Noncompliance includes intentional or accidental actions or omissions that violate applicable laws or regulations while conducting the entity's business. Personal misconduct unrelated to the entity's business falls outside this engagement-specific definition.
- Management maintains compliance, establishes preventive and detective controls, and records or discloses relevant financial consequences.
- Those charged with governance oversee management's conduct and the entity's financial reporting.
- The accountant's responsibility depends on the engagement objective, applicable professional standards, and any additional legal duties.
A financial statement audit provides reasonable assurance, high but not absolute assurance that the statements contain no material misstatement. Concealment, collusion, and violations occurring outside accounting records limit detection; management's compliance responsibility remains in place throughout the engagement.
The auditor applies accounting and auditing expertise to evaluate evidence and financial reporting consequences, obtaining legal advice when interpretation requires specialized competence. A financial statement opinion does not establish that every business activity complies with every applicable law.
The engagement determines what “tests of compliance” accomplish:
In a nonissuer review, relevant suspected noncompliance requires communication with management, a request for management's assessment, and consideration of financial reporting effects.
Common mistakes
- Law named, procedure missing. “Review payroll law” omits verification of the $800,000 wage base and comparison of the computed $32,000 obligation with recorded amounts.
- Payment treated as completeness. A subsequent $32,000 payment supports settlement but cannot independently establish that every taxable wage entered the calculation.
- One unanswered allegation. Marlon's disputed regulator notice remains unresolved when the workpaper records only management's denial.
Bottom line
- Management maintains legal compliance; the accountant's responsibilities depend on the engagement and applicable requirements.
- Direct-effect requirements demand evidence supporting their effects on material financial statement amounts or disclosures without a suspicion prerequisite.
- Fundamental operating requirements can have material indirect consequences without prescribing financial statement calculations.
- Ordinary audit procedures concerning indirect-effect laws do not provide assurance that every operational violation will be detected.
Exam shortcut
Identify the engagement first, then classify the legal requirement, locate any new information, and select the next required procedure. For a direct-effect calculation, trace the rule, input population, recomputation, recorded amount, and disclosure. A payment receipt answers only part of that sequence. In paired cases, isolate the changed fact. A regulator's allegation expands the response even when the law's category and tax calculations stay unchanged.
The full lesson (about 4,246 words, 28 min read) adds 2 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- II.G1
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.