Auditing Standard No. 240 on the responsibilities of auditors related to fraud in the audit of financial statements, issued together with Circular 214/2012/TT-BTC.

 

VIETNAMESE AUDITING STANDARDS SYSTEM

Auditing Standard 240: Auditor's Responsibility Regarding Fraud in the Auditing of Financial Statements

(Issued together with Circular No. 214/2012/TT-BTC) (December 6, 2012, Ministry of Finance)

 

I/ General Regulations

Scope of application

1. This auditing standard specifies and guides the responsibilities of auditors. and auditing firms (hereinafter referred to as "auditor") Regarding fraud during the audit of financial statements, this Standard also provides additional guidance on how to apply Vietnamese Auditing Standards No. 315 and No. 330 to risks of material misstatement due to fraud.

Characteristics of fraud

2. Errors in financial reporting can arise from fraud or mistake. To distinguish between fraud and mistake, it is necessary to consider whether the conduct leading to the error in the financial reporting was intentional or unintentional.

3. Although fraud is a very broad legal concept, for the purposes of auditing standards, auditors should only be concerned with frauds that result in material misstatements in the financial statements. There are two types of intentional misstatements that auditors should be concerned with: misstatements arising from fraudulent financial reporting and misstatements resulting from misappropriation of assets. While auditors may suspect or, in a few cases, determine that fraud has occurred, they should not make a legal decision on whether fraud actually occurred (see guidance in paragraphs A1–A6 of this Standard).

Responsibility for preventing and detecting fraud

4. The prevention and detection of fraud is primarily the responsibility of the management and board of directors of the audited entity. It is crucial that the board of directors, under the supervision of the board, pay particular attention to fraud prevention to minimize opportunities for fraudulent activity and to the detection of fraud, thereby persuading individuals not to engage in fraudulent activity due to the likelihood of detection and punishment. This responsibility includes a commitment to fostering a culture of integrity and ethical conduct, which can be strengthened by the active oversight of the board of directors. In carrying out their oversight responsibilities, the board of directors must consider the possibility of control or inappropriate actions influencing the preparation and presentation of financial statements, for example, the board of directors attempting to manipulate business results to mislead analysts about the performance and profitability of the audited entity.

Responsibilities of the auditor

5. When conducting an audit in accordance with Vietnamese auditing standards, the auditor is responsible for obtaining reasonable assurance that the financial statements, taken as a whole, are free from material misstatement due to fraud or error. Due to the inherent limitations of auditing, there is an unavoidable risk that the auditor may not detect certain material misstatements affecting the financial statements, even when the audit has been planned and performed in accordance with Vietnamese auditing standards (see paragraph A51 of Vietnamese Auditing Standard 200).

6. As mentioned in paragraph A51 of Vietnamese Auditing Standard No. 200, the impact of inherent limitations is particularly serious for misstatements due to fraud. The risk of material misstatement due to fraud is higher than the risk of material misstatement due to mistake. This is because fraud can be carried out through sophisticated and well-organized schemes to conceal the fraudulent act, such as falsifying records, intentionally failing to record transactions, or intentionally providing false explanations to the auditor. Concealment can be even more difficult to detect when there is collusion. Collusion can lead the auditor to believe that audit evidence is convincing when in fact it is false. The auditor's ability to detect fraud depends on factors such as the skill of the perpetrator, the frequency and extent of the manipulation, the degree of collusion, the value of the manipulated funds, and the rank of the individuals involved in the fraudulent act. Although auditors can identify opportunities for fraudulent activity, it is difficult to determine whether errors in the areas they examine, such as accounting estimates, are due to fraud or mistake.

7. Furthermore, the risk of auditors failing to detect material misstatements arising from fraudulent conduct by management is higher than the risk of detecting misstatements due to employee fraud, because management often has the opportunity to directly or indirectly manipulate accounting records, present fraudulent financial information, or override established control procedures designed to prevent similar fraudulent conduct by other employees.

8. To obtain reasonable assurance, auditors must maintain professional skepticism throughout the audit process, consider the possibility of management exerting control, and be aware that audit procedures designed to effectively detect misstatement may not be effective in detecting fraud. The provisions of this auditing standard are intended to assist auditors in identifying and assessing the risks of material misstatement due to fraud and establishing procedures to detect such misstatement.

9. Auditors and audit firms must comply with the provisions of this Standard in the process of auditing financial statements.

The audited entity (client) and the parties using the audit results must have the necessary understanding of the provisions in this Standard to coordinate work with the audit firm and auditors, as well as manage relationships related to the audited information.

Target

10. Objectives of the auditor and auditing firms the:

(a) Identify and assess the risk of material misstatement in the financial statements due to fraud;

(b) Obtain sufficient appropriate audit evidence regarding the assessed risks of material misstatement due to fraud, through the design and implementation of appropriate remedies;

(c) Appropriate measures are in place to address fraud that has been identified or suspected during the audit.

Terminology explained

11. In Vietnamese auditing standards, the following terms are understood as follows:

(a) Fraud: Is the willful act of one or more persons in the Board of Directors, Management, employees or third parties by deceptive means to obtain unjust or unlawful gain.

(b) Factors contributing to the risk of fraud: These are events or conditions that reflect a motive or pressure to commit fraud or create an opportunity to commit fraud.

II/ Standard Content

Requirement

Career skepticism

12. According to Vietnamese Auditing Standard No. 200, auditors must maintain professional skepticism throughout the audit and must be aware of the possibility of material misstatement due to fraud, even if, in previous audits, the auditor was aware of the integrity and honesty of the management and administration of the audited entity (see guidance in paragraphs A7-A8 of this Standard).

13. Unless there is reason to doubt, the auditor may accept the authenticity of documents and accounting records. If, during the audit, conditions arise that lead the auditor to believe that a document may be falsified or altered without justification, the auditor must conduct further investigation (see guidance in paragraph A9 of this Standard).

14. If the explanations provided by the Board of Directors or the Management Board, as requested by the auditor, are inconsistent, the auditor shall conduct an investigation into those inconsistencies.

Discussion within the audit team.

