ISA (UK) 240 revised: what changes on fraud, and how to apply it on a smaller audit

ISA 240 revised, published by the FRC as ISA (UK) 240 (Revised March 2026), applies to every UK statutory audit of financial statements for periods beginning on or after 15 December 2026. For a company with a 31 December year end, the first affected year end is 31 December 2027. The revision brings the UK fraud standard back into line with the IAASB's revised ISA 240. Because the UK strengthened its own standard in 2021, much of the international change was already UK practice, and the FRC expects "minimal additional work for auditors beyond that required by the international standards themselves". For a smaller audit the real changes are a handful of new steps, a longer documentation list and a different auditor's report.

This guide compares the March 2026 text with the May 2021 UK edition it replaces, paragraph by paragraph, and then applies it to an owner-managed company.

What is ISA (UK) 240 revised, and which edition applies?

ISA (UK) 240 revised is ISA (UK) 240 (Revised March 2026), the FRC's fraud standard published on 30 April 2026. It applies to periods beginning on or after 15 December 2026; earlier periods stay under the May 2021 edition. Three documents carry similar names, and readers searching for "ISA 240 revised 2024" or "2025" usually mean one of them:

• ISA 240 (Revised), the IAASB's international standard, issued in July 2025 (the FRC's feedback statement calls it ISA 240 (Revised 2024)).
• ISA (UK) 240 (Revised March 2026), the UK standard and the new edition.
• ISA (UK) 240 (Revised May 2021) (Updated September 2025), the current UK edition, which continues to apply to periods beginning before 15 December 2026.

The objectives are now set out in four parts in paragraph 17: to identify and assess the risks of material misstatement due to fraud; to obtain sufficient appropriate evidence about them through appropriate responses; to respond appropriately to fraud or suspected fraud identified during the audit; and to report in accordance with the standard. That fourth objective, reporting, is new.

Both editions are on the FRC's ISA (UK) 240 page, with the reasons for the final text in the FRC's feedback statement and impact assessment. The consultation ran from 1 October 2025 to 16 January 2026 and drew 19 responses. For the rest of the standards set, see the guide to UK auditing standards.

ISA 240 revised effective date: which year ends it applies to

Paragraph 16 says the standard "is effective for audits of financial statements for periods beginning on or after December 15, 2026" (the FRC's standard page says "commencing", which means the same). What decides it is the date the period starts, not the year end, so a long or short period after a change of accounting reference date is tested the same way.

The dates are computed from paragraph 16. The earliest period caught is one that begins on 15 December 2026 itself: for a company with a 14 December year end, the year ending 14 December 2027.

The revised going concern standard takes effect from the same date; it has its own guide, ISA 570 revised.

Can ISA 240 revised be applied early?

No FRC source we found permits it, so the careful reading is that the May 2021 edition governs every period beginning before 15 December 2026. The March 2026 text says nothing about early application, and the FRC's standard page lists the new edition's effective date without the "early application permitted" note that its entry for the May 2021 edition (Updated May 2022) carried. The IAASB "encourages jurisdictions to consider early adoption" of its revised standard; that is addressed to standard setters, and no FRC source says the FRC has taken it up for ISA (UK) 240. For the companion going concern standard the FRC is explicit: its October 2026 staff guidance says that for ISA (UK) 570 (Revised March 2026) "early adoption is not permitted". The revised reporting standards are different. ISA (UK) 700 and 701 (Revised May 2026) each say "Early adoption is permitted", as does ISA (UK) 720, but that permission covers those standards only and does not extend to ISA (UK) 240.

Summary of changes from the 2021 UK edition

The structure is the biggest visible change. The May 2021 edition listed its risk assessment procedures by who the auditor asks (management, internal audit, those charged with governance). The March 2026 edition walks through the components of ISA (UK) 315 (Revised July 2020) one by one, asking the fraud question at each.

The table compares requirements, not application material. "Already UK" means the May 2021 edition already required it.

Management override of controls keeps its unconditional status: paragraph 40 treats it as a risk at the financial statement level, and paragraphs 47 to 49 set the journal work. Inquiries of people in the reporting process and the selection of period-end and post-closing entries carry over from the May 2021 edition. What is new is evidence that the journal population is complete (49(b)), and a firmer verb on testing through the period: the auditor must now determine the need, where the 2021 text said consider it (49(d)). Choosing and testing entries is for a separate guide on management override of controls and on journal entry testing.

The fraud lens on ISA (UK) 315

Each ISA (UK) 315 component now carries its own fraud requirement (31 to 37, shown in the diagram above), and the auditor then evaluates whether fraud risk factors are present (38). The definition of fraud risk factors now includes "an attitude or rationalization that justifies the fraudulent action" (18(b)).

Responding, and the stand-back

The requirement to design responses that are not biased towards corroborating evidence (42) was already UK in 2021 (13-1, which also covered risk assessment procedures). Unpredictability, accounting policies, estimates bias, unusual transactions and the final analytics (43 to 53) carry over in substance.

