scenario.
• Time. Allow time in proportion to marks and finish scenarios with a one-line recommendation.

Common mistakes in the exam

• Saying the auditor must find every breach of law. The auditor must look for direct-effect laws and respond to others as they appear.
• Forgetting legal advice when management cannot show compliance.
• Leaving out the effect on the audit report when evidence is lacking, which is a scope limitation.
• Saying money laundering applies only to banks. Accountants are in the regulated sector.
• Quoting a five-year retention period without saying it is a minimum.
• Saying confidentiality prevents reporting. It does not.
• Advising the auditor to resign at once on suspecting laundering, or to warn the client.
• Missing the MLRO. The MLRO receives staff reports and reports on.

Quick revision

• ISA 250: understand the legal framework; get evidence on direct-effect laws; look out for other laws.
• Procedures: enquire; inspect regulator correspondence; stay alert; written representations; document.
• Action: understand, evaluate, discuss (legal advice if no proof), consider scope limitation, consider other areas, decide whom to report to.
• Management is responsible for compliance; an audit committee, internal audit and compliance units monitor it.
• Money laundering: hiding the origin of criminal proceeds. Offences include failing to report and tipping off. Defences: report made, intention to report with reasonable excuse, good-faith purchase for value.
• Nigeria: Money Laundering (Prohibition) Act 2011 (named in the syllabus), FATF recommendations.
• Firms: systems, MLRO, records for at least five years, client identity, reporting procedures, training. Penalties: unlimited fines; principals may be jailed.
• Confidentiality is no defence; good-faith reports are protected; resignation may tip off, so take legal advice.

Practice questions

These are original questions written in the style of the ICAN exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.