15. Paragraph 10 of Vietnamese Auditing Standard 315 requires the audit team to hold discussions among its members, and the member of the Board of Directors responsible for the overall audit must identify issues to be discussed with members of the audit team who are not participating in the group discussion. This discussion must focus specifically on the nature and manner in which the audited entity's financial statements are susceptible to material misstatement due to fraud, including how such fraud might occur. This discussion must be conducted even if the audit team has confidence in the integrity and honesty of the audited entity's Board of Directors and management (see guidance in paragraphs A10-A11 of this Standard).

Risk assessment procedures and related activities

16. When performing risk assessment procedures and related activities to understand the audited entity and its operating environment, including its internal controls, as required by paragraphs 05–24 of Vietnamese Auditing Standard 315, the auditor must perform the procedures in paragraphs 17–24 of this Standard to gather information to identify the risk of material misstatement due to fraud.

The Board of Directors and other stakeholders within the audited entity.

17. The auditor must interview the management of the audited entity about:

(a) Management’s assessment of the risk of misstatement due to fraud in the financial reporting, including the content, scope and frequency of such assessments (see guidance in paragraphs A12–A13 of this Standard);

(b) The management's process for identifying and addressing fraud risks within the entity, including any specific fraud risks that management has identified or been notified of, or groups of transactions, account balances, or disclosures in which fraud risks may exist (see guidance in paragraph A14 of this Standard);

(c) Communication between the Board of Directors (if any) and the Management Board regarding the process for identifying and addressing fraud risks within the unit;

(d) Communication by the Board of Directors (if any) with employees regarding the Board's views on business operations and ethical conduct.

18. The auditor shall interview management and other relevant parties within the audited entity to the extent appropriate to determine whether they are aware of any actual fraud, suspected fraud, or allegations of fraud affecting the entity (see guidance in paragraphs A15–A17 of this Standard).

19. If the audited entity has an internal audit department, the auditor must interview the internal audit department to determine whether they are aware of any actual fraud, suspected fraud, or allegations of fraud affecting the entity, and to ascertain the internal audit department's views on the risk of fraud (see guidance in paragraph A18 of this Standard).

Board of Directors

20. Unless all members of the Board of Directors are also members of the Board of Management of the audited entity (as per paragraph 13 of Vietnamese Auditing Standard 260), the auditor must understand how the Board of Directors performs its oversight function over the process of identifying and addressing the risks of fraud within the entity, as well as the internal controls established by the Board of Management to mitigate these risks (see guidance in paragraphs A19–A21 of this Standard).

21. Unless all members of the Board of Directors are also members of the Board of Management of the audited entity, the auditor must interview the Board of Directors to determine whether the Board is aware of any actual fraud, suspected fraud, or allegations of fraud affecting the entity. This interview also helps to corroborate the Board of Management's responses to the interviews conducted by the auditor.

Unusual or unexpected relationships have been identified.

22. The auditor must assess whether unusual or unexpected relationships identified during the performance of analytical procedures, including those relating to accounts reflecting revenue, may indicate a risk of material misstatement due to fraud.

Other information

23. The auditor must consider whether other information obtained by the auditor indicates a risk of material misstatement due to fraud (see guidance in paragraph A22 of this Standard).

Assess the factors that contribute to the risk of fraud.

24. The auditor must assess whether information gathered from other risk assessment procedures and related activities indicates the existence of one or more factors that give rise to the risk of fraud. While the presence of factors that give rise to the risk of fraud does not necessarily mean that fraud has occurred, these factors often appear when fraudulent acts have already occurred and may therefore be indicative of the risk of material misstatement due to fraud (see guidance in paragraphs A23–A27 of this Standard).

Identify and assess the risk of material misstatement due to fraud.

25. According to paragraph 25 of Vietnamese Auditing Standard No. 315, auditors must identify and assess the risk of material misstatement due to fraud at the financial statement level and at the assertion level of groups of transactions, account balances, and disclosures.

26. When identifying and assessing the risk of material misstatement due to fraud, the auditor must rely on the assumption that there is a risk of fraud in the recognition of revenue to assess which type of revenue, transaction, or underlying data related to the revenue could give rise to such risks. Paragraph 47 of this Standard specifies that it must be documented and retained when the auditor concludes that such assumption is inappropriate in each audit and therefore the auditor does not identify the recognition of revenue as a risk of material misstatement due to fraud (see guidance in paragraphs A28–A30 of this Standard).

27. Auditors must consider the assessed risks of material misstatement due to fraud as significant risks; therefore, they must investigate the entity's relevant controls, including those controls related to those risks (see guidance in paragraphs A31–A32 of this Standard).

Measures to address the risk of material misstatement due to fraud have been assessed.

Overall remedial measures

28. According to paragraph 05 of Vietnamese Auditing Standard 330, auditors must identify overall measures to address material misstatement risks due to fraud that have been assessed at the financial statement level (see guidance in paragraph A33 of this Standard).

29. When determining the overall treatment to address the risks of material misstatement due to fraud that have been assessed at the financial reporting level, the auditor must:

(a) Assignment and supervision of personnel based on the knowledge, skills and abilities of the individuals who will be assigned primary responsibility in the audit and the auditor's assessment of the risk of material misstatement due to fraud for the audit (see guidance in paragraphs A34–A35 of this Standard);

(b) Assess whether the selection and application of accounting policies by the audited entity, particularly policies relating to subjective estimates and judgments and complex transactions, show signs of fraudulent financial reporting stemming from an attempt by management to manipulate business results;

(c) Changes or additions to certain unpredictable elements when selecting the content, timing and scope of audit procedures (see guidance in paragraph A36 of this Standard).

Audit procedures for the risk of material misstatement due to fraud at the assertion level have been assessed.

30. According to paragraph 06 of Vietnamese Auditing Standard 330, auditors must design and perform follow-up audit procedures whose content, timing, and scope correspond to the assessment of the risk of material misstatement due to fraud at the assertion level (see guidance in paragraphs A37–A40 of this Standard).

Audit procedures for assessed risks related to management's control mechanisms have been conducted.

31. Management is susceptible to fraud because it has the ability to falsify accounting records and produce fraudulent financial statements by manipulating controls that appear to be functioning properly. While the degree of risk of management manipulating controls varies from entity to entity, this risk can exist in all entities. Because manipulating controls is unpredictable, this is a material misstatement risk due to fraud and is a significant risk.

