External Audit Fraud Responsibilities

Why This Topic Matters

The question of what an external auditor is—and is not—responsible for when it comes to fraud sits at the heart of the so-called expectation gap: the difference between what the public believes auditors do and what professional standards actually require. Investors, regulators, and juries frequently assume that a clean audit opinion means the financial statements are fraud-free. Auditing standards say something far more limited. As a Certified Fraud Examiner, you must understand this gap precisely, because you will work alongside auditors, evaluate their work after a fraud surfaces, testify about whether audit procedures were adequate, and explain to clients why an audit did not catch a scheme. On the CFE Exam, this material falls within the Financial Transactions and Fraud Schemes section under Auditors' Fraud-Related Responsibilities, and it is a reliably tested area because the rules are specific and the distinctions are sharp.

What It Is: The Scope of the External Auditor's Duty

An external (independent) auditor is engaged to express an opinion on whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework (GAAP, IFRS, etc.). The auditor's responsibility relating to fraud flows directly from this objective. Under the major standards, the auditor is responsible for obtaining reasonable assurance that the financial statements as a whole are free of material misstatement, whether caused by error or fraud.

Three words carry enormous weight here:

1. Reasonable — not absolute. Because of inherent limitations (sampling, judgment, concealment, collusion, forgery, management override), even a properly performed audit may fail to detect a material fraud.
2. Material — the auditor is not responsible for detecting immaterial fraud, although discovered fraud of any size involving senior management is treated seriously.
3. Financial statements — the auditor's focus is misstatement of the statements, not every act of wrongdoing in the organization.

The standards identify two types of intentional misstatement relevant to the auditor: fraudulent financial reporting (cooking the books, usually by management) and misappropriation of assets (theft, usually by employees, that causes the statements to be misstated). An auditor does not make legal determinations of whether fraud occurred; that is for the courts. The auditor's concern is intentional misstatement.

The Governing Standards You Must Know

AICPA AU-C Section 240, Consideration of Fraud in a Financial Statement Audit — applies to audits of nonpublic (non-issuer) entities in the United States. It is the clarified successor to SAS No. 99, which was issued in 2002 in the wake of Enron and WorldCom. Older exam material may still reference SAS 99; treat AU-C 240 and SAS 99 as the same lineage.

PCAOB AS 2401, Consideration of Fraud in a Financial Statement Audit — applies to audits of public companies (issuers) in the United States. Its substance closely mirrors AU-C 240.

ISA 240, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements — the International Standard on Auditing issued by the IAASB, followed in most jurisdictions outside the United States. Its principles are consistent with the U.S. standards.

Sarbanes-Oxley Act of 2002 (SOX) and Section 10A of the Securities Exchange Act of 1934 — statutory requirements affecting auditors of U.S. public companies, including procedures for illegal acts and mandatory reporting chains.

How It Works: The Fraud-Related Audit Process

The standards impose a structured set of requirements. Learn them in sequence.

1. Professional Skepticism
The auditor must maintain an attitude that includes a questioning mind and a critical assessment of audit evidence throughout the engagement, regardless of past experience with the client's honesty. Past integrity does not justify accepting less-than-persuasive evidence. The auditor should not assume management is dishonest, but should not assume unquestioned honesty either.

2. Engagement Team Brainstorming (Discussion Among Engagement Personnel)
Before and during the audit, the engagement team—including the partner—must hold a discussion about how and where the entity's financial statements might be susceptible to material misstatement due to fraud, how management could perpetrate and conceal fraudulent reporting, and how assets could be misappropriated. The team is instructed to set aside beliefs about management's honesty and think like a fraudster. This brainstorming requirement was one of the signature innovations of SAS 99.

3. Obtaining Information to Identify Fraud Risks
The auditor gathers information through:
• Inquiries of management about its own assessment of fraud risk, its process for identifying and responding to fraud risk, knowledge of any actual, suspected, or alleged fraud, and communications with those charged with governance.
• Inquiries of the audit committee (or those charged with governance), internal audit, and others within the entity such as operating personnel, in-house counsel, and employees involved in initiating or recording unusual transactions. Asking people beyond management is deliberate—it is a way to corroborate or contradict management's story.
• Analytical procedures performed in planning, with specific attention to revenue relationships that are unusual or unexpected.
• Consideration of fraud risk factors, organized around the fraud triangle: incentives/pressures, opportunities, and attitudes/rationalizations. The standards' appendices list examples for both fraudulent financial reporting and misappropriation.
• Other information, including results of client acceptance and continuance procedures and interim reviews.

