An auditor finds an EPA consent decree showing the client agreed to pay $8 million in environmental fines next quarter. Nothing is accrued, nothing is disclosed. AU-C 250 draws the line between what the auditor "missed" and what was never inside the audit's scope, and that line moves depending on whether the law has a direct effect on the financial statements.
An auditor of a chemical plant cannot also be the EPA. If the standard required testing compliance with every law touching the entity, the engagement becomes infeasible and the opinion misleads users. AU-C 250 draws a bright line: laws that produce numbers in the financial statements are inside the audit's scope; laws that do not are outside it, except the auditor cannot ignore evidence of noncompliance even when it surfaces from outside that scope.
HIGH-FREQUENCY: Direct-effect noncompliance is a misstatement risk. Indirect-effect noncompliance is a disclosure-and-going-concern risk. The exam tests whether you can classify a law into the right tier and apply the right level of work.
Common mistakes
- Treating environmental or OSHA fines as "auditor must test for compliance." These are indirect-effect. The auditor inquires, inspects regulator correspondence, and obtains representations, but does not design procedures to detect noncompliance. Trap: "expand procedures to test environmental compliance." Wrong: infeasible and misleads users.
- Confusing issuer and nonissuer reporting paths. For a private company, noncompliance escalates within the entity (management → TCWG → board); confidentiality bars direct disclosure to outside regulators. For an SEC issuer, Section 10A requires audit-committee escalation and, if unresolved, a one-business-day SEC report.
- Skipping the counsel inquiry because management says nothing is pending. The lawyer's letter is required regardless. Counsel often knows of matters management has not surfaced. Skipping on management's say-so reverses the burden of proof.
Bottom line
- AU-C 250 splits laws into direct-effect (auditor tests compliance) and indirect-effect (auditor responds if noncompliance surfaces)
- Direct-effect laws determine reported amounts or required disclosures (tax, pension funding, regulated revenue). Design specific procedures.
- Indirect-effect laws are fundamental to the business but do not drive FS amounts (environmental, OSHA, the Foreign Corrupt Practices Act, the Bank Secrecy Act and anti-money laundering rules, licensing). Inquire and stay alert; do not design tests to detect noncompliance.
- Five required procedures regardless of category: understand the legal framework, inquire of management and TCWG, inspect regulator correspondence, inquire of legal counsel, obtain written representations
Exam shortcut
When a question describes a law and asks about audit responsibility, ask: does compliance produce numbers in the financial statements? Yes → direct-effect, design procedures. No → indirect-effect, inquire and stay alert. This single question eliminates most trap answers.
The full lesson (about 3,261 words, 22 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- II.G1
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.