32. Even if auditors have differing assessments of the risk of management exerting control, auditors must still establish and perform audit procedures to:

(a) Examine the appropriateness of journal entries and other adjustments made in the preparation of financial statements. When establishing and performing audit procedures for such examinations, the auditor shall:

(i) Interviewing individuals involved in the accounting and financial reporting process regarding inappropriate or unusual activities related to journal entries and other adjustments;

(ii) Selection of journal entries and other adjustments to be made at the end of the accounting period;

(iii) Consider the need to examine journal entries and other adjustments throughout the accounting period (see guidance in paragraphs A41–A44 of this Standard).

(b) Review the accounting estimates to see if there is any bias and assess whether the circumstances giving rise to the bias (if any) represent a risk of material misstatement due to fraud. During the review, the auditor must:

(i) Assess whether the judgments and decisions of the Board of Directors in making the accounting estimates in the financial statements, including when each judgment and decision was reasonable, show signs of bias on the part of the Board of Directors that could indicate the existence of a risk of material misstatement due to fraud. If so, the auditor must reassess all such accounting estimates;

(ii) Conduct a retrospective review of the assessments and assumptions made by Management relating to significant accounting estimates reflected in the prior year's financial statements (see guidance in paragraphs A45–A47 of this Standard).

(c) For significant transactions arising outside the normal course of business of the audited entity, or which appear unusual in the auditor's judgment after having familiarized himself with the entity and its operating environment and other information gathered during the audit, the auditor shall assess whether there is a proper economic justification for such transactions. If there is no proper justification, the auditor shall consider whether such transactions were arranged to produce fraudulent financial statements or to conceal misappropriation of assets (see guidance in paragraph A48 of this Standard).

33. To address identified risks related to management control, the auditor must determine whether additional audit procedures beyond those outlined above are necessary (for example, in cases where the risk of management control was not considered during the procedures performed to satisfy the requirements set out in paragraph 32 of this Standard).

Evaluating audit evidence (See guidance in paragraph A49 of this Standard)

34. The auditor must evaluate the analytical procedures performed at the final stage of the audit when drawing an overall conclusion (to determine whether the financial statements are consistent with the auditor's understanding of the audited entity) for indications of any previously undetected risk of material misstatement due to fraud (see guidance in paragraph A50 of this Standard).

35. If an error is identified, the auditor must assess whether that error is indicative of fraud. If there is evidence of fraud, the auditor must assess the impact of that error in relation to other aspects of the audit, particularly the reliability of management’s explanations, and must be aware that fraud is not usually an isolated incident (see guidance in paragraph A51 of this Standard).

36. If an misstatement, regardless of its materiality, is identified and the auditor has reason to believe that it was caused by or could have been caused by fraud and involved management (especially senior management), the auditor must reconsider their assessment of the risk of material misstatement due to fraud and the impact of that misstatement on the substance, timing, and scope of the audit procedures with respect to the assessed risk. In reconsidering the reliability of previously obtained evidence, the auditor must also consider whether the circumstances or conditions indicate collusion involving personnel, management, or third parties (see guidance in paragraph A52 of this Standard).

37. When the auditor determines that the financial statements contain material misstatements, or cannot conclude whether the financial statements contain material misstatements due to fraud, the auditor must assess the implications for the audit (see guidance in paragraph A53 of this Standard).

The auditor is unable to continue with the audit contract.

38. As a result of an error due to fraud or suspected fraud, if a situation arises that requires a review of the feasibility of continuing the audit work, the auditor must:

(a) Determine the professional and legal responsibilities applicable in that situation, including the responsibility to report to the entity designated to perform the audit or to the competent regulatory authorities (if any);

(b) Consider withdrawing from the audit engagement if permitted by law or relevant regulations;

(c) If the auditor withdraws from the contract, they must:

(i) Communicate with the appropriate management level in the Board of Directors and the Board of Management of the audited entity regarding the withdrawal from the audit engagement and the reasons for withdrawal;

(ii) Identify the professional or legal responsibility requiring reporting to the designated entity performing the audit or to the competent regulatory authority (if any) regarding the auditor's withdrawal from the audit engagement and the reasons for withdrawal (see guidance in paragraphs A54–A57 of this Standard).

Written explanation

39. The auditor must obtain written explanations from the management and administration of the audited entity (to the extent appropriate) regarding:

(a) The Board of Directors and the Management Board (to the extent appropriate) acknowledge their responsibility to establish, implement and maintain internal controls to prevent and detect fraud;

(b) The Board of Directors and Management (to the extent appropriate) have provided the auditor with the Board of Directors' and Management's assessment of the potential risk of material misstatement in the financial statements due to fraud;

(c) The Board of Directors and Management (to the extent appropriate) have provided the auditor with information known to them regarding fraud or suspected fraud affecting the audited entity, relating to:

(i) Board of Directors;

(ii) Employees who play a key role in internal control; or

(iii) Other matters, in which case the fraudulent conduct may have material effects on the financial statements;

(d) Management and administration (to the extent appropriate) have provided the auditor with information they know of any allegations of fraud, or suspected fraud affecting the audited entity's financial statements, as reported by current or former employees of the entity, analysts, regulators, or other parties (see guidance in paragraphs A58–A59 of this Standard).

Communicate with the Board of Directors and the management team of the audited entity.

40. If the auditor identifies fraudulent conduct or obtains information suggesting that fraudulent conduct may have occurred, the auditor shall promptly communicate such matters to the appropriate management of the entity in order to inform those primarily responsible for preventing and detecting fraud about matters relating to their responsibilities (see guidance in paragraph A60 of this Standard).

41. If the auditor determines or suspects that fraudulent activity involves:

(a) Board of Directors;

(b) Employees who play a key role in internal control; or

(c) Other persons in the event that the fraudulent conduct results in material misstatements in the financial statements

The auditor must promptly communicate this matter to the management, unless all members of the management are also members of the Board of Directors of the audited entity. If the auditor suspects fraudulent conduct involving the Board of Directors, the auditor must communicate this matter to the management and discuss with them the substance, timing, and scope of the audit procedures necessary to complete the audit (see guidance in paragraphs A61–A63 of this Standard).

