HEHENDRAWANTOAUDIT, ACCOUNTING & TAX

ARTICLE · AUDIT

Revised ISA 240: The Auditor's Responsibilities Relating to Fraud

IAASB standard effective for periods beginning on or after 15 December 2026: scepticism, a fraud lens, responding to suspected fraud, and its position in Indonesia

By Hendrawanto, SE., Ak., CA., CLI., AseanCPA., CPA., CFI. · · Baca dalam Bahasa Indonesia

Infographic on ISA 240 (Revised): issued by the IAASB on 8 July 2025, effective for periods beginning on or after 15 December 2026, five key enhancements: professional scepticism, a fraud lens, responding to suspected fraud, and communication and transparency

On 8 July 2025, the International Auditing and Assurance Standards Board (IAASB) issued ISA 240 (Revised), "The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements". The international standard applies to audits of financial statements for periods beginning on or after 15 December 2026, so for calendar-year entities the 2027 financial statement audit will be the first affected in jurisdictions that adopt it.

Fraud is the risk that draws the most public attention when financial statements turn out to be wrong. The revision responds to criticism that auditors have been too passive when faced with signs of fraud. This article summarises the main changes, their position in Indonesia, and practical steps that boards of directors and audit committees can prepare.

Position in Indonesia

Public accountants in Indonesia apply the Standards on Auditing (SA) set by the Indonesian Institute of Certified Public Accountants (IAPI), including SA 240 on the auditor's responsibilities relating to fraud. The Standar Audit 2025 exposure draft issued by IAPI's Public Accountant Professional Standards Board, with a comment deadline of 10 October 2025, is based on the 2023–2024 edition of the IAASB Handbook, which predates ISA 240 (Revised). At the time of writing, the list of exposure drafts on IAPI's website does not yet include a revised SA 240.

This means the SA 240 currently in force remains the audit reference in Indonesia until IAPI decides otherwise. Even so, the direction of ISA 240 (Revised) is worth understanding now: Indonesia adopts ISAs periodically, and many of the practices strengthened by this revision can already be applied as good audit practice.

ISA 240 (Revised) timeline and Indonesia's position
  1. 8 Jul 2025The IAASB issues ISA 240 (Revised).
  2. 10 Oct 2025Comment deadline for IAPI's Standar Audit 2025 exposure draft, based on the 2023–2024 IAASB Handbook (before the revised ISA 240).
  3. 15 Dec 2026Effective internationally for periods beginning on or after this date, together with ISA 570 (Revised 2024).
  4. FY 2027For calendar-year entities, the first audit affected in adopting jurisdictions.
  5. IndonesiaIAPI's current SA 240 remains the reference until IAPI issues the revision.
Sources: IAASB (press release and ISA 240 Revised publication page); IAPI (Standar Audit 2025 exposure draft and exposure draft list).

Five Key Changes

The IAASB highlights five main enhancements. They can be summarised as follows.

  1. Clearer auditor responsibilities. The auditor still does not make legal determinations of whether fraud has occurred, but is responsible for obtaining reasonable assurance that the financial statements are free from material misstatement due to fraud. The standard uses the term "fraud or suspected fraud", including allegations that come to the auditor's attention, and explicitly covers third-party fraud against the entity, for example by customers, suppliers or related parties.
  2. Reinforced professional scepticism. The auditor must remain alert to information indicating fraud risk factors, follow up inconsistent responses from management, those charged with governance or internal audit, and investigate further when conditions indicate that a document may not be authentic or that its terms have been modified without disclosure.
  3. Risk assessment through a "fraud lens". The engagement team discussion must address how and where the financial statements are susceptible to fraud, including culture and tone at the top. The auditor must understand the entity's whistleblower programme and how complaints are handled. The presumed risk of fraud in revenue recognition remains, and if the auditor concludes that the presumption does not apply, the reasons must be documented. The risk of management override of controls continues to be treated as a financial statement level risk.
  4. Responding to identified or suspected fraud. A new section sets out what the auditor does on identifying fraud or suspected fraud: understanding the matter, making inquiries of management and, where appropriate, those charged with governance, and evaluating the entity's investigation and remedial actions. The engagement partner determines whether additional risk assessment or further procedures are needed and assesses the effect on materiality, the reliability of management representations, other audit areas and prior periods.
  5. Communication and transparency. The auditor must communicate fraud or suspected fraud on a timely basis to management and those charged with governance, unless prohibited by law or regulation, and consider whether there is a duty or right to report it to an authority outside the entity. In audits applying the key audit matters requirements (ISA 701), the auditor determines key audit matters related to fraud and presents them under a subheading that shows their link to fraud.
When fraud is identified or suspected
  1. 1
    Understand the matterInquire of management and, where appropriate, those charged with governance; evaluate the entity's investigation and remediation.
  2. 2
    Decide next stepsThe engagement partner considers additional risk assessment or further procedures and effects on prior periods.
  3. 3
    Assess the impactMateriality, control deficiencies, other audit areas, and reliability of representations and evidence, including possible collusion.
  4. 4
    Communicate and reportTimely to management and those charged with governance; consider any duty or right to report to an authority.
  5. 5
    Determine the opinionIf the financial statements are materially misstated or evidence is insufficient, the opinion is modified as required.
Summarised from ISA 240 (Revised). The auditor does not make legal determinations of whether fraud has occurred.

