Fraud is the risk every auditor worries about and few feel fully equipped to handle. ISA 240, The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements, sets out what auditors must do: not to guarantee that no fraud exists, but to obtain reasonable assurance that the financial statements are free from material misstatement, whether caused by fraud or error.

The standard is also changing. The IAASB issued ISA 240 (Revised) in July 2025, effective for audits of financial statements for periods beginning on or after 15 December 2026. For a December year-end client, that means the 2027 audit. This article covers what the standard requires, what the revision changes, the gaps we see most often in practice, and a checklist your team can use now.

What ISA 240 requires

ISA 240 separates two kinds of intentional misstatement:

• Fraudulent financial reporting: deliberately misstating or omitting amounts or disclosures to mislead users. Examples are inflated revenue, understated liabilities and manipulated estimates.
• Misappropriation of assets: theft of the entity’s assets. Examples are fictitious suppliers, ghost employees, diverted receipts and personal use of company property.

The core requirements follow the audit cycle:

1. Professional scepticism throughout. Recognise that fraud could exist even where management has seemed honest in the past.
2. An engagement team discussion about how and where the financial statements could be susceptible to fraud.
3. Risk assessment procedures, including inquiries of management, internal audit and those charged with governance about fraud risks and any known or suspected fraud.
4. Evaluation of fraud risk factors using the fraud triangle: incentive or pressure, opportunity, and attitude or rationalisation.
5. A presumed risk of fraud in revenue recognition. If the auditor concludes the presumption does not apply, the reasons must be documented.
6. Responses to management override of controls. This risk is present in every entity. Required procedures include testing journal entries and other adjustments, reviewing accounting estimates for bias, and evaluating the business rationale for significant unusual transactions.
7. Evaluation of audit evidence, including whether identified misstatements could indicate fraud.
8. Communication with management and those charged with governance, and with regulators where law requires it.
9. Documentation of the discussion, the identified risks, the responses and the communications.

What changes under ISA 240 (Revised)

The revised standard keeps the same foundations but raises expectations in several areas:

• Clearer auditor responsibilities. The auditor’s responsibilities come first in the standard, and inherent limitations are presented separately so they cannot be used as a reason for weak procedures.
• Stronger scepticism. The revised standard places more emphasis on challenging management’s explanations and on remaining alert to information that contradicts other evidence, including records and documents that may not be authentic.
• A fraud lens on risk assessment that aligns with ISA 315 (Revised 2019). This includes understanding the entity’s whistleblower programme and how it handles fraud allegations.
• A harder-to-rebut revenue presumption.
• Ongoing communication about fraud matters with management and those charged with governance throughout the audit, not just at the end.
• More transparency in the auditor’s report for listed entities. Fraud-related matters can be reported as key audit matters.
• A stand-back evaluation before forming the opinion, to confirm the fraud risk assessment and responses remain appropriate.
• Scalability guidance for smaller entities and practices.

The IAASB encourages early adoption alongside ISA 570 (Revised 2024) on going concern. Firms in Zimbabwe should check adoption timing with their professional body and regulator. Either way, the 2026 planning season is the right time to start updating methodology and templates.

Why it matters in the Zimbabwean context

Several features of our operating environment raise fraud risk factors:

• Multi-currency records. Transactions in ZiG and USD, with changing exchange rates, create opportunities to manipulate translation, apply the wrong rate or move value between currency ledgers. Unusual exchange-rate entries deserve specific journal testing.
• Pressure on results. Banks facing capital and liquidity targets, and companies with covenants or performance-linked bonuses, have incentives to manage earnings.
• Public sector and NGOs. Procurement, payroll and donor-funded programmes are frequently exposed to misappropriation, especially where segregation of duties is limited at district or project level.
• Cash-heavy operations. Retail, transport and agriculture businesses with high cash volumes give more opportunity for skimming and unrecorded sales.

Common gaps seen in practice

Reviews of audit files often find the same weaknesses:

• Boilerplate team discussions. The minutes repeat last year’s wording and do not identify specific accounts, people or schemes.
• Revenue presumption rebutted without real reasoning, or accepted but answered with generic procedures that do not target the specific fraud risk.
• Weak journal entry testing. Selection criteria are not linked to fraud risk factors, the population is not reconciled to the trial balance, and there is no evidence that period-end and post-closing entries were covered. Data analytics tools such as ProDataTool make it practical to filter and stratify the full journal population, so you are not limited to a small sample.
• Accounting estimates reviewed one at a time, with no retrospective review for management bias across estimates.
• Inquiries limited to the finance director. Internal audit, the audit committee, and staff outside finance are not asked.
• Misstatements explained away as errors without considering whether they point to intent.
• Late communication of suspected fraud to those charged with governance.

Practical ISA 240 checklist

Area	Question to answer on file	Done?
Team discussion	Did we identify specific fraud schemes by account and process, with senior team members present?	☐
Inquiries	Have we asked management, internal audit, those charged with governance and selected other staff about fraud risks and known or suspected fraud?	☐
Whistleblowing	Do we understand the whistleblower channel and how allegations were handled this year?	☐
Fraud risk factors	Have incentives, opportunities and rationalisation been assessed and linked to specific risks?	☐
Revenue	Is the revenue fraud risk defined (which streams and which assertions), with targeted procedures?	☐
Journal entries	Is the population complete, are the selection criteria risk-based, and are period-end and post-closing entries covered?	☐
Estimates	Has a retrospective review for management bias been performed?	☐
Unusual transactions	Is the business rationale for significant unusual transactions evaluated?	☐
Unpredictability	Have we included at least one procedure management would not expect?	☐
Communication	Have fraud matters been communicated promptly to the right level?	☐
Stand-back	Before signing, are the fraud risk assessment and responses still appropriate?	☐

Conclusion

ISA 240 does not make auditors fraud investigators, but it does require a sceptical, specific and well-documented response to fraud risk. The revised standard raises the bar with clearer responsibilities, more communication and greater transparency. Audit teams that adapt their risk assessment, journal testing and documentation now will be ready for the transition. Many internal audit functions are tightening their fraud-related work in the same way.

Bring structure to your fraud risk work with Auditors Track GRC

Fraud risk assessments, findings and evidence are hard to keep together when they sit in scattered spreadsheets and email threads. Auditors Track GRC is internal audit management software that helps organisations across Africa digitise audit work. Your team can run risk assessments, conduct audit reviews, record findings, write reports and attach evidence in one place. It also offers dashboards by department and engagement type, multi-user department assignments, and built-in libraries of controls, audits, working papers and risks. Book a free demo of Auditors Track GRC to see how it can support your next audit cycle.