ISA 240 and Failure To Prevent Fraud: What organisations need to do now

Together, the new Failure to Prevent Fraud offence and ISA 240 are changing expectations of boards and senior management, as well as their relationship with auditors. Arguably, fraud risk is no longer a theoretical compliance issue – it is a core governance priority that needs to be factored into all senior management and board agendas.

The Failure to Prevent Fraud offence, introduced under the Economic Crime and Corporate Transparency Act 2023, creates corporate criminal liability where a large organisation fails to prevent fraud committed by an associated person for its benefit.

This represents a fundamental shift. Enforcement does not depend on proving that the organisation intended wrongdoing. Instead, the focus is on whether it had reasonable procedures in place to prevent it.

In parallel, ISA 240 requires auditors to obtain reasonable assurance that financial statements are free from material misstatement due to fraud, including identifying and assessing fraud risks and responding appropriately.

For organisations, this creates a convergence: Regulators are asking, did you prevent fraud? Auditors are asking, did you understand and respond to fraud risk properly?

The direction of travel is towards greater transparency, stronger evidence and more robust challenges.

Fraud is not a narrow financial reporting issue. It is any intentional act involving deception for gain and can be committed by employees, management or third parties across the organisation.

The consequences can be significant:

• Criminal liability for the organisation

• Financial penalties, potentially linked to the harm caused

• Reputational damage and loss of stakeholder confidence

• Increased regulatory scrutiny and audit pressure

• Exposure to civil litigation and shareholder claims

Crucially, regulators and auditors increasingly view weak fraud controls as evidence of poor governance and culture, not simply an operational gap.

Auditors are now expected to take a more probing and evidence‑led approach to fraud risk. In practice, this means organisations should expect greater scrutiny of:

• Fraud risk assessments

• The design and effectiveness of controls

• Incident response processes and records

• Whistleblowing arrangements

• Training and communication across the business

Auditors will not simply accept documented policies at face value; they will expect to see evidence that risk assessments are tailored, current and embedded in decision‑making.

Where this evidence is lacking, audit procedures may be extended and, in more serious cases, opinions may be modified.

These principles align closely with UK government guidance across all failure‑to‑prevent offences, reinforcing the need for consistency rather than siloed compliance approaches.

The most important step organisations can take is to develop and maintain a genuinely organisation‑specific fraud risk assessment that is actively owned by the board.

This matters because it underpins everything else:

• It determines where controls are needed

• It shapes the auditor’s assessment

• It provides the foundation for a legal defence

Without it, policies and procedures risk becoming generic, ineffective and difficult to defend under scrutiny.

The combined effect of ISA 240 and the Failure to Prevent Fraud offence is an increasingly demanding environment for organisations. Expectations are higher, and the margin for error is smaller.

For boards and senior management, the priority is clear and simple: to move beyond compliance and ensure fraud risk management is embedded, evidence‑based and aligned to how the business actually operates.