4. Identifying and Assessing Risks of Material Misstatement Due to Fraud
The auditor synthesizes the information to identify specific fraud risks, considering the type of risk, its significance, its likelihood, and its pervasiveness. Two presumptions are built into the standards and are heavily tested:
• Improper revenue recognition is presumed to be a fraud risk. The auditor must treat it as such unless the presumption can be specifically overcome and the reasons documented.
• Management override of controls is always a risk in every audit. Because management can override even well-designed controls, this risk cannot be rebutted, and specific procedures must address it in every engagement.

5. Responding to Assessed Fraud Risks
The auditor's response operates at three levels:
• Overall responses — assigning more experienced personnel or forensic specialists, increasing supervision, evaluating the entity's accounting policies for aggressive choices, and incorporating unpredictability into the nature, timing, and extent of procedures (e.g., testing accounts not normally tested, visiting locations unannounced, changing sampling methods).
• Responses at the assertion level — modifying the nature (more external, more physical evidence), timing (closer to year-end rather than interim), and extent (larger samples) of specific procedures.
• Mandatory procedures for management override, required in every audit:
  (a) Examine journal entries and other adjustments for evidence of possible material misstatement, with emphasis on nonstandard entries, entries posted at period end, entries by unusual users, and entries to seldom-used or unrelated accounts.
  (b) Review accounting estimates for bias, including a retrospective review of prior-year estimates to see whether management's judgments consistently favored a particular result.
  (c) Evaluate the business rationale for significant unusual transactions that are outside the normal course of business or otherwise appear unusual, considering whether they may have been entered into to engage in fraudulent reporting or conceal misappropriation.

6. Evaluating Audit Evidence
Near the end of the audit, the auditor performs analytical procedures as an overall review to see whether the financial statements hang together, evaluates whether identified misstatements may be indicative of fraud, and reassesses fraud risk in light of everything learned. A misstatement that may be the result of fraud, even if not material, requires the auditor to consider the implications for the rest of the audit, especially regarding management's integrity and the reliability of representations. If the auditor concludes that fraud involving senior management has occurred or that misstatements are material, the auditor may need to modify the opinion, withdraw from the engagement, or consult legal counsel.

7. Communicating About Fraud
This is one of the most heavily tested areas. Know the recipients:
• Management — any evidence that fraud may exist, even if inconsequential, should be brought to the attention of the appropriate level of management (at least one level above those involved).
• Those charged with governance (audit committee) — fraud involving senior management, and fraud (by anyone) that causes a material misstatement, must be communicated directly. The auditor should also discuss fraud risks identified and any significant deficiencies in controls relating to fraud.
• Parties outside the entity — ordinarily the auditor's duty of confidentiality precludes disclosing fraud to third parties. Exceptions exist: (1) to comply with legal and regulatory requirements (e.g., Section 10A reporting to the SEC); (2) to a successor auditor making inquiries under professional standards; (3) in response to a subpoena; and (4) to a funding agency or other specified agency in audits of entities receiving governmental financial assistance.

8. Documentation
The auditor must document the brainstorming discussion (how and when it occurred, who participated, and what was discussed), the procedures performed to obtain information about fraud risks, the specific risks identified and the responses, the reasons for overcoming the revenue recognition presumption if applicable, the results of journal entry testing and other management override procedures, other conditions or analytical relationships that prompted additional procedures, and the nature of communications about fraud to management, the audit committee, and others.

Section 10A of the Securities Exchange Act: Illegal Acts

Added by the Private Securities Litigation Reform Act of 1995, Section 10A applies to audits of public companies and requires that each audit include:
• Procedures designed to provide reasonable assurance of detecting illegal acts that would have a direct and material effect on the financial statement amounts.
• Procedures designed to identify related-party transactions material to the statements or otherwise requiring disclosure.
• An evaluation of the entity's ability to continue as a going concern.

