Document ID: chunk:federal_register_of_legislation:F2023C01125:body:0:p18
Version: federal_register_of_legislation:F2023C01125
Segment Type: other
Provision Reference: 
Character Range: 50475–53629

required to report misstatements to an appropriate authority in cases where management or those charged with governance fail to take corrective action.

Aus A29.1 In certain circumstances, the auditor has a statutory responsibility to report instances of non‑compliance with laws and regulations.  For example, in certain circumstances, the auditor is required under the Corporations Act 2001, to report to the Australian Securities and Investments Commission (ASIC).  Establishing the appropriate authority to which such a report would be made in a particular instance will depend on the nature and circumstances of the non‑compliance.  When in doubt, the auditor would ordinarily seek legal advice.

A30.         In other cases, the relevant ethical requirements may require the auditor to determine whether reporting identified or suspected non‑compliance with laws and regulations to an appropriate authority outside the entity is an appropriate action in the circumstances.  For example, the Code requires the auditor to take steps to respond to identified or suspected non‑compliance with laws and regulations and determine whether further action is needed, which may include reporting to an appropriate authority outside the entity.[17] The Code explains that such reporting would not be considered a breach of the duty of confidentiality under the Code.[18]

A31.         Even if law, regulation or relevant ethical requirements do not include requirements that address reporting identified or suspected non‑compliance, they may provide the auditor with the right to report identified or suspected non‑compliance to an appropriate authority outside the entity.  For example, when auditing the financial report of financial institutions, the auditor may have the right under law or regulation to discuss matters such as identified or suspected non‑compliance with laws and regulations with a supervisory authority.

A32.         In other circumstances, the reporting of identified or suspected non‑compliance with laws and regulations to an appropriate authority outside the entity may be precluded by the auditor's duty of confidentiality under law, regulation or relevant ethical requirements.

A33.         The determination required by paragraph 29 may involve complex considerations and professional judgements.  Accordingly, the auditor may consider consulting internally (e.g., within the firm or a network firm) or on a confidential basis with a regulator or professional body (unless doing so is prohibited by law or regulation or would breach the duty of confidentiality).  The auditor may also consider obtaining legal advice to understand the auditor's options and the professional or legal implications of taking any particular course of action.

Considerations Specific to Public Sector Entities

A34.         A public sector auditor may be obliged to report on identified or suspected non‑compliance to the legislature or other governing body or to report them in the auditor's report.

Documentation (Ref: Para. 30)

A35.         The auditor's documentation of findings regarding identified or suspected non‑compliance with laws