SA 250 distinguishes between laws and regulations that have a direct effect on determining material amounts and disclosures in the financial statements — tax law, for instance — and those that don't directly affect the figures but compliance with them is fundamental to the entity's ability to continue operating, such as licensing or environmental regulations. The auditor's responsibility is explicitly different for each: for the first category, the audit is designed to obtain reasonable assurance that material amounts and disclosures comply, the same as for any other material item. For the second, the audit is limited to specified procedures that might bring instances of non-compliance to attention — not a comprehensive compliance review of every applicable law.
What the auditor is actually required to do for each category
| Direct effect on financial statements | Indirect effect (fundamental to operations) | |
|---|---|---|
| Example | Tax law, specific accounting-related regulation | Environmental permits, sector-specific licensing, labour law |
| Required audit response | Procedures designed to obtain reasonable assurance of compliance, same rigor as any other material balance | Inquiry of management and those charged with governance, and inspection of correspondence with regulators — not a comprehensive review |
| What triggers deeper investigation | Any indication of non-compliance found through normal procedures | Any indication that non-compliance may have occurred, from any source during the audit |
SA 250 is explicit that an audit cannot be expected to detect non-compliance with ALL laws and regulations — the standard deliberately scopes the auditor's responsibility rather than treating every statute applicable to the entity as something the audit must test for.
What happens once non-compliance, or suspected non-compliance, is identified
- 01Understand the nature of the act and the circumstancesEnough to evaluate the possible effect on the financial statements, which may require legal advice where the matter is genuinely unclear.
- 02Evaluate the effect on the financial statements and the audit opinionA fine or penalty may need to be provided for or disclosed; the auditor's opinion may need to reflect the effect if management hasn't adequately addressed it.
- 03Communicate with those charged with governanceUnless the matter is clearly inconsequential — this communication is a required response, not an optional courtesy.
- 04Consider the implications for other aspects of the auditA single instance of non-compliance can affect the reliability of management representations made elsewhere, and may need to be factored into the fraud risk assessment under SA 240.
If management or those charged with governance don't take appropriate remedial action and the auditor concludes the non-compliance is material, SA 250 may require withdrawal from the engagement where permitted, or reporting to an appropriate authority outside the entity in specified circumstances — not simply noting the matter and continuing as before.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCSA 240: the auditor's responsibilities relating to fraudSA 240 doesn't make the auditor a fraud investigator. It requires planning and performing the audit as if fraud could exist, and documenting that you did.
- CARO & Companies ActCARO 2020 reporting checklist for statutory auditorsThe topic areas CARO reporting covers, what evidence each one needs, and how the clauses fit together across the audit file.
- CARO & Companies ActSecretarial compliance checklist for a statutory auditorBoard meeting frequency, statutory registers and ROC filing timeliness, read as evidence of compliance culture rather than a secretarial checklist in its own right.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.