Consideration of Laws and Regulations in an Audit: CPA Exam Guide

The Auditor's Responsibility for Laws and Regulations

The auditor has a responsibility to consider the effect of laws and regulations on the financial statements during a financial statement audit. Under AU-C Section 250, the auditor's responsibility varies depending on whether the laws and regulations have a direct effect or an indirect effect on the financial statements. This distinction is critical for the CPA AUD exam because it determines the nature and extent of the auditor's procedures and reporting obligations.

An audit conducted in accordance with generally accepted auditing standards cannot be expected to detect all instances of noncompliance with laws and regulations. The inherent limitations of an audit, combined with the nature of noncompliance (which may involve intentional concealment, collusion, or forgery), make it impossible for the auditor to guarantee that all noncompliance will be identified. Nevertheless, the auditor must plan and perform the audit with professional skepticism, recognizing that noncompliance could materially affect the financial statements.

Direct-Effect Laws and Regulations

Definition and Examples

Laws and regulations with a direct effect on the financial statements are those that directly determine the reported amounts and disclosures. These include tax laws that determine income tax provisions and liabilities, regulations governing revenue recognition in regulated industries (such as rate-setting regulations for utilities), pension and benefit laws that determine pension obligations, and environmental regulations that require recognition of remediation liabilities.

Auditor's Procedures

For laws and regulations with a direct effect, the auditor has a responsibility to obtain sufficient appropriate audit evidence about compliance. This is analogous to the auditor's responsibility for any assertion that directly affects the financial statements. Procedures include evaluating the entity's compliance with applicable laws and regulations as part of the audit of the related financial statement amounts, testing transactions for compliance, and evaluating the adequacy of related disclosures.

Indirect-Effect Laws and Regulations

Definition and Examples

Laws and regulations with an indirect effect on the financial statements are those that do not directly determine reported amounts but whose violation could have material consequences for the entity. Examples include occupational safety and health laws, environmental protection laws, equal employment opportunity laws, antitrust and competition laws, and anti-bribery and anti-corruption laws (such as the Foreign Corrupt Practices Act).

Auditor's Procedures

For laws and regulations with an indirect effect, the auditor's responsibility is limited to performing specified audit procedures that may identify noncompliance. These procedures include inquiring of management and those charged with governance about whether the entity is in compliance with applicable laws and regulations, inspecting correspondence with licensing or regulatory authorities, and remaining alert during the audit for indications that noncompliance may have occurred. The auditor is not required to design specific procedures to detect violations of these laws and regulations but must respond appropriately if information comes to the auditor's attention suggesting noncompliance.

Responding to Identified or Suspected Noncompliance

Evaluating the Effect on Financial Statements

When the auditor identifies or suspects noncompliance, the auditor must obtain an understanding of the nature of the act, the circumstances in which it occurred, and sufficient information to evaluate the possible effect on the financial statements. The auditor considers whether the noncompliance could result in material financial statement amounts such as fines, penalties, damages, contingent liabilities, revenue losses, or asset impairments.

Communication Requirements

The auditor must communicate identified or suspected noncompliance with laws and regulations to the appropriate level of management unless the matters are clearly inconsequential. Noncompliance that involves senior management or results in a material misstatement must be communicated to those charged with governance. If the auditor suspects that management or those charged with governance are involved in the noncompliance, the auditor should communicate the matter to the next higher level of authority, such as an audit committee or supervisory board.

Implications for the Audit Report

If the auditor concludes that noncompliance has a material effect on the financial statements and has not been properly reflected, the auditor should express a qualified or adverse opinion. If the auditor is unable to determine whether noncompliance has occurred because of management-imposed limitations on the scope of the audit, the auditor should consider the implications for the audit opinion, which may result in a qualification or disclaimer. When the entity's noncompliance is so severe that the auditor questions the integrity of management, the auditor may consider withdrawing from the engagement.

Reporting to Regulatory Authorities

Generally, the auditor's duty of confidentiality precludes reporting noncompliance to parties outside the entity. However, in certain circumstances, the auditor may have a legal obligation to report noncompliance to regulatory authorities, such as in audits of entities subject to government regulation (financial institutions, government entities) or when specifically required by law. The auditor should consider consulting with legal counsel when deciding whether to report to external parties.

CPA Exam Tips

• Distinguish between direct-effect and indirect-effect laws and regulations. The auditor has a more extensive responsibility for direct-effect laws.
• For indirect-effect laws, the auditor performs specified procedures but is not required to design audit procedures to detect noncompliance.
• Noncompliance involving senior management must be communicated to those charged with governance regardless of materiality.
• The auditor's report may need to be modified if noncompliance has a material effect on the financial statements that is not properly reflected.
• The auditor's duty of confidentiality generally precludes reporting noncompliance to external parties unless required by law or regulation.