When the auditor detects or becomes aware of information indicating an illegal act has or may have occurred, the auditor must:
1. Determine whether it is likely an illegal act occurred and, if so, its possible effect on the financial statements (including contingent fines, penalties, and damages).
2. Inform the appropriate level of management and ensure the audit committee (or board, if no audit committee) is adequately informed—unless the act is clearly inconsequential.
3. If the auditor concludes the illegal act has a material effect, senior management has not taken timely and appropriate remedial action, and the failure is reasonably expected to warrant a departure from a standard report or resignation, the auditor must report these conclusions directly to the board of directors.
4. The board must notify the SEC within one business day of receiving the auditor's report and provide a copy of that notice to the auditor.
5. If the auditor does not receive the copy within one business day, the auditor must either resign or furnish the report directly to the SEC within one business day. If the auditor resigns, the auditor must still furnish the report to the SEC within one business day of resigning.

Auditors who comply in good faith with these reporting duties are protected from private liability for the reports they make. Note the one business day timing—it is a favorite exam detail.

Sarbanes-Oxley Provisions Affecting Auditors

SOX dramatically changed the external auditor's environment for public company audits. Key provisions to know:
• Title I created the PCAOB, which registers, inspects, and sets standards for firms auditing public companies. Auditing of public companies is no longer self-regulated.
• Section 201 prohibits auditors from providing certain non-audit services to audit clients (bookkeeping, financial information systems design, appraisal/valuation, actuarial services, internal audit outsourcing, management or HR functions, broker-dealer or investment advisor services, legal and expert services unrelated to the audit). Other non-audit services (including tax) require audit committee pre-approval.
• Section 203 requires rotation of the lead and concurring audit partners every five years.
• Section 204 requires the auditor to report to the audit committee all critical accounting policies, alternative GAAP treatments discussed with management (and the auditor's preferred treatment), and other material written communications with management such as the management representation letter and schedule of unadjusted differences.
• Section 206 imposes a one-year cooling-off period before a member of the audit engagement team can be hired as CEO, CFO, controller, or chief accounting officer of the client.
• Section 301 makes the audit committee directly responsible for appointing, compensating, and overseeing the auditor; the auditor reports to the audit committee, not to management. Audit committees must also establish whistleblower procedures.
• Section 302 requires the CEO and CFO to certify the financial statements and disclose to the auditors and audit committee all significant control deficiencies and any fraud involving management or employees with a significant role in internal control.
• Section 404 requires management to assess internal control over financial reporting and, for larger filers, requires the auditor to attest to and report on that assessment (integrated audit). This moved the auditor into a direct evaluation of the control environment where fraud is prevented or detected.
• Section 802 requires auditors to retain audit workpapers for seven years and criminalizes destruction or alteration of records to impede an investigation. Related rules penalize officers who fraudulently influence, coerce, or mislead auditors.

Distinguishing the External Auditor From Others

Exam questions frequently test whether you can tell roles apart:
• External auditors opine on financial statements; fraud is addressed only insofar as it could materially misstate them; they are independent of the entity.
• Internal auditors are employees (or outsourced function) governed by IIA Standards; they evaluate the organization's fraud risk management and controls, have sufficient knowledge to identify red flags, but are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud.
• Fraud examiners are engaged specifically to resolve allegations of fraud, work from predication, and gather evidence to prove or disprove a specific allegation; their work is not limited by materiality.
• Management and those charged with governance hold primary responsibility for preventing and detecting fraud—not the auditor. The auditor's responsibility is secondary and derivative of the opinion objective.

The Expectation Gap and Its Consequences

Because the public expects auditors to find fraud, auditors are routinely named in lawsuits following major frauds. Standards respond by tightening requirements (SAS 99's brainstorming and management override procedures, PCAOB inspection findings on skepticism, ISA 240 revisions) but never promise detection. Fraud examiners should understand that a well-executed audit can still miss a collusive, well-concealed scheme, and that the appropriate question in evaluating an auditor's performance is whether the auditor complied with professional standards and exercised due care—not merely whether the fraud was found.

Exam Tips: Answering Questions on External Audit Fraud Responsibilities

Tip 1 — Anchor on "reasonable assurance" and "material misstatement." Any answer stating that auditors must detect all fraud, provide absolute assurance, or guarantee the statements are free of fraud is wrong. Likewise, any answer saying auditors have no responsibility for fraud is wrong. The correct framing is always: reasonable assurance that the statements are free of material misstatement whether due to error or fraud.