42. The auditor must communicate with the management board about any other matters relating to fraudulent conduct that the auditor assesses are related to the management board's responsibility (see guidance in paragraph A64 of this Standard).

Consult with relevant regulatory and law enforcement agencies.

43. If fraud is identified or suspected, the auditor must determine the responsibility to report such fraud or suspected fraud to third parties (if applicable). While the client's confidentiality obligations may prevent the auditor from making such reporting, in some cases the auditor's legal liability may outweigh that confidentiality obligation (see guidance in paragraphs A65–A67 of this Standard).

Audit documents and records

44. In accordance with paragraphs 08-11 and guidance in paragraph A6 of Vietnamese Auditing Standard 230, auditors must retain the following documents in their audit files to demonstrate their understanding of the audited entity, its business environment, and the results of their risk assessment of material misstatement as required by paragraph 32 of Vietnamese Auditing Standard 315:

(a) Significant decisions made during the audit team's discussions regarding the likelihood that the audited entity's financial statements contain material misstatements due to fraud;

(b) Risks have been identified and assessed regarding the likelihood of material misstatement due to fraud at the financial reporting and assertion levels.

45. Auditors must retain the following documents in their audit file to demonstrate the auditor's response to the assessed risk of material misstatement as required by paragraph 28 of Vietnamese Auditing Standard 330:

(a) The overall treatment of the assessment of material misstatement risk due to fraud at the financial reporting level and the content, timing, scope of audit procedures, and the relationship between those procedures and the assessment of material misstatement risk due to fraud at the assertion level;

(b) Results of audit procedures, including procedures established to address risks that management controls.

46. ​​Auditors must record and retain in their audit files any information regarding fraudulent activities communicated to the Board of Directors, the Management Board, regulatory bodies, and other parties.

47. When concluding that the assumption of material misstatement risk due to fraud relating to revenue recognition is inconsistent with the facts of the audit, the auditor must record in the audit file the grounds for that conclusion.

III/ Application Instructions

When implementing this Standard, reference should be made to Vietnamese Auditing Standard No. 200.

Characteristics of fraud (Guidance in paragraph 03 of this Standard)

A1. Fraud, whether it involves fraudulent financial reporting or embezzlement, is related to a motive or pressure to commit the fraudulent act, a clear opportunity to do so, and the justification of the fraudulent act. For example:

(1) The motive or pressure to commit fraudulent financial reporting may exist when the Board of Directors is under external or internal pressure to achieve a projected (and possibly unrealistic) profit or financial result target, especially in cases where failure to achieve the financial target would have significant consequences. Similarly, individuals may have a motive to commit embezzlement, for example, due to difficult economic circumstances;

(2) A clear opportunity for fraudulent conduct may exist when an individual believes he can circumvent internal controls, for example because he is in a position of confidence or is aware of specific deficiencies in internal controls;

(3) Individuals may justify committing fraud. Some individuals have attitudes, personalities, or systems of moral values ​​that allow them to intentionally commit fraud. However, even without such conditions, honest individuals may commit fraud under strong pressure.

A2. Fraudulent financial reporting involves intentional errors such as deliberately omitting figures or explanatory information from financial statements to deceive users of the financial statements. Intentional errors may stem from the management's deliberate intention to manipulate business results, misleading users of the financial statements about the operating situation and profitability of the audited entity. These manipulations can begin with minor actions or inappropriate adjustments to assumptions and alter the management's judgments. Pressure and motivation can increase the level of influence and lead to fraudulent financial reporting. This occurs when, due to pressure to achieve market targets or the desire to maximize performance-based compensation, management intentionally attempts to create material misstatements in the financial statements. In some companies, the Board of Directors may attempt to underreport profits to reduce tax liability or overreport profits to facilitate easier bank loan applications.

A3. Fraudulent financial reporting can be carried out through the following actions:

(1) Distorting, falsifying (including forging signatures), or modifying documents and accounting books containing content and data used to prepare financial statements;

(2) Misrepresenting or intentionally failing to present in financial statements significant events, transactions or other information;

(3) Willfully misapplying accounting principles relating to figures, classifications, presentation or disclosures.

A4. Fraudulent financial reporting often involves management exerting control that appears to be functioning properly. Management typically employs the following tactics to exert control in order to commit fraud:

(1) Making fictitious entries, especially near the end of the accounting period, to adjust business results or to achieve other purposes;

(2) Unreasonably adjusting assumptions and changing judgments used to estimate account balances;

(3) Failure to recognize, premature recognition or delay in recognizing in financial statements financial events and transactions occurring during the reporting period;

(4) Concealing or failing to disclose facts that may affect items recognized in financial statements;

(5) Arranging complex transactions to distort the financial position or business results of the entity;

(6) Amend documents and terms relating to large and unusual transactions.

A5. The perpetrators of embezzlement in the form of theft of relatively small and non-material value are often employees within the unit. However, embezzlement can also be committed by members of the Board of Directors because they have easier access and use methods that are harder to detect. Embezzlement can manifest in various forms, such as:

(1) Embezzlement of revenue (for example, embezzlement of receivables that have already been collected or transfer of receivables that have been written off to personal bank accounts);

(2) Stealing physical or intellectual property (e.g., stealing inventory, scrap, selling technical documents to competitors);

(3) Making the unit pay for goods and services that the unit does not receive (for example, paying fictitious sellers, paying sellers at a higher price than the actual value so that individuals can receive commissions due to price differences, paying fictitious employees);

(4) Using the unit's assets to benefit individuals (for example, using the unit's assets as collateral for personal loans or loans for a related party).

The act of misappropriating assets is often accompanied by the falsification of documents to conceal the fact that those assets have been lost or have been mortgaged without authorization.

Notes on auditing public sector entities

A6. The auditor's responsibilities regarding fraud when auditing public sector entities may be stipulated in relevant laws or regulations applicable to public sector entities, or may be specifically defined in the auditor's duties and responsibilities. Therefore, the auditor's responsibilities when auditing public sector entities may not be limited to considering risks of material misstatement in financial statements, but may also include the responsibility to consider broader risks of fraud.

