Rule Atlas
AU-C § 240: Management's & Auditors' Fraud Responsibilities
Under AU-C § 240 (ACFE / DOJ / PCAOB), management's & Auditors' Fraud Responsibilities establishes the authoritative rules tested on the ACFE CFE. Understanding the distinct roles of management, external auditors, and internal auditors in preventing, detecting, and reporting fraud per professional standards and statutes. VoraPrep verifies every threshold, worked table, and practice question below against the current ACFE CFE blueprint.
Core Statutory Concepts
| Responsibility Area | Management (CEO/CFO) | External Auditor (PCAOB AS 2401 / AU-C 240) | Internal Auditor (IIA GIAS Standards) |
|---|---|---|---|
| Primary Goal | Prevent, deter, and detect fraud; maintain effective controls. | Provide reasonable assurance on financial statements (material misstatements due to fraud/error). | Evaluate and improve risk management, control, and governance processes. |
| Legal Mandate/Std | SOX 302, SOX 404, COSO Guide | PCAOB AS 2401 (issuers), AU-C 240 (non-issuers) | IIA GIAS Standards |
| Focus | Design, implement, monitor internal controls; 'tone at the top'. | Fraud risk assessment, audit procedures, professional skepticism. | Assess control effectiveness, fraud risk, recommend improvements. |
| Guilt/Innocence | No opinion | No opinion | No opinion (ACFE Article IV applies to all CFEs) |
The CEO and CFO of a publicly traded company are preparing to file their company's quarterly financial statements with the Securities and Exchange Commission (SEC). Which of the following statements most accurately analyzes this situation?
Practitioner Application: Management's & Auditors' Fraud Responsibilities
As a CFE, you're reviewing an external audit report for a public company. The report states that while no material misstatements were found, the auditors identified several control weaknesses that could enable fraud, but explicitly disclaim responsibility for fraud prevention. Meanwhile, the company's CEO and CFO have certified the financial statements. Your internal audit department has also flagged a lack of a formal fraud risk assessment. On exam day, you must precisely delineate the responsibilities of each party.
- Effective fraud prevention and detection require a clear understanding of the roles and responsibilities of various stakeholders within an organization and its oversight bodies. The CFE exam frequently tests the distinctions between management's, external auditors', and internal auditors' duties.
- Management's Primary Responsibility Management bears the primary responsibility for establishing and maintaining a system of internal controls to prevent, detect, and deter fraud. This includes fostering an ethical 'tone at the top' and implementing robust anti-fraud programs.
Common ACFE CFE Distractors on AU-C § 240
- 1Management's Role: Primary responsibility for fraud prevention, detection, and internal controls ('tone at the top'). Reinforced by SOX Sections 302 and 404.
- 2External Auditor's Role: Provide 'reasonable assurance' that financial statements are free of material misstatement due to error or fraud. Guided by AU-C 240 (non-issuers) and PCAOB AS 2401 (issuers). They are not responsible for preventing fraud.
- 3Internal Auditor's Role: Evaluate and improve risk management, control, and governance processes, including assessing fraud risks and controls, as per IIA GIAS Standards.
- 4'Reasonable Assurance': A high, but not absolute, level of assurance. Auditors do not guarantee fraud detection.
- 5ACFE Ethics: No CFE, regardless of their role, should ever express an opinion on the guilt or innocence of any person (ACFE Article IV).
Frequently Asked Questions: AU-C § 240
What is the core rule under AU-C § 240 (Management's & Auditors' Fraud Responsibilities)?
Under AU-C § 240 (ACFE / DOJ / PCAOB), management's & Auditors' Fraud Responsibilities establishes the authoritative rules tested on the ACFE CFE. Understanding the distinct roles of management, external auditors, and internal auditors in preventing, detecting, and reporting fraud per professional standards and statutes. VoraPrep verifies every threshold, worked table, and practice question below against the current ACFE CFE blueprint.
How is AU-C § 240 tested on the ACFE CFE?
Management's Role: Primary responsibility for fraud prevention, detection, and internal controls ('tone at the top'). Reinforced by SOX Sections 302 and 404. External Auditor's Role: Provide 'reasonable assurance' that financial statements are free of material misstatement due to error or fraud. Guided by AU-C 240 (non-issuers) and PCAOB AS 2401 (issuers). They are not responsible for preventing fraud.
Where can I practice ACFE CFE questions on Management's & Auditors' Fraud Responsibilities?
Test yourself instantly with the free playable ACFE CFE question on this page, or launch VoraPrep's full ACFE CFE adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cfe.