When fraud or suspected fraud is found

Paragraphs 55 to 58 replace a short sequence with a process. The auditor understands the matter, makes inquiries at the right level, and evaluates any investigation and remediation by the entity. Unless the matter is clearly inconsequential, the engagement partner then decides whether more risk assessment or further procedures are needed and whether ISA (UK) 250 duties arise, and considers the effect on prior periods (56).

What the UK kept, dropped and put back

The FRC aligned the UK text with the international standard, "augmented with a limited number of UK pluses" (feedback para 5). From the feedback statement and the final text:

• Kept: the governance discussion (32-1). The auditor discusses the risks of fraud with those charged with governance, including those specific to the entity's sector. One respondent asked for its removal; the FRC kept it to "maintain the enhanced risk assessment procedures" (para 21).
• Put back: post-closing entries (49(c)). The exposure draft dropped the explicit reference. After feedback the FRC reinstated it, saying this "does not increase the expected work effort of the auditor" (para 23).
• Kept: public interest entities (56-1, 67-1). Inform the entity and invite it to investigate suspected irregularities; inform the authorities responsible for investigating them if it does not.
• Added: the tipping-off reminder (25). A footnote now says UK law may restrict communications, "e.g. for compliance with legislation relating to 'tipping off'" (footnote 13a; feedback para 27).
• Dropped: "may accept records as genuine" (extant 14). The FRC says the position is unchanged because ISA (UK) 200 still states it, and the auditor is "not required to design procedures" to look for altered documents (para 13).
• Not added: other UK laws. Respondents asked for material on the failure to prevent fraud offence and the Companies Act duty to keep adequate records. The FRC declined, pointing to ISA (UK) 250 (para 26).

Applying it on a smaller audit

The FRC's impact assessment says the revised standards "are designed to be scalable". The scalability guidance is in the application material, and five points matter most on an owner-managed audit.

When the directors are the owners

This is the change that needs a decision. In the May 2021 edition, understanding governance oversight (21) and inquiries of those charged with governance (22) applied "unless all of those charged with governance are involved in managing the entity", and the UK discussion in 22-1 hung on those two paragraphs. In the March 2026 edition the requirements in 32(a)(iii) and 32(c) carry no such words. For these two requirements, the carve-out survives only in application material, and only for the oversight understanding in 32(a)(iii): where all of those charged with governance are involved in managing the entity (A79's example is a smaller or less complex entity where "a single owner manages the entity and no one else has a governance role"), there is "ordinarily no action on the part of the auditor because there is no oversight separate from management" (A79).

Two consequences follow from the text. The inquiries in 32(c) have no scalability note, so they are made of the director-owners: what fraud they know of, where they think the accounts could be misstated, and what control weaknesses they know about. And 32-1 is tied to work done under 32(a)(iii), which A79 says ordinarily needs no action. The text does not settle whether the 32-1 sector discussion is still expected in that case. The cautious approach is to hold it inside the 32(c) conversation and record it. It costs one agenda item. The carve-out does stay in one requirement: fraud found is communicated to those charged with governance "unless all of those charged with governance are involved in managing the entity" (65).

Domination of management by a single individual "does not generally, in and of itself" indicate a failure by management to display an appropriate attitude to internal control, but it "creates a conducive environment for management override of controls" (A112).

No whistleblowing line, no risk assessment process on paper

Paragraph 32(a)(ii) applies "if the entity has such a program". The application material accepts informal arrangements, such as a programme communicated by word of mouth (A74), and it names the lack of a programme as a possible sign of control deficiencies "in a larger or more complex entity" (A75). Where there is no formal risk assessment process, the auditor "is still required to obtain an understanding" of how management identifies, assesses and addresses fraud risks (A91). In practice that is a recorded conversation.

Who needs forensic skills

Paragraph 23 asks the engagement partner to determine that the team collectively has the competence and capabilities, including sufficient time and any specialised skills, for the fraud work. The forensic references are included "as application material, and not as a requirement" (FRC feedback para 16). The partner decides on the facts; the examples that point to forensic or other specialist help (A39) are investigations by the entity or an authority, and complex structures, industries or financial instruments.

Journals in a cloud ledger

Paragraph 35 requires understanding how entries are "initiated, processed, recorded, and corrected", and 49(b) requires evidence that the population is complete. The population may include manual and "top-side" adjustments made directly to the reported amounts (A140), so the understanding should cover how year-end adjustments reach the accounts. Where the team uses automated tools on the journal file, A41 says the engagement partner may consider the team's expertise in them; the FRC AI audit guidance covers documenting such tools.

"Clearly inconsequential" fraud

The new process in 55 and 56 lets the auditor stop short where a matter is clearly inconsequential. The FRC declined to add UK examples, calling it a matter of professional judgement, and set a tight test: "where there is uncertainty about if an instance of fraud, or suspected fraud, is clearly inconsequential, the fraud is not clearly inconsequential" (feedback para 29).

The auditor's report and what you tell the directors

The report changes come from ISA (UK) 240 and from the revised reporting standards, ISA (UK) 700 and 701 (Revised May 2026), which take effect from the same date.

