ISA (UK) 240 Revised 2026: What Changes for Fraud Auditing?

The revised standard is effective for audits of financial statements for periods beginning on or after 15 December 2026. As at August 2026, therefore, it has been issued but is not yet mandatory for earlier financial periods.

That distinction is important for firms communicating the change to teams and clients. This is an implementation period, not a reason to describe every new paragraph as already effective.

The FRC also makes an important wider point: UK requirements had previously been strengthened, so many of the international revisions were already reflected in UK practice. The FRC consequently expects relatively limited incremental work compared with jurisdictions starting from the unmodified international standard.

The real implementation challenge is therefore likely to be quality and linkage, not simply adding more fraud forms to an audit file.

What is changing in ISA (UK) 240?

The revised international model places greater emphasis on:

• clarity over the auditor's responsibilities for fraud
• stronger and more connected fraud risk assessment
• professional scepticism
• broader and continuing enquiries
• management override
• an overall stand-back evaluation
• technology in fraud-related audit procedures; and
• greater transparency in the auditor's report for relevant entities.

The FRC's consultation summary identifies several of these enhancements and notes that most were already embedded in the existing UK version, while the strengthened stand-back and reporting requirements include areas of more substantive change.

That means firms should compare the revised standard with their current methodology rather than assuming every headline represents a completely new UK requirement.

Fraud risk assessment should tell a coherent story

A strong fraud section of an audit file should connect:

fraud risk factors → identified fraud risks → audit responses → evidence obtained → completion conclusion.

That sounds obvious, but it is where generic fraud documentation frequently loses value.

The August 2026 course makes the same point through examples of entity-specific fraud assessments and completion evaluations: the documentation should show why particular incentives, opportunities or pressures lead to particular risk pathways and how those pathways affected the audit response.

For example, a company may have:

• aggressive earnings targets
• financing covenants
• management bonuses
• unusually complex revenue arrangements; and
• extensive ability to post manual journals.

Simply listing these five facts is not yet a fraud risk assessment.

The audit team should consider what they mean for the financial statements. Could pressure produce premature revenue recognition? Could management override provisions? Could results be manipulated through late consolidation journals?

That entity-specific connection is far more valuable than attaching a generic fraud-triangle checklist.

Professional scepticism needs to influence how evidence is sought

One of the themes reinforced in the revised framework is that audit procedures should not be designed or performed in a way that is biased towards evidence supporting management's position while overlooking contradictory evidence. The FRC identified that enhancement when consulting on the revised standard.

This is more than wording.

Imagine management explains a significant year-end adjustment with a spreadsheet and an internally prepared memo. Both documents agree with one another because they originate from the same source.

The professional-scepticism question is not merely whether those documents exist. It is whether the evidence is sufficiently reliable and whether other information challenges the explanation.

Depending on the risk, corroboration might come from:

• underlying contracts
• subsequent cash flows
• external correspondence
• operational data
• independent system records
• customer evidence; or
• retrospective outcomes.

Scepticism does not mean assuming management is dishonest. It means not allowing a plausible explanation to substitute automatically for persuasive evidence.

Enquiries should reach beyond the finance director

Fraud information does not necessarily sit with the person responsible for preparing the accounts.

Depending on the entity, useful enquiries can involve:

• those charged with governance
• internal audit
• compliance
• HR
• legal
• operational management
• staff involved in processing transactions; and
• personnel responsible for whistleblowing arrangements.

The purpose is not to generate a longer list of interview notes.

Different functions see different warning signals. HR may know about incentive pressures or allegations. Compliance may know about regulatory matters. Operational staff may understand unusual contract practices that finance does not.

The audit team should use those enquiries to refine its understanding of where fraud could actually arise.

Revenue remains important, but the analysis must be specific

The revenue fraud presumption remains a central part of ISA (UK) 240.

A weak audit response is to label “revenue recognition” a fraud risk and then perform an unchanged standard sales test.

The useful questions are more specific:

• Which revenue streams are susceptible to manipulation?
• What form would intentional misstatement take?
• Is the risk occurrence, cut-off, measurement, completeness or a combination?
• Could side agreements change the accounting?
• Is there significant variable consideration?
• Can management influence progress estimates?
• Are credit notes or returns processed after year-end?
• Can senior finance users bypass normal controls?

The answer should influence the procedure.

A cut-off fraud risk might lead to a different audit response from an overstatement-of-progress risk on a long-term service contract, even though both are called “revenue”.

Management override still requires a direct response

Management override remains pervasive because people with sufficient authority may be able to circumvent otherwise effective controls.

