Think of SA 250 as the standard that answers one uncomfortable question every auditor faces: What happens when I discover my client is breaking the law? That's exactly what SA 250 — Consideration of Laws and Regulations — is designed to handle.
First, understand the two-bucket framework for laws. Bucket 1: Direct laws — these directly shape what goes into the financial statements. Think the Companies Act 2013, Income Tax Act, GST Act. These have a pervasive effect, so the auditor has a direct responsibility to check compliance. Bucket 2: Indirect laws — these don't directly affect financial statements but non-compliance could still hurt the company financially through fines, penalties, or loss of licence. Think labour laws, environmental regulations, SEBI norms for listed companies. Here, the auditor's responsibility is limited — they only need to stay alert and investigate if something looks suspicious.
Now, what does the auditor actually do? The standard sets out three layers. Layer 1 — Obtain a general understanding of the legal and regulatory framework applicable to the entity and industry. Layer 2 — Perform specific procedures for direct laws (e.g., verify PF/ESI compliance, check dividend declaration as per Companies Act). Layer 3 — Remain alert throughout the audit for any indication of non-compliance (unusual transactions, unexplained payments, legal notices hidden in board minutes). Importantly, SA 250 clarifies that the auditor is not responsible for preventing non-compliance — that duty belongs to management and Those Charged with Governance (TCWG).
When the auditor does spot non-compliance (or suspects it), here's the drill: First, discuss with management and obtain explanations. Second, evaluate the effect on the financial statements — do penalties need to be provided for? Is going concern affected? Third, if management is involved in the non-compliance, escalate to TCWG. Fourth, consider whether to modify the audit report (qualified or adverse opinion if material and not disclosed). Finally — and this is the exam favourite — consider whether there is a duty to report to regulatory authorities. In India, this could mean reporting to the NCLT, SEBI, or RBI depending on the entity type. Note: SA 250 recognises that professional duty of confidentiality may conflict here, and the auditor may need legal advice. This is asked frequently as a 4-mark or 8-mark question in the form of scenario-based problems.