Fraud: what management owns and what the auditor owns
Who prevents and detects fraud in a client, what the auditor is actually responsible for, and how to set that out before anything goes wrong.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
"Isn't that what we pay you for?" Most audit partners have heard a version of it, usually after a client discovers that a bookkeeper has been paying herself twice, or that a sales manager invented customers to reach a target. The client assumed the audit was a fraud check. The auditor understood it differently, and the gap between those two views is where complaints, fee disputes and sometimes litigation begin.
The split of responsibility is not complicated, but it has to be explained before something goes wrong, not afterwards. Here is how it divides, what the revised fraud standard is changing, and how to put it on paper.
Management and the board own prevention
ACCA explains that in a limited company the board of directors is responsible for ensuring appropriate internal controls are in place, while in sole traders and unlimited partnerships that responsibility often lies with the owners. Preventing fraud and catching it day to day are the work of those controls: who can approve a payment, who can add a supplier, who reconciles the bank account, who checks the payroll before it is paid.
Culture matters as much as procedure. Investopedia explains that the control environment, set by the board and by management leading by example, establishes for every employee the importance of integrity and a commitment to rooting out improprieties, including fraud. A board that tolerates convenient month-end adjustments to meet a target has set the tone, whatever its written policies say.
In an owner-managed business, that often means the owner in person. The consequence is the same either way: the people who run the business are the first line against fraud, and an annual audit is no substitute for them.
What the auditor is responsible for
ACCA states it directly: it is not the auditor's responsibility to prevent or detect fraud, but the auditor must identify and assess the risk of misstatement due to fraud and respond appropriately to obtain sufficient appropriate evidence about those risks.
That sits inside the overall objective. ICAEW explains that ISA 200 requires the auditor to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error. Two limits are built into that sentence. The auditor is concerned with fraud that materially misstates the statements, not with every theft from the petty cash tin. And the assurance is reasonable, not absolute, because concealment, forgery and collusion can defeat well-designed procedures.
In practice, the auditor's fraud work on a typical engagement covers:
- a team discussion of where and how the statements could be manipulated;
- questions to management and those charged with governance about fraud risks and any known or suspected fraud;
- an assessment of the pressures, incentives and opportunities in the business;
- procedures designed around the risks found, including the risk that management overrides controls;
- an evaluation of whether misstatements found could point to fraud;
- reporting what was found to the right level of management and to those charged with governance.
Clearer responsibilities under ISA 240 (Revised)
The IAASB states that ISA 240 (Revised), The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, has been revised to deliver clearer responsibilities, stronger risk response and improved transparency. The IAASB's ISA 240 (Revised) publication page summarises those aims and gives access to the revised standard, which the IAASB says applies to periods beginning on or after 15 December 2026.
For a conversation with a client, the point is not the detail of the new requirements; it is that the auditor's own part is being set out more clearly. An audit remains an audit, not a forensic investigation, and a firm that wants to offer the latter should scope and price it as a separate engagement.
Setting expectations in the engagement letter
The engagement letter is where the split is first written down: management's responsibility for internal control and for preventing and detecting fraud, the auditor's responsibility to obtain reasonable assurance, and the inherent limits of an audit. If those paragraphs are boilerplate that nobody discussed, they will not help much when a client feels let down.
In Achekam, AI can draft an engagement letter's clauses, never its fees, and a person saves the draft. Achekam will not send a letter whose wording breaks the professional guardrails, and for audits and reviews it will not send one before a partner has reviewed it. That partner review is the moment to read the fraud paragraph slowly: does it describe what the firm will actually do, and does anything in the covering e-mail or proposal promise more? Audit engagement letter terms covers the rest of the letter.
Recording fraud-related findings
When the team does find something, such as a duplicated supplier payment, a journal with no support or a salary paid to someone who left, the working papers need to show what was found, what was done about it and who was told.
In Achekam, findings can be raised from a working paper and later closed or withdrawn, so each one carries a status rather than sitting in a note. Where a finding leads to a correction, staff record an audit adjustment against the lead schedule line with a reason; lead schedules are built from the engagement's trial balance, with each figure traceable to its lines. If the matter reaches the opinion, the auditor's report is drafted on standard ISA wording for a qualified, adverse or disclaimer opinion, and only the engagement partner can approve it.
A finding that suggests fraud also needs judgement about whom to tell, and when, particularly if management may be involved. Record that reasoning, not only the outcome. Revenue is one of the commonest areas; see responding to revenue fraud risk.
Answering "that is what we pay you for"
A reply that is honest without being defensive might run like this:
Our audit is designed to give reasonable assurance that your financial statements as a whole are not materially misstated, including by fraud. We assess where fraud could distort the statements and we test those areas. We do not examine every transaction, and a well-concealed fraud, especially one involving collusion or senior people, can get past an audit. Preventing and detecting fraud day to day is the job of your controls, and we report the weaknesses we find in them.
Then follow through. If the audit did identify the weakness that allowed the fraud, show the client where it was reported. If it did not, ask honestly whether the risk assessment should have picked it up, and record that review as well.
The right time to settle who owns fraud is the first meeting with a new client, when nobody has anything to defend. Use it.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
