<strong>ISSAI</strong> 1250ISA 250CONSIDERATION OF LAWS AND REGULATIONSIN AN AUDIT OF FINANCIAL STATEMENTSA16. If m<strong>an</strong>agement or, as appropriate, those charged with govern<strong>an</strong>ce do notprovide sufficient <strong>in</strong>formation to the auditor that the entity is <strong>in</strong> fact <strong>in</strong>compli<strong>an</strong>ce with laws <strong><strong>an</strong>d</strong> regulations, the auditor may consider itappropriate to consult with the entity’s <strong>in</strong>-house legal counsel or externallegal counsel about the application <strong>of</strong> the laws <strong><strong>an</strong>d</strong> regulations to thecircumst<strong>an</strong>ces, <strong>in</strong>clud<strong>in</strong>g the possibility <strong>of</strong> fraud, <strong><strong>an</strong>d</strong> the possible effects onthe f<strong>in</strong><strong>an</strong>cial statements. If it is not considered appropriate to consult withthe entity’s legal counsel or if the auditor is not satisfied with the legalcounsel’s op<strong>in</strong>ion, the auditor may consider it appropriate to consult theauditor’s own legal counsel as to whether a contravention <strong>of</strong> a law orregulation is <strong>in</strong>volved, the possible legal consequences, <strong>in</strong>clud<strong>in</strong>g thepossibility <strong>of</strong> fraud, <strong><strong>an</strong>d</strong> what further action, if <strong>an</strong>y, the auditor would take.Evaluat<strong>in</strong>g the Implications <strong>of</strong> Non-Compli<strong>an</strong>ce (Ref: Para. 21)A17. As required by paragraph 21, the auditor evaluates the implications <strong>of</strong> noncompli<strong>an</strong>ce<strong>in</strong> relation to other aspects <strong>of</strong> the audit, <strong>in</strong>clud<strong>in</strong>g the auditor’srisk assessment <strong><strong>an</strong>d</strong> the reliability <strong>of</strong> written representations. Theimplications <strong>of</strong> particular <strong>in</strong>st<strong>an</strong>ces <strong>of</strong> non-compli<strong>an</strong>ce identified by theauditor will depend on the relationship <strong>of</strong> the perpetration <strong><strong>an</strong>d</strong> concealment,if <strong>an</strong>y, <strong>of</strong> the act to specific control activities <strong><strong>an</strong>d</strong> the level <strong>of</strong> m<strong>an</strong>agementor employees <strong>in</strong>volved, especially implications aris<strong>in</strong>g from the<strong>in</strong>volvement <strong>of</strong> the highest authority with<strong>in</strong> the entity.A18. In exceptional cases, the auditor may consider whether withdrawal from theengagement, where withdrawal is possible under applicable law orregulation, is necessary when m<strong>an</strong>agement or those charged withgovern<strong>an</strong>ce do not take the remedial action that the auditor considersappropriate <strong>in</strong> the circumst<strong>an</strong>ces, even when the non-compli<strong>an</strong>ce is notmaterial to the f<strong>in</strong><strong>an</strong>cial statements. When decid<strong>in</strong>g whether withdrawalfrom the engagement is necessary, the auditor may consider seek<strong>in</strong>g legaladvice. If withdrawal from the engagement is not possible, the auditor mayconsider alternative actions, <strong>in</strong>clud<strong>in</strong>g describ<strong>in</strong>g the non-compli<strong>an</strong>ce <strong>in</strong> <strong>an</strong>Other Matter(s) paragraph <strong>in</strong> the auditor’s report. 11Report<strong>in</strong>g <strong>of</strong> Identified or Suspected Non-Compli<strong>an</strong>ceReport<strong>in</strong>g Non-Compli<strong>an</strong>ce to Regulatory <strong><strong>an</strong>d</strong> Enforcement Authorities (Ref: Para. 28)A19. The auditor’s pr<strong>of</strong>essional duty to ma<strong>in</strong>ta<strong>in</strong> the confidentiality <strong>of</strong> client<strong>in</strong>formation may preclude report<strong>in</strong>g identified or suspected non-compli<strong>an</strong>cewith laws <strong><strong>an</strong>d</strong> regulations to a party outside the entity. However, theauditor’s legal responsibilities vary by jurisdiction <strong><strong>an</strong>d</strong>, <strong>in</strong> certa<strong>in</strong>circumst<strong>an</strong>ces, the duty <strong>of</strong> confidentiality may be overridden by statute, the11 ISA 706, “Emphasis <strong>of</strong> Matter Paragraphs <strong><strong>an</strong>d</strong> Other Matter Paragraphs <strong>in</strong> the Independent <strong>Audit</strong>or’sReport,” paragraph 8.15304 <strong>Consideration</strong> <strong>of</strong> <strong>Laws</strong> <strong><strong>an</strong>d</strong> <strong>Regulations</strong> <strong>in</strong> <strong>an</strong> <strong>Audit</strong> <strong>of</strong> F<strong>in</strong><strong>an</strong>cial Statements
<strong>ISSAI</strong> 1250ISA 250CONSIDERATION OF LAWS AND REGULATIONSIN AN AUDIT OF FINANCIAL STATEMENTSlaw or courts <strong>of</strong> law. In some jurisdictions, the auditor <strong>of</strong> a f<strong>in</strong><strong>an</strong>cial<strong>in</strong>stitution has a statutory duty to report the occurrence, or suspectedoccurrence, <strong>of</strong> non-compli<strong>an</strong>ce with laws <strong><strong>an</strong>d</strong> regulations to supervisoryauthorities. Also, <strong>in</strong> some jurisdictions, the auditor has a duty to reportmisstatements to authorities <strong>in</strong> those cases where m<strong>an</strong>agement <strong><strong>an</strong>d</strong>, whereapplicable, those charged with govern<strong>an</strong>ce fail to take corrective action. Theauditor may consider it appropriate to obta<strong>in</strong> legal advice to determ<strong>in</strong>e theappropriate course <strong>of</strong> action.<strong>Consideration</strong>s Specific to Public Sector EntitiesA20. A public sector auditor may be obliged to report on <strong>in</strong>st<strong>an</strong>ces <strong>of</strong> noncompli<strong>an</strong>ceto the legislature or other govern<strong>in</strong>g body or to report them <strong>in</strong>the auditor’s report.Documentation (Ref: Para. 29)A21. The auditor’s documentation <strong>of</strong> f<strong>in</strong>d<strong>in</strong>gs regard<strong>in</strong>g identified or suspectednon-compli<strong>an</strong>ce with laws <strong><strong>an</strong>d</strong> regulations may <strong>in</strong>clude, for example:• Copies <strong>of</strong> records or documents.• M<strong>in</strong>utes <strong>of</strong> discussions held with m<strong>an</strong>agement, those charged withgovern<strong>an</strong>ce or parties outside the entity.16<strong>Consideration</strong> <strong>of</strong> <strong>Laws</strong> <strong><strong>an</strong>d</strong> <strong>Regulations</strong> <strong>in</strong> <strong>an</strong> <strong>Audit</strong> <strong>of</strong> F<strong>in</strong><strong>an</strong>cial Statements 305