Career skepticism (Refer to paragraphs 12-14 of this Standard)

A7. Maintaining professional skepticism requires auditors to continually question whether the information and evidence obtained show signs of material misstatement due to fraud. This includes considering the reliability of the information to be used as audit evidence and controlling the preparation and maintenance of that information. Due to the nature of fraud, the auditor's professional skepticism is particularly important when considering the risk of material misstatement due to fraud.

A8. Although the auditor is aware of the integrity and honesty of the management and administration of the audited entity, the auditor's professional skepticism remains particularly important when considering the risks of material misstatement due to fraud because in many cases this could have been altered.

A9. In accordance with the guidance in paragraph A47 of Vietnamese Auditing Standard No. 200, Vietnamese auditing standards do not require auditors to verify the authenticity of documents, and auditors are not trained to be experts, nor are they considered experts, in verifying such authenticity. However, when an auditor determines that there are issues leading the auditor to believe that a document may be inaccurate or that provisions in a document have been altered without the auditor's notification, further investigation may be conducted using the following procedures:

(1) Direct confirmation with a third party;

(2) Use experts to verify the authenticity of that document.

Discussion within the audit team. (Guidance in paragraph 15 of this Standard)

A10. Discussions within the audit team regarding suspicions that the audited entity's financial statements may contain material misstatements due to fraud aim to:

(1) To provide opportunities for experienced members of the audit team to exchange their views on how and under what circumstances financial reporting may contain material misstatements due to fraud;

(2) To enable the auditor to consider appropriate treatment for the possibility of material misstatement in the financial statements due to fraud and to identify which members of the team will perform certain audit procedures;

(3) Allows auditors to determine how the results of performing audit procedures are communicated within the audit team and how to handle information regarding allegations of fraud that the auditors receive.

A11. Topics discussed within the audit team may include:

(1) Exchange of views among members of the audit team on how and under what circumstances they believe the audited entity’s financial statements are likely to contain material misstatements due to fraud, how management may have committed and concealed fraudulent financial reporting, and how the entity’s assets may have been misappropriated;

(2) Consider the circumstances that show there is manipulation of business results and the schemes that members of the Board of Directors may take to manipulate business results resulting in the preparation of fraudulent financial statements;

(3) Consider external and internal factors affecting the audited entity that may create an incentive or pressure for management or other parties to commit fraud, create opportunities for committing fraud, and have cultural or environmental factors that enable management or other parties to justify committing fraud;

(4) Consider the Board of Directors' oversight of employees who regularly have access to money or assets that are susceptible to embezzlement;

(5) Consider any unusual or unexplained changes in the behavior or lifestyle of the Board of Directors or employees that the audit team takes note of;

(6) Emphasize the importance of maintaining the right attitude throughout the audit regarding the possibility of material misstatement due to fraud;

(7) Consider situations where fraud may exist;

(8) Consider how to incorporate elements that the audited entity could not have foreseen into the content, timing and scope of the audit procedures to be performed;

(9) Consider and select effective audit procedures to address the possibility of material misstatement due to fraud in the financial statements of the audited entity;

(10) Consider the information regarding allegations of fraud that the auditor receives;

(11) Consider the risk of Board of Directors exerting control.

Risk assessment procedures and related activities

Interview with the Board of Directors

Management's assessment of the risk of material misstatement due to fraud (guidance in paragraph 17(a) of this Standard)

A12. The Board of Directors is responsible for the entity's internal controls and financial reporting. Therefore, auditors need to interview the Board of Directors about their individual assessment of fraud risk and existing controls in preventing and detecting fraud risk. The content, scope, and frequency of the Board of Directors' risk and control assessment may vary from entity to entity. In some entities, the Board of Directors may conduct a detailed assessment annually or during ongoing monitoring. In other entities, the Board of Directors' assessment may be less detailed and less frequent. The content, scope, and frequency of the Board of Directors' assessment help the auditor better understand the entity's control environment. For example, the Board of Directors' failure to conduct a fraud risk assessment in some cases may indicate a lack of concern for internal controls.

Notes on auditing small entities

A13. In some units, particularly smaller ones, the Board of Directors' assessment may focus on risks of fraud and embezzlement of assets caused by employees.

Management's process for identifying and addressing risks of fraud (guidance in paragraph 17(b) of this Standard)

A14. In cases where the audited entity has multiple operating locations, the management's process for identifying and addressing fraud risks may include varying levels of oversight of the operating locations or business units. Management may also have identified specific operating locations and business units where fraud is more likely to occur.

Interviewing the Board of Directors and other stakeholders within the organization. (Guidance in paragraph 18 of this Standard)

A15. Interviews with management can provide useful information about risks of material misstatement in financial statements arising from employee fraud. However, interviews with management often do not provide useful information about risks of material misstatement in financial statements arising from management fraud. Interviews with other stakeholders within the entity may offer them opportunities to provide information to the auditor that would not be available otherwise.

A16. Other individuals within the entity whom the auditor may conduct direct interviews regarding fraud or suspected fraud include:

(1) Employees involved in business activities not directly related to the financial reporting process;

(2) Employees of different ranks;

(3) Employees involved in the implementation, processing or recording of complex or unusual transactions and those responsible for managing or supervising such employees;

(4) Legal department staff;

(5) Personnel officer;

(6) Officer in charge of handling fraud allegations.

A17. Management is often best positioned to engage in fraudulent activities. Therefore, when evaluating management's responses to auditor's interview questions, with professional skepticism, auditors may need to further verify the content of management's responses from other sources of information.

Interview with the internal audit department. (Guidance in paragraph 19 of this Standard)

A18. Paragraph 23 of Vietnamese Auditing Standard 315 and Vietnamese Auditing Standard 610 provides for and guidance on auditing entities with internal audit departments. To implement the provisions and guidance of these auditing standards regarding fraud, auditors may interview internal audit departments about their operations, for example:

(1) Procedures that internal auditors have taken during the year to detect fraud;

(2) Does the Board of Directors have appropriate measures to address findings from the above procedures?