Journal entry testing therefore remains a particularly important audit response.

The course's journal section correctly highlights that journal testing is not made optional simply because the control environment appears strong; it also emphasises enquiries, period-end adjustments and consideration of journals throughout the reporting period.

The practical risk is turning journal testing into a standard data filter used unchanged on every audit.

Selection criteria should respond to how override could occur in the particular entity.

Potential characteristics might include:

• unusual users
• unusual posting times
• sensitive accounts
• combinations of accounts inconsistent with normal processing
• large late adjustments
• unusual descriptions
• repeated reversals; or
• journals bypassing normal workflows.

Data analytics can improve the ability to interrogate a population, but an anomaly score is not itself sufficient audit evidence. The identified item still needs to be understood and evaluated.

The training update similarly warns against treating analytics output as the conclusion.

The stand-back evaluation matters at completion

One of the most useful features of the revised approach is the emphasis on standing back at the end of the audit.

At that stage, the team should not ask only:

“Did our planned fraud procedures clear?”

It should reconsider the audit as a whole.

For example:

• Were there unexpected late journals?
• Did management explanations become inconsistent?
• Were several individually small misstatements biased in the same direction?
• Did corrected errors reveal pressure around a particular KPI?
• Did information obtained during fieldwork alter the original fraud-risk assessment?
• Is the evidence obtained still sufficient and appropriate in light of everything now known?

The August update describes this as a completion exercise that revisits the initial assessment rather than concluding simply that no fraud was found.

That is a meaningful distinction.

An audit does not prove that fraud does not exist. The completion documentation needs to explain why the work performed provides a sufficient basis for the audit conclusion in light of the assessed fraud risks.

What changes in the auditor's report?

The FRC states that the revised ISA 240 enhances transparency in fraud reporting, particularly for audits of publicly traded entities.

The interaction with key audit matters is intended to make reporting about significant fraud-related audit attention more meaningful rather than generic.

For firms, this creates a linkage challenge.

External reporting should be consistent with:

• the risk assessment
• matters requiring significant auditor attention
• the actual audit response; and
• the conclusions evidenced on file.

A polished fraud-related KAM cannot compensate for weak underlying risk assessment.

What this means for audit firms in practice

Implementation should start with methodology design but should not end there.

A technically compliant new template can still produce weak audits if teams populate it generically.

Firms may need to focus on:

Training. Teams need examples showing the difference between a generic fraud risk and an entity-specific one.

Planning discussions. Engagement-team discussions should encourage genuine challenge rather than reading prescribed prompts.

Enquiry protocols. Teams should know which additional functions may hold relevant fraud information.

Journal analytics. Standard filters should be capable of tailoring to entity-specific risks.

Completion. The stand-back should bring together misstatements, behaviour, journal results, estimates and other fraud indicators.

Review. Managers and RIs should challenge the logical connection from risk to response rather than merely confirming that required forms are signed.

Finance teams should also expect sharper questions

Although ISA (UK) 240 is an auditing standard, its implementation affects audited companies.

Management may increasingly need to articulate:

• its own fraud risk assessment
• how whistleblowing allegations are evaluated
• governance over fraud
• controls addressing management override
• unusual journal processes
• significant incentive arrangements; and
• how identified allegations or suspected fraud affect financial reporting.

This is particularly relevant when the organisation is also implementing the ECCTA failure-to-prevent-fraud framework. The two regimes have different purposes, but information produced for one may be relevant to understanding the other.

What should audit firms do now?

1. Perform a gap analysis between current methodology and ISA (UK) 240 Revised March 2026.
2. Train teams on entity-specific fraud pathways, not merely new wording in the standard.
3. Review enquiry templates to ensure relevant non-finance information sources are considered.
4. Challenge standard journal-testing criteria and require linkage to actual fraud risks.
5. Strengthen completion stand-back documentation so it genuinely revisits the risk assessment.
6. Review reporting templates and ISA 701 interaction for affected entities.
7. Use 2026 audits to improve behaviours now, while being clear about which version of the standard is formally applicable.

Conclusion

The most important effect of ISA 240 fraud changes in the UK is not likely to be a dramatic increase in the number of mandatory procedures.

The direction is towards a clearer line of sight through the audit: understand how fraud could occur, tailor the response, remain alert to contradictory evidence and reassess the conclusion when the audit is substantially complete.

For firms that already have sophisticated fraud methodology, the challenge will be making sure that this thinking is visible in actual engagement files rather than only in the firm's manuals.

Primary sources

• FRC: ISA (UK) 240 current and revised editions
• FRC: final 2026 revisions to the UK fraud and going-concern standards