Tip 2 — Remember who holds primary responsibility. If a question asks who is primarily responsible for preventing and detecting fraud, the answer is management and those charged with governance, not the external auditor.

Tip 3 — Know the two presumptions cold. Improper revenue recognition is a presumed fraud risk (rebuttable, with documentation). Management override of controls is a risk in every audit (not rebuttable). Questions love to ask which risk is always present—management override.

Tip 4 — Memorize the three mandatory management-override procedures. Journal entry and adjustment testing, retrospective review of accounting estimates for bias, and evaluation of the business rationale for significant unusual transactions. If a question asks what the auditor must do in every audit regardless of assessed risk, look for these.

Tip 5 — Link fraud risk factors to the fraud triangle. The standards organize risk factors as incentives/pressures, opportunities, and attitudes/rationalizations. If a scenario describes a CFO under pressure to meet analyst expectations, that is an incentive/pressure factor; weak controls over cash are an opportunity factor; a disdain for regulators is an attitude/rationalization factor.

Tip 6 — Master the communication hierarchy. Evidence that fraud may exist goes to management (one level above those involved). Fraud involving senior management or causing a material misstatement goes directly to the audit committee. Disclosure outside the entity is ordinarily not permitted, except for legal/regulatory requirements, successor auditor inquiries, subpoenas, and government funding agencies. A question asking whether an auditor should call the police or notify shareholders directly is almost certainly testing this restriction.

Tip 7 — Drill the Section 10A chain and the one-business-day clock. Auditor → management and audit committee → (if material, no remediation, and would affect the report) board of directors → board notifies SEC within one business day → if auditor receives no copy of the notice, auditor resigns or reports directly to SEC within one business day. Watch for distractors citing five days, ten days, or thirty days.

Tip 8 — Match SOX section numbers to their content. The most testable pairs: 201 (prohibited non-audit services), 203 (five-year partner rotation), 204 (reports to audit committee), 206 (one-year cooling-off), 301 (audit committee oversees auditor), 302 (CEO/CFO certification), 404 (internal control reporting), 802 (seven-year workpaper retention). Also recall that SOX created the PCAOB.

Tip 9 — Watch for the standard-setter trap. AU-C 240 (AICPA) applies to non-issuers; AS 2401 (PCAOB) applies to issuers; ISA 240 (IAASB) applies internationally. SAS 99 is the predecessor of AU-C 240. A question describing a privately held U.S. company points to AICPA standards; a U.S. public company points to PCAOB and SOX.

Tip 10 — Distinguish auditors from fraud examiners. If a question contrasts the two, remember that auditors work from materiality and sampling toward an opinion, while fraud examiners work from predication toward resolving a specific allegation without a materiality threshold. Auditors do not make legal determinations that fraud occurred.

Tip 11 — Use the "skepticism" filter on scenario questions. When a scenario describes an auditor relying on management's assurances because of a long, trouble-free relationship, the correct answer will identify a failure of professional skepticism. Past honesty never justifies accepting less persuasive evidence.

Tip 12 — Eliminate absolutes. Answer choices containing "always," "never," "all," or "guarantee" are usually wrong in this area—with the single notable exception that management override is always a fraud risk.

Quick-Reference Summary

• Objective: reasonable assurance of no material misstatement due to error or fraud.
• Standards: AU-C 240 / SAS 99 (non-issuers), AS 2401 (issuers), ISA 240 (international).
• Process: skepticism → brainstorming → inquiries and analytics → risk assessment (revenue and management override presumptions) → responses (overall, assertion level, mandatory override procedures) → evaluation → communication → documentation.
• Communication: management for possible fraud; audit committee for senior-management fraud or material misstatement; third parties only in limited legal exceptions.
• Section 10A: illegal acts, related parties, going concern; board-to-SEC reporting with one-business-day deadlines.
• SOX: PCAOB, independence rules, partner rotation, audit committee authority, certification, internal control attestation, seven-year retention.
• Primary responsibility for fraud prevention and detection rests with management and governance, not the auditor.

Master these points and you will be able to handle both direct recall questions and scenario-based questions on external audit fraud responsibilities with confidence.