Learn about the oversight activities of the Board of Directors. (Guidance in paragraph 20 of this Standard)

A19. The management of an entity is responsible for overseeing the entity's systems to manage risk, control finances, and ensure legal compliance. Because the responsibilities of the management and the board of directors may differ between entities, auditors must understand the relevant responsibilities of each party to understand the supervisory activities of individuals (paragraphs A1–A8 of Vietnamese Auditing Standard 260 provide guidance on the parties with whom auditors must communicate when the entity's governance structure is not clearly defined).

A20. Understanding the oversight practices of the Board of Directors can provide auditors with insights into the entity's susceptibility to management-level fraud, the adequacy and appropriateness of internal controls to fraud risks, and the competence and integrity of the Board of Directors. Auditors can explore this in various ways, such as attending meetings or reviewing relevant meeting minutes and interviewing the Board of Directors.

Notes on auditing small entities

A21. In some cases, all members of the Board of Directors also participate in the Management Board, for example, a small entity with only one owner who performs both management and supervisory functions. In this case, the auditor usually does not need to investigate the supervisory activities of the Board of Directors because supervisory activities are not separate from management activities.

Consider other information (Guidance in paragraph 23 of this Standard)

A22. In addition to information gathered from the application of analytical procedures, other information gathered about the entity and its operating environment may be useful in identifying risks of material misstatement due to fraud. Discussions among audit team members may provide useful information for identifying these risks. Furthermore, information gathered from the audit firm's client acceptance and maintenance processes and experience gained from other services provided to the entity may be relevant to identifying risks of material misstatement due to fraud, for example, interim financial statement review services.

Assess the factors that contribute to the risk of fraud. (Guidance in paragraph 24 of this Standard)

A23. In practice, fraudulent behavior is often concealed and very difficult to detect. However, auditors can detect events or circumstances that suggest the motive, pressure, or opportunity for fraud (these are factors that contribute to the risk of fraud). For example:

(1) The need to meet third-party expectations in order to obtain funding can create pressure leading to fraud;

(2) Large bonus policies for achieving unrealistic profit targets can create an incentive for fraud;

(3) An ineffective control environment can create opportunities leading to fraud.

A24. Factors contributing to fraud risk are difficult to categorize by importance. The importance of factors contributing to fraud risk varies greatly. In some entities under specific conditions, some of these factors may be present but do not necessarily indicate material misstatement risk. Therefore, determining whether a factor contributing to fraud exists and whether it is considered when assessing the risk of material misstatement due to fraud requires auditors to exercise professional judgment.

A25. Examples of risk factors for fraud related to fraudulent financial reporting and misappropriation of assets are presented in Appendix 01 of this Standard. These examples illustrate risk factors classified based on three common conditions for fraud:

(1) Motive or pressure leading to fraud;

(2) Opportunities leading to fraud;

(3) The ability to justify fraudulent behavior.

Through observation, auditors may not easily detect factors that contribute to the risk of fraud. However, auditors can still identify the existence of such factors. Although the factors contributing to fraud risk listed in Appendix 01 encompass a range of situations that auditors may encounter, this is not an exhaustive list of all factors that can lead to fraud risk.

A26. The size, complexity, and ownership structure of an entity significantly influence the consideration of factors contributing to fraud risk. For example, large entities often have many factors that restrict the illegal actions of the Board of Directors, such as:

(1) The Board of Directors performs its supervisory duties effectively;

(2) There is an effective internal audit department;

(3) There are effective regulations on ethics and anti-fraud measures.

Furthermore, factors contributing to fraud risk when considered at the business unit level may provide different insights compared to factors contributing to fraud risk gathered when considered at the unit-wide level.

Notes on auditing small entities

A27. For small entities, some or all of the issues auditors need to consider may be inappropriate or only minimally relevant. For example, a small entity may not have written regulations on ethics and anti-fraud measures, but it may still have a corporate culture that emphasizes the importance of integrity and professional ethics through public awareness campaigns and the exemplary conduct of its management. The managerial monopoly of a single individual in a small entity does not usually mean that the management lacks reasonable concern for internal controls and the entity's financial reporting processes. In some entities, direct management oversight may mitigate control deficiencies and reduce the risk of employee fraud. However, the managerial monopoly of a single individual can be a potential flaw due to the management's ability to exert control.

Identify and assess the risk of material misstatement due to fraud.

Risk of revenue fraud (Guidance in paragraph 26 of this Standard)

A28. Material misstatements resulting from fraudulent financial reporting related to revenue recognition typically arise from over-recognition through, for example, premature recognition or fictitious recognition. This misstatement can also result from under-recognition through, for example, inappropriate carryforward of revenue to a later period.

A29. In some entities, the risk of revenue recognition fraud may be higher than in others. For example, in listed organizations, where performance is measured by year-on-year revenue or profit growth, management may face pressure or incentives leading to fraudulent financial reporting by recording revenue improperly. Similarly, the risk of revenue recognition fraud may be higher if the entity primarily sells goods and services through cash.

A30. The auditor may exclude the assumption of the existence of a risk of fraud in revenue recognition. For example, the auditor may conclude that there is no risk of material misstatement due to fraud related to revenue recognition when the entity has only a single type of revenue transaction, for example, rental income from a single rental property.

Identify and assess the risk of material misstatement due to fraud and understand the entity's relevant controls. (Guidance in paragraph 27 of this Standard)

A31. In accordance with the guidance in paragraph A48 of Vietnamese Auditing Standard 315, the management of the audited entity may make judgments about the scope and extent of the controls it chooses to implement and about the scope and extent of the risks it decides to accept. To determine which controls are necessary to prevent and detect risks, management should consider the risks of material misstatement in the financial statements resulting from fraud. In considering this, management may conclude that implementing and maintaining a particular control to mitigate the risk of material misstatement due to fraud is not cost-effective.

A32. Auditors should be interested in learning about the controls that management has designed, implemented, and maintained to prevent and detect fraud. In doing so, auditors may learn information such as whether management intentionally chose to accept the risks associated with not delegating authority. Information gathered from this inquiry may be helpful in identifying factors contributing to fraud risk that could affect the auditor's assessment of the risk that the financial statements may contain material misstatements due to fraud.

Measures to address the risk of material misstatement due to fraud have been assessed.

