ISA 240 (Revised): fraud duties from December 2026

What the IAASB says ISA 240 (Revised) changes for audits of periods beginning on or after 15 December 2026, and how a firm can prepare its papers and team.

By Achekam · 11 October 2026 · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya

The fraud standard is the one every auditor quotes and few have read from start to finish since their exams. On most small and medium audits, fraud lives in a planning checklist: the team discussion ticked, the inquiries of management recorded, the journal testing done, the revenue presumption considered. ISA 240 (Revised) is the IAASB's attempt to move fraud out of the checklist and into the way the audit is planned and performed.

This article summarises what the IAASB says the revision does, when it applies, and what a firm should change before its first affected year-end.

Clearer responsibilities, stronger responses, more transparency

The IAASB states that ISA 240 (Revised), The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, has been revised to deliver clearer responsibilities, stronger risk response and improved transparency. Its ISA 240 (Revised) publication page summarises the revision and is the right starting point before anyone opens the full text.

Each of those three aims lands somewhere different:

• Responsibilities shape what the engagement letter and the team briefing say the auditor will do about fraud.
• Risk response shapes the procedures: what the team actually tests in reply to the fraud risks it identifies.
• Transparency shapes what users eventually read about fraud-related matters.

A fraud lens across the audit

The IAASB states that ISA 240 (Revised) emphasises a fraud lens in the auditor's risk assessment and in the appropriate responses to identified risks.

One practical reading of that phrase is that fraud should not be a separate box completed after the "real" risk assessment. When the team considers revenue, inventory, estimates or related-party transactions, it asks at the same time how each could be deliberately misstated, by whom, and what would reveal it. The responses then follow from that thinking rather than from a standard list. For revenue in particular, see responding to revenue fraud risk.

Transparency for publicly traded entities

The IAASB states that the revised standard provides greater transparency in the auditor's reports of publicly traded entities. Firms with listed audit clients should expect their report templates for those clients to change and should read the reporting requirements closely.

Most smaller firms in South Africa, Nigeria and Kenya do not audit publicly traded entities, so this part may not touch their reports directly. It still matters to them indirectly: what large-firm reports start saying about fraud will shape what boards and lenders expect to hear from every auditor.

Built to scale to smaller audits

The IAASB states that the structure of ISA 240 (Revised) incorporates scalability and proportionality, to support consistent and effective application across a range of audit engagements. That is useful news for a practice whose clients are owner-managed businesses, schools, churches and family companies. A scalable standard does not mean optional requirements; it means the work can be sized to the entity. Document the sizing decision so a reviewer can see why the response on a small client looks lighter than on a large one.

The effective date and early adoption

The IAASB states that ISA 240 (Revised) becomes effective at the same time as ISA 570 (Revised 2024), for periods beginning on or after 15 December 2026. It encourages jurisdictions to consider early adoption of ISA 240 (Revised), ISA 570 (Revised 2024) and the narrow-scope amendments for listed and public interest entities as a cohesive package, and its page describes that package as a stronger, more coordinated response to the risks of fraud and financial distress.

Check with your own regulator and professional body how and when the revised standard applies locally before you fix dates in your methodology. For a client with a December year-end, the IAASB's date first bites on the year beginning in January 2027; for other year-ends, count from the first period that starts on or after the effective date.

Where the firm's fraud papers will change

The revised text, not a summary, should drive the changes. Use this list to make sure nothing is missed when the methodology partner works through it:

1. The record of the engagement team's fraud discussion.
2. The fraud risk assessment, including incentives, pressures and opportunities.
3. Inquiries of management, those charged with governance and others in the entity.
4. The responses to assessed fraud risks, including procedures on management override.
5. Journal entry testing, its population and its selection criteria; see journal entry testing.
6. The evaluation of misstatements for possible fraud.
7. Communications with management, those charged with governance and, where required, authorities.
8. Auditor's report templates, especially for publicly traded clients.
9. Engagement letter wording on fraud responsibilities.

Rolling out new fraud templates in Achekam

Achekam does not pull a live feed of standards and regulatory changes; the Standards & Regulatory Updates page shows what its knowledge base records. Tracking the revision and its local adoption is therefore the firm's job.

When the papers above are rewritten, the firm's partners can keep them as the firm's own methodology and working-paper templates beside Achekam's platform methodology. A template version is published only by someone other than its author, so the partner who redrafts the fraud risk assessment cannot also be the one who releases it to every engagement. Achekam's own template packs, written in its own words for audit areas, ISA for LCE and other engagement types, stay marked as unapproved platform content until the firm adopts them; read them against ISA 240 (Revised) before adopting anything for affected periods.

Briefing the team before the first affected year-end

A short, focused briefing works better than a long lecture:

• what the IAASB says the revision is for, in its own three aims;
• which clients fall under it first, by period start date;
• which templates have changed and where to find the new versions;
• one worked example from a real client, showing fraud thinking inside the risk assessment rather than after it;
• who to consult when a fraud question goes beyond the template.

Run it before planning starts on the first affected engagements, not during fieldwork. A revised fraud standard applied by a team that met it for the first time on site will look exactly like the old one.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.