Key audit matters. Where key audit matters are reported, the auditor determines those related to fraud and gives them a subheading that says so (60–62). For a listed entity it "may be rare" not to have one (A180). ISA (UK) 701 (Revised May 2026) applies to publicly traded entities, public interest entities, entities that report (by requirement or by choice) on how they have applied the UK Corporate Governance Code, audits where law or regulation requires key audit matters, and audits where the auditor decides to report them. Most owner-managed audits are outside it.

Every report. ISA (UK) 700 (Revised May 2026) para 40(a) now has the auditor's responsibilities section state that the auditor communicates with those charged with governance about identified fraud or suspected fraud, and other matters related to fraud relevant to their responsibilities. The description can sit in the report, in an appendix or, in the UK, in a cross-reference to the applicable version maintained on an appropriate authority's website (para 41). On 24 June 2026 the FRC published, as a PDF, what it calls a draft of the description for periods commencing on or after 15 December 2026, which includes these points. It says that statement becomes the description on its website from 15 December 2026 (FRC Staff Guidance Note, October 2026, para 10). Until then the FRC web page carries the version for periods commencing on or after 15 December 2023, without the fraud points (as read 22 October 2026). For auditors who adopt ISA (UK) 700 (Revised May 2026) early, the FRC provides an interim statement, which it says is "only suitable for audits where ISA (UK) 700 (Revised May 2026) alone has been early adopted" (Staff Guidance Note para 12).

The irregularities paragraph. The May 2021 edition required the report to explain "to what extent the audit was considered capable of detecting irregularities, including fraud" (40-1). That requirement now sits in ISA (UK) 701 para 16-1, so it applies only where ISA (UK) 701 does. The FRC calls this "the removal of the requirement from most auditor's reports". For a typical private company audit, the irregularities paragraph goes for periods commencing on or after 15 December 2026, or earlier where the auditor chooses to adopt ISA (UK) 700 (Revised May 2026) early. The FRC's October 2026 staff guidance covers that case, and says the explanation stays in reports on public interest entities and publicly traded entities, because law and regulation require it there. Early adoption of the reporting standard does not bring forward ISA (UK) 240 (Revised March 2026). Illustrative wording belongs in a guide to the UK auditor's report.

Talking to the directors. Communication on fraud runs through the audit (25), not only when fraud is identified or suspected, which 64 and 65 require to be communicated on a timely basis (66 adds other fraud matters relevant to those charged with governance). The written representations widen (63): the disclosures in 63(c) now include allegations of fraud, and the third category reaches fraud that "could have an effect" on the financial statements.

What the audit file must now show

Paragraph 68 lists the documentation. Against the May 2021 list it adds:

• the matters discussed by the team (68(a)), not only the significant decisions;
• key elements of the understanding under 31 to 36, the sources of information and the procedures performed (68(b));
• the rationale for significant judgements in assessing fraud risks (68(c));
• the significant judgements and conclusions on management override, alongside the results (68(e));
• any fraud or suspected fraud, the work done and the conclusions (68(f));
• communications, including how management and those charged with governance responded (68(g)).

The reasons for rebutting the revenue presumption are still required (68(d)). A cold file review of a period beginning on or after 15 December 2026 will be read against these paragraphs.

Updating your methodology before the first affected year end

For a calendar-year client, the first affected period starts on 1 January 2027, so the update needs to be in place before planning for that audit begins. A short list for the update:

1. Planning templates: re-map the fraud risk assessment to 31 to 38; add journals understanding (35) and population completeness (49(b)).
2. Team discussion agenda: culture, revenue types, override, prior fraud (29).
3. Governance conversation: the 32(c) inquiries and the 32-1 discussion, with the owner-managed reasoning recorded.
4. Engagement partner sign-offs: resources and time (23), supervision (24), decisions after fraud is found (56).
5. Fraud-found procedure: 55 to 58, including the clearly inconsequential test.
6. Representation letter: redraft to 63.
7. Report templates: ISA (UK) 700 (Revised May 2026) wording; the irregularities paragraph only where ISA (UK) 701 applies.
8. Quality management: record the update as a response under ISQM (UK) 1 and revisit it in the firm's ISQM 1 annual evaluation.
9. Training before the first planning meetings.

If the latest changes to the ISAs (UK) are stretching your team, partner with us: our platform reads documents and reconciles figures for your review, saving your team hours, and you remain the auditor and sign.

What we don't know yet

As at 22 October 2026:

• SME guidance for the new edition. The FRC published Practice Note 28, Guidance for audits of small and medium-sized entities, on 24 March 2026. It cites the May 2021 edition of ISA (UK) 240. The April 2026 feedback statement says the FRC "is currently working with stakeholders on a Practice Note" for smaller and medium-sized entities. No source read says whether PN 28 will be updated for the March 2026 edition.
• Post-implementation review. The FRC says one "will be considered in the future when sufficient evidence is available" (feedback para 58).
• The owner-managed governance point. No FRC material read addresses how 32-1 applies where A79 says no action is ordinarily needed. Until it does, firms are making their own call.