Overall remedial measures (Guidance in paragraph 28 of this Standard)

A33. Determining the overall course of action for assessed risks of material misstatement due to fraud typically involves considering ways to enhance professional skepticism throughout the audit, for example:

(1) Enhance sensitivity in selecting content and scope of audit documents for material transactions;

(2) Raise awareness of the need for adequate and appropriate evidence regarding the Board's explanations or justifications for material matters.

The determination of the aforementioned measures also involves a broader consideration beyond other specific planned procedures; this scope of consideration includes the issues set out in paragraph 29 and the guidance in paragraphs A34–A36 of this Standard.

Personnel assignment and supervision (Guidance in paragraph 29(a) of this Standard)

A34. Auditors may address the risk of material misstatement due to identified fraud by assigning additional individuals with specialized skills and knowledge (such as legal and IT consultants), or by assigning additional experienced individuals to the audit.

A35. The level of supervision depends on the auditor's assessment of the risk of material misstatement due to fraud, as well as the professional competence of the audit team.

Use unpredictable factors when selecting audit procedures. (Guidance in paragraph 29(c) of this Standard)

A36. The inclusion of unpredictable elements in the selection of the content, schedule, and scope of audit procedures is of great importance, as individuals within the audited entity are familiar with the procedures typically performed during the audit and are therefore more likely to conceal fraud in the preparation and presentation of financial statements. Unpredictable elements can be incorporated in ways such as:

(1) Perform substantive tests on selected account balances and assertions which, given their materiality or risk, the auditor might not test;

(2) Adjusting the time for performing other audit procedures from the planned time;

(3) Using different sampling methods;

(4) Performing audit procedures at different locations or at locations not notified in advance.

Audit procedures for the risk of material misstatement due to fraud at the assertion level. has been evaluated (Guidance in paragraph 30 of this Standard)

A37. Audit measures for assessed risks of material misstatement due to fraud at the assertion level may include changes to the content, timing, and scope of audit procedures in the following ways:

(1) The content of the audit procedures to be performed may need to change in order to obtain more relevant and reliable audit evidence or to obtain additional corroborating information. This may affect the type of audit procedure and the combination of these procedures. For example:

a. Physical observation or inspection of certain assets may become more important, or auditors may choose to use computer-assisted auditing techniques to gather more evidence about data in accounts or significant electronic transaction files;

b. Auditors may design additional audit procedures to gather further corroborating information. For example, if the auditor determines that management is under pressure to meet profit targets, there may be a risk that management is overrecognizing revenue by entering into sales contracts with provisions allowing for pre-recognition of revenue or issuing sales invoices before delivery. In this case, the auditor may design independent confirmations that not only confirm the balances but also confirm details of the sales contracts, including the signing date, return rights, and delivery terms. Additionally, to supplement these independent confirmations, the auditor may interview non-finance staff within the entity regarding any changes to the sales contracts and delivery terms.

(2) The schedule for performing substantive tests may need to be adjusted. The auditor may determine that performing substantive tests at or near the end of the reporting period would be more effective for assessing the risks of material misstatement due to fraud. The auditor may conclude that, because of assessed intentional misstatement or deliberate manipulation, audit procedures to extrapolate audit conclusions from the mid-period to the end of the period would not be effective. Conversely, because an intentional misstatement (such as an error related to revenue recognition) may arise mid-period, the auditor may choose to apply substantive testing to transactions occurring earlier in the period or to transactions occurring throughout the reporting period.

(3) The scope of procedures applied depends on the auditor's assessment of the risk of material misstatement due to fraud. For example, increasing the sample size or performing more detailed analytical procedures may be necessary. At the same time, computer-assisted audit techniques may allow for more in-depth testing of electronic transactions and data. These techniques may be used to sample key electronic transactions, classify transactions with specific characteristics, or to test the entire population instead of a sample.

A38. If the auditor discovers a risk of material misstatement due to fraud affecting inventory quantities, examining the entity's inventory records may help identify locations or items requiring special attention during or after the inventory count. This review may lead to a decision to conduct inventory observation at certain locations without prior notice or to conduct inventory counts at all locations simultaneously.

A39. Auditors may identify risks of material misstatement due to fraud affecting an account and assertion. These accounts and assertions may include: asset valuations, accounting estimates relating to specific transactions (such as acquisitions, restructuring, or liquidation of a business unit), and other significant liabilities incurred (such as environmental remediation obligations). Risks may also relate to significant changes in assumptions concerning estimates. Information gathered through understanding the entity and its operating environment may help auditors assess the reasonableness of accounting estimates and the judgments and assumptions underlying management's estimates. Reviewing similar judgments and assumptions applied by management in prior periods will help auditors better understand the reasonableness of the judgments and assumptions underlying management's estimates.

A40. Appendix 02 of this Standard provides examples of audit procedures that may be applied to address assessed risks of material misstatement due to fraud, including procedures for combining unpredictable elements. This Appendix also provides examples of measures for the auditor's assessment of the risk of material misstatement arising from fraudulent financial reporting (including fraudulent reporting due to revenue recognition) and from misappropriation of assets.

Audit procedures for risks related to management control.

Journal entries and other adjustments (guidance in paragraph 32(a) of this Standard)

A41. Material misstatements in financial statements due to fraud typically involve manipulation of the preparation and presentation of financial statements by making inappropriate or unapproved journal entries. This may occur during or at the end of the reporting period, or by management adjusting financial statements in a way that is not reflected in the accounting records, such as through consolidation adjustments and reclassifications.

A42. Auditors need to consider the risks of material misstatement associated with the unreasonable control over book entries because automated control processes and activities may mitigate the risk of error due to negligence but do not mitigate the risk of individuals misusing these automated processes in an unreasonable manner, for example, by altering values ​​automatically entered into the General Ledger or into the financial reporting system. Furthermore, when using information technology to automatically transmit information, there may be little or no clear evidence of such interference within the information systems.

A43. When determining and selecting journal entries and other adjustments to test and determining the appropriate method to test the basis of selected items, auditors should consider the following issues:

(1) Assess the risk of material misstatement due to fraud: The existence of factors that give rise to the risk of fraud and other information gathered from the auditor's assessment of the risk of material misstatement due to fraud can help the auditor identify specific types of journal entries and other adjustments to be tested.

