Under ISA (UK) 250 Section A the auditor must obtain sufficient appropriate evidence that a company has complied with the laws that directly determine figures and disclosures in its accounts, such as tax and pensions law, but for every other law only has to make enquiries, inspect correspondence with regulators and stay alert. Once non compliance is found or suspected, the auditor must understand it, discuss it, weigh the effect on the accounts and the opinion, tell those charged with governance and decide whether the law requires a report to someone outside the company.
Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.
Which version of the standard applies today?
The current text is ISA (UK) 250 Section A (Revised November 2019), most recently updated in September 2025. It applies to audits of financial statements for periods commencing on or after 15 December 2019 (paragraph 10). Section B is a separate standard covering the statutory right and duty of auditors of public interest entities and other financial sector entities to report direct to their regulators.
Change is coming. In March 2026 the FRC issued a re consultation on ISA (UK) 250 (Revised) and a new ISA (UK) 270 (Revised) on reporting to an appropriate authority outside the entity, with responses due by 21 May 2026. The proposals replace the split between direct and indirect laws with a risk based approach. At the time of writing no final revised standard had been published, so the 2019 text still governs current audits. For where this standard sits among the others, see ISAs (UK): the auditing standards.
Is the auditor responsible for making sure the company obeys the law?
No. Paragraph 3 puts responsibility for compliance on management, with the oversight of those charged with governance. Paragraph 4 says the auditor is not responsible for preventing non compliance and cannot be expected to detect non compliance with all laws and regulations.
Paragraph 5 explains why: many operating laws never touch the accounting system, breaches may be concealed, and whether an act breaks the law is ultimately for a court to decide.
Paragraph 12 defines non compliance as acts of omission or commission, intentional or not, by the entity, those charged with governance, management or others working for or under the direction of the entity, that are contrary to law or regulation. Personal misconduct unrelated to the business is excluded.
Worried about an HMRC check? Tax investigation insurance pays your accountant’s fees if HMRC opens an enquiry or compliance check. Solar Protect cover pays up to £100,000 with no excess. It never pays tax, interest or penalties.
From £108.75 a year (£9.06 a month) for individuals, £117.57 for sole traders and £207.50 for companies and partnerships, including IPT and the £20 admin fee.
See my price in 2 questions or call 01795 841 310.
★★★★★ Rated 4.9 out of 5 on Trustpilot from over 160 reviews
What is the difference between the two categories of law?
Paragraph 6 divides the legal framework into two groups, and the work required differs sharply.
| Category | Examples given in the standard | What the auditor must do |
|---|---|---|
| Laws with a direct effect on material amounts and disclosures (paragraph 6(a)) | Tax and pensions law; in the UK, the rules on distributions only out of profits available, keeping adequate accounting records and disclosing directors’ remuneration (A12) | Obtain sufficient appropriate audit evidence about compliance (paragraph 14) |
| Other laws fundamental to the business (paragraph 6(b)) | Operating licence terms, regulatory solvency requirements, environmental regulation | Perform the specified procedures in paragraph 15 and remain alert (paragraph 16) |
For the second group, paragraph 15 requires two things: enquiry of management and, where appropriate, those charged with governance about whether the entity complies, and inspection of any correspondence with licensing or regulatory authorities. Paragraph A15 notes that ordinary work such as reading board minutes and asking lawyers about claims often brings breaches to light anyway.
Paragraph 17 requires written representations that all known actual or suspected non compliance has been disclosed to the auditor. Paragraph 18 then sets a limit: if nothing suggests non compliance, the auditor need not go beyond paragraphs 13 to 17. Paragraph 13 requires a general understanding of the legal framework as part of the ISA (UK) 315 risk assessment, and paragraph A14-1 adds that a small entity outside a regulated sector will need few specific procedures.
What happens when the auditor suspects a breach?
Paragraph 19 requires the auditor to understand the nature of the act and the circumstances, and to obtain further information to evaluate the possible effect on the accounts. Paragraph 20 requires the auditor to discuss the suspicion with the appropriate level of management and, where appropriate, those charged with governance, unless the law prohibits it. If they cannot show the entity complied and the effect may be material, quantitatively or qualitatively, the auditor must consider taking legal advice.
If sufficient information cannot be obtained, paragraph 21 requires the auditor to evaluate the effect on the opinion. Paragraph 22 requires the auditor to think about knock on effects, including the risk assessment and how far written representations can now be relied on. Paragraph A25 notes that withdrawal may be considered where integrity is in doubt, but it does not replace any duty to report.
Who does the auditor tell inside the company?
