The auditor and the client's compliance with laws
What ISA 250 (Revised) requires of an auditor on a client's compliance with laws and regulations, and what to do about suspected non-compliance.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A transport client's operating licences lapsed for part of the year. A construction client employs workers without registering them for the statutory funds. A food manufacturer received a notice from a health inspector and has not mentioned it. None of these is an accounting error, and the auditor is not a lawyer or a regulator. Yet each could lead to fines, claims or closure, and each may need to be reflected in the statements, communicated to governance or reported outside the client.
ISA 250 (Revised) sets the auditor's responsibilities for considering laws and regulations. It does not make the auditor responsible for preventing non-compliance, and it recognises that an audit will not detect all of it. It does require specific work, and a disciplined response when non-compliance is suspected.
Laws with a direct effect on the statements
ISA 250 (Revised) divides laws and regulations into two categories. The first is those generally recognised to have a direct effect on the determination of material amounts and disclosures in the statements, such as tax and pension laws. For these, the auditor obtains sufficient appropriate evidence about compliance, as part of auditing the related balances.
In practice that means testing the tax charge and liability, checking statutory deductions from payroll were calculated and paid over, and confirming that amounts owed to the tax authority are complete. These procedures sit in the relevant areas of the file, not in a separate laws paper.
Other laws and the inquiries required
The second category is other laws that do not directly determine amounts in the statements but compliance with which may be fundamental to the business: operating licences, environmental permits, health and safety rules, industry regulation. For these, the auditor's work is limited to specified procedures:
- inquiring of management and, where appropriate, those charged with governance whether the entity is complying;
- inspecting correspondence, if any, with the relevant licensing or regulatory authorities.
The auditor also stays alert throughout the audit: reading minutes, legal invoices and correspondence, and noticing payments that look like fines, penalties or settlements.
Use the RFI console to ask for the list of licences and permits the client holds, and for correspondence with regulators during the year. Staff create, send and track requests for documents, answers and confirmations there, and the request's timeline shows what was asked and when it was answered. A client that says "there is no correspondence" in writing has given you something you can rely on and, if it proves untrue, something to raise.
Suspected non-compliance
When the auditor becomes aware of information about identified or suspected non-compliance, ISA 250 (Revised) requires the auditor to:
- obtain an understanding of the nature of the act and the circumstances in which it occurred;
- obtain further information to evaluate the possible effect on the statements;
- discuss the matter with management and, where appropriate, those charged with governance, unless law or regulation prohibits it;
- consider the need for legal advice if management or governance does not provide sufficient information that the entity is in compliance;
- evaluate the implications for other aspects of the audit, including the risk assessment and the reliability of written representations.
Suspected non-compliance is sensitive inside the firm as well as outside it. Partners and administrators can restrict a client or one engagement in Achekam to named people with a reason, and a restriction is lifted rather than deleted, with who did what and when recorded. The account manager and the engagement's partner and manager can always open it, so choose those people with the restriction in mind.
Consulting and legal advice
These matters rarely have a clear answer at the point they arise. Is the act non-compliance at all? Is it material? Does a reporting duty apply, and does it override confidentiality? Staff can take a technical consultation from question to conclusion and closure, and record a difference of opinion with each party's position, escalation and resolution. Record the legal advice obtained, or why it was not needed.
Effects on the report, and confidentiality
If non-compliance has a material effect on the statements that is not adequately reflected, the auditor expresses a qualified or adverse opinion under ISA 705. If management or governance prevents the auditor from obtaining sufficient evidence, the auditor considers a qualified opinion or a disclaimer. In Achekam, the engagement team drafts the report on standard ISA 700, 705, 706 and 701 wording, approval is refused while any bracketed placeholder remains, and only the engagement partner approves. The choice of modification is covered in qualified, adverse or disclaimer.
ISA 250 (Revised) also requires the auditor to determine whether law, regulation or ethical requirements require reporting to an authority outside the entity, or establish responsibilities under which reporting may be appropriate. The rules differ by country:
- South Africa: registered auditors have a statutory duty to report reportable irregularities to IRBA under section 45 of the Auditing Profession Act. IRBA's page on reportable irregularities sets out that duty, with IRBA's guide and illustrative report letters.
- Nigeria: under FRC Rule 14, from 1 January 2025, the auditor must confirm by e-mail to the FRC, before signing an opinion, that the client and its signatories complied with FRC requirements. Achekam does not send that e-mail; the auditor sends it and records it with evidence in Achekam, and signing stays blocked until it is recorded.
- Kenya: follow ICPAK's requirements and take legal advice on any duty to report outside the entity.
Where a reporting duty applies, it generally overrides the duty of confidentiality to the client for that purpose. Where it does not, confidentiality still binds the auditor, and legal advice is the safe course before saying anything to a third party.
Inquiries of the client's lawyers often surface the first sign of non-compliance; see confirming litigation and claims with lawyers.
Recording the work
On the laws and regulations work item, each procedure is marked done only with a written response and its documents, or set aside with a reason, and steps are never deleted. Record the laws identified as relevant, the inquiries made and of whom, the correspondence inspected, any suspected non-compliance and its resolution, and the written representation obtained.
A short planning step
At planning, list the licences, permits and regulators that matter to the client's industry, in one table. The inquiries, the correspondence request and the reporting question all follow from that list.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