Sharper Procedures

Beyond these five points, several familiar procedures are now set out in more detail. Journal entry testing includes inquiries of financial reporting staff, checking the completeness of the journal population, selecting period-end entries and considering whether to test entries throughout the period. Accounting estimates are reviewed for indicators of management bias, and significant unusual transactions are evaluated for whether their business rationale instead suggests fraudulent financial reporting or concealment of misappropriated assets.

Near the end of the audit, the auditor performs analytical procedures to detect previously unrecognised fraud risks and then re-evaluates whether the risk assessment and the evidence obtained are sufficient. Documentation is also expanded: team discussions, the basis for fraud risk assessments, conclusions on the revenue recognition presumption, results of procedures on management override, findings, and all fraud-related communications.

A fraud lens throughout the audit
  1. Team discussionWhere and how the financial statements are susceptible to fraud, including culture and tone at the top.
  2. Risk assessmentWhistleblower programme, complaints, presumed revenue recognition risk, management override.
  3. ResponsesJournal entry testing, review of estimates for bias, significant unusual transactions.
  4. Overall evaluationAnalytical procedures near the end of the audit and reassessment of evidence.
  5. ReportingCommunication with management and those charged with governance, fraud-related key audit matters, documentation.
Summarised from ISA 240 (Revised); not a quotation of the standard.

Link with ISA 570 (Revised 2024)

ISA 240 (Revised) takes effect at the same time as ISA 570 (Revised 2024) on going concern. The IAASB aligned the two because fraud and financial distress are often interrelated: pressure to meet targets or lender requirements can drive manipulation of financial statements. The IAASB also encourages jurisdictions to consider early adoption of both standards, together with narrow-scope amendments for listed entities, as a package.

What Companies Should Prepare

ISA 240 governs auditors, not management. However, because auditors will ask deeper questions and request more evidence, a well-prepared company will have a smoother audit. Areas worth reviewing:

  • A documented internal fraud risk assessment, including revenue, estimates and related party transactions.
  • A working whistleblowing channel, with records of complaints received, how they were reviewed and how they were followed up.
  • Controls over manual journal entries, especially period-end entries, entries by users with broad access, and entries without adequate supporting documents.
  • Clear internal investigation procedures for suspected fraud, including when to involve the audit committee and legal counsel.
  • Open communication with the auditor: suspected fraud, including fraud by third parties, is better disclosed early than discovered later by the auditor.

Audit committees can use audit planning to ask how the auditor assesses the company's fraud risks and which procedures will be performed in response.

Conclusion

ISA 240 (Revised) sharpens the auditor's role in dealing with fraud: more consistent scepticism, risk assessment through a fraud lens, clear steps when fraud is identified or suspected, and more open communication, including in the auditor's report. In Indonesia, the current SA 240 remains the reference until IAPI adopts the revision, but companies need not wait to strengthen their anti-fraud controls, complaint channels and journal entry documentation.

If your company is dealing with suspected fraud, see our Investigative Audit and Financial Statement Audit services, read Revised SA 600: Changes to Group Financial Statement Audits and Understanding Audit Opinions, or request an estimate through the Proposal page.

Official References

  • IAASB, "IAASB Revises Fraud Standard to Enhance Public Trust", press release, 8 July 2025.
  • IAASB, International Standard on Auditing 240 (Revised), The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements (effective for periods beginning on or after 15 December 2026).
  • Indonesian Institute of Certified Public Accountants (IAPI), Standar Audit 2025 Exposure Draft and DSPAP exposure draft list.

This article is general information and is not legal, audit, or tax advice for any particular situation. Application to each company must consider the relevant facts, documents, and applicable regulations. The Indonesian version is the original text.