- Those charged with governance. Paragraph 23 requires the auditor to communicate non compliance that comes to their attention, other than clearly inconsequential items, unless the law prohibits it or all of those charged with governance are also in management and already know.
- Urgently, if it is deliberate and material. Paragraph 24 requires communication as soon as practicable where the auditor believes the non compliance is intentional and material.
- Over management’s head. Paragraph 25 says that if management or those charged with governance are suspected of involvement, the auditor goes to the next level of authority, such as an audit committee. If none exists, or the auditor doubts the report will be acted on, the auditor must consider legal advice.
- Public interest entities. Paragraph 23-1 requires the auditor to inform the entity of suspected irregularities, including fraud, and invite it to investigate. If it does not investigate, paragraph 29-1 requires the auditor to inform the authorities responsible for investigating.
How can a breach affect the audit opinion?
Paragraph 26 requires a qualified or adverse opinion where non compliance has a material effect on the accounts and has not been adequately reflected. Paragraph 27 requires a qualified opinion or a disclaimer where management or those charged with governance stop the auditor obtaining the evidence needed. Paragraph 28 deals with limitations caused by circumstances rather than by the client, which the auditor evaluates under ISA (UK) 705. The different outcomes are explained in types of audit opinion.
A clean opinion can still follow if the accounts deal with the consequences properly. Paragraph A27-1 points out that disclosure may be needed even where the immediate financial effect is small, because fines or litigation could follow or the breach may be qualitatively material.
When must the auditor report outside the company?
Paragraph 29 requires the auditor to determine whether law, regulation or ethical rules require, or make appropriate, a report to an authority outside the entity. Three routes arise in the UK.
- Money laundering. Paragraph A29-1 explains that UK anti money laundering legislation imposes a duty to report suspected money laundering, and that partners and staff must avoid tipping off, which is a criminal offence. The appendix lists the Proceeds of Crime Act 2002, the Terrorism Act 2000, the Crime and Courts Act 2013, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and the Criminal Finances Act 2017. See AML supervision for accountants and defence against money laundering.
- Regulated entities. Under Section B, the auditor of a regulated entity has a statutory duty to report information relevant to the regulator’s functions that is, or may be, of material significance to the regulator. Paragraph 2(b) of Section B says the auditor has no responsibility to search out such information; the duty arises from what is found in the course of the audit. Footnote 16c of Section A notes similar duties for auditors of pension schemes and charities.
- Public interest. Paragraphs A33-1 to A33-5 describe reporting in the public interest. Normally the auditor discusses the issue with those charged with governance first, notifies them in writing of the conclusion and reports directly if the entity does not. The auditor reports without discussion if they no longer have confidence in the integrity of those charged with governance. The auditor is protected from claims for breach of confidence or defamation if the disclosure is made in the public interest to an appropriate body and without malice.
How might this look on a real audit?
Illustration only. A chemicals distributor has audit materiality of 150,000 pounds. While reading board minutes the audit senior sees a reference to a regulator’s warning letter about breaches of a site permit. The auditor obtains the letter (paragraph 15(b)), discusses it with the finance director and the board (paragraph 20), and learns the regulator is considering a fine that could exceed 200,000 pounds. The auditor considers whether a provision or contingent liability disclosure is needed, revisits the reliability of management’s earlier answers (paragraph 22), reports the issue to the board (paragraph 23) and documents the work and discussions (paragraph 30). If the accounts are adjusted or properly disclosed, the opinion can remain unmodified.
What mistakes come up most often?
- Treating ISA (UK) 250 as a requirement to audit legal compliance generally. Outside paragraph 6(a) laws, the work is enquiry, inspection and alertness.
- Relying on enquiry alone for tax and pensions compliance, which needs real evidence under paragraph 14.
- Leaving the compliance confirmation out of the representation letter required by paragraph 17.
- Discussing a money laundering suspicion with the client in a way that tips them off.
- Failing to record the procedures, judgements and discussions that paragraph 30 requires. See audit documentation.
Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.
Related Accountapedia entries
- The auditor and other information: ISA (UK) 720
- Communicating with those charged with governance
- Management representation letters
- Responding to non compliance with laws and regulations
- Fraud and the auditor: ISA (UK) 240
Sources
- Financial Reporting Council: Isa uk 250 section a
- Financial Reporting Council: ISA UK 250A Revised November 2019 Updated September 2025
- Financial Reporting Council: Re consultation on isa uk 250 revised and isa uk 270 revised
- Financial Reporting Council: ISA UK 250B Revised November 2019 Updated September 2025
Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.