(2) Controls are made on journal entries and other adjustments: Effective controls over the preparation and execution of journal entries and other adjustments may reduce the level of substantive testing required, provided the auditor has already tested the effectiveness of those controls.

(3) Procedures for preparing and presenting financial reports of the unit and the content of evidence that can be collected: For many entities, the transaction processing procedure is a combination of manual and automated steps and procedures. Similarly, the processing of journal entries and other adjustments may include both manual and automated control procedures and activities. When information technology is applied to the financial reporting process, journal entries and other adjustments may only exist in electronic data form.

(4) Characteristics of fraudulent journal entries and adjustments: Improper journal entries or adjustments often have distinct identifying characteristics. These characteristics may include entries that are (a) made in inappropriate, unusual, or rarely used accounts, (b) made by individuals who would not normally make journal entries, (c) recorded at the end of the period or after closing the books with little or no explanation or interpretation, (d) made before or during the preparation of financial statements without being reflected in accounting accounts, or (e) have amounts that are rounded or have consistent last digits.

(5) Content and complexity of accounts: Inappropriate journal entries or adjustments may be recorded in accounts that (a) have complex and unusual transactions, (b) contain significant estimates and year-end adjustments, (c) have previously resulted in errors, (d) have not been reconciled in a timely manner or have unreconciled differences, (e) contain intercompany transactions, or (f) are associated with an identified risk of material misstatement due to fraud. When auditing entities with multiple business locations or subsidiaries, auditors should be mindful of selecting journal entries from different locations.

(6) Journal entries or other adjustments are treated differently from the usual way of handling: Unusual journal entries may not be subject to the same controls as journal entries recording regular transactions such as monthly revenue, purchases, and cash disbursements.

A44. Auditors should use professional judgment when determining the substance, timing, and scope of testing of journal entries and other adjustments. However, paragraph 32(a)(ii) of this Standard requires auditors to select journal entries and other adjustments made at the end of the reporting period, since fraudulent journal entries and other adjustments are often made at this time. In addition, paragraph 32(a)(iii) of this Standard requires auditors to consider the need to perform testing of journal entries and other adjustments throughout the reporting period, since material misstatements in financial statements due to fraud may arise throughout the period and fraud may be cleverly concealed.

Accounting estimates (Guidance in paragraph 32(b) of this Standard)

A45. When preparing and presenting financial statements, management must make certain judgments or assumptions affecting significant accounting estimates and continuously monitor the reasonableness of those estimates. Fraudulent financial reporting is often accomplished through deliberate errors in accounting estimates. This can be achieved by, for example, under- or over-recording provisions or equity items in the same direction to create consistent profit growth over two or more accounting periods or to achieve expected profit levels, thereby misleading users of the financial statements about the entity's performance and profitability.

A46. The purpose of reviewing the judgments and assumptions underlying the management's significant accounting estimates in the prior year's financial statements is to determine whether there is any indication of bias on the part of management. This review is not intended to evaluate the professional judgments the auditor made in the prior year based on the information available at that time.

A47. Paragraph 09 of Vietnamese Auditing Standard 540 also requires auditors to review the judgments and assumptions underlying the management's significant accounting estimates in the prior year's financial statements. This review is performed as a risk assessment procedure to gather information on the effectiveness of management's estimation process in the prior period, to gather audit evidence on the performance of transactions related to prior period accounting estimates relevant to current period accounting estimates, and to gather audit evidence on issues such as the uncertainty of estimates that need to be disclosed in the financial statements. The review of management's judgments and assumptions to determine biases that may reflect the risk of material misstatement due to fraud as defined in this Standard may be performed in conjunction with the review required by Vietnamese Auditing Standard 540.

Economic reasons behind important operations (Guidance in paragraph 32(c) of this Standard)

A48. Indications that significant transactions not part of the unit's normal operations or unusual transactions may be undertaken to create fraudulent financial statements or to conceal the misappropriation of assets include:

(1) The form of those transactions is too complex (for example, transactions involving multiple units within a group that must prepare consolidated financial statements or multiple third parties that are not related parties);

(2) The Board of Directors did not discuss with the unit's management board the content and accounting methods of those transactions and did not have complete relevant documents and books;

(3) The Board of Directors emphasizes the specific accounting requirements more than the economic content of the transaction;

(4) Transactions with related parties that are not consolidated, including special purpose entities (such as subsidiaries established for the purpose of transferring profits, losses, etc.) that are not properly reviewed and approved by the entity's Board of Directors;

(5) Transactions with previously unidentified related parties or parties that do not have the financial capacity or ability to carry out the transaction without the support of the audited entity.

Evaluating audit evidence (Refer to paragraphs 34-37 of this Standard)

A49. Paragraph 25 of Vietnamese Auditing Standard 330 requires auditors to consider whether assessments of material misstatement risk at the assertion level remain appropriate, based on audit procedures performed and evidence gathered. While this consideration is primarily qualitative and based on the auditor's judgment, it can help the auditor better understand the risk of material misstatement due to fraud and determine the need for additional or other audit procedures. Appendix 03 of this Standard provides examples of situations that may demonstrate the possibility of fraud.

Analytical procedures are performed at the end of the audit when forming the overall conclusion. (Guidance in paragraph 34 of this Standard)

A50. Auditors should use professional judgment in identifying trends and specific relationships that may be indicative of material misstatement risk due to fraud, particularly unusual relationships relating to revenue and income at the end of the year such as: large income items of unclear content recognized near the end of the reporting period or unusual transactions; or income inconsistent with cash flow from operating activities.

Review the identified errors. (Refer to paragraphs 35-37 of this Standard)

A51. Fraud does not typically arise in isolation because it is usually associated with motives, pressures, or opportunities to commit fraud, or with justification for fraudulent conduct. Accordingly, errors, for example, a large number of errors at a particular location, even if the cumulative impact is not material, may still indicate the existence of a risk of material misstatement due to fraud.

A52. Depending on the specific circumstances, the significance of identified fraud may vary. For example, a non-material act of fraud may become material if it involves senior management. In this case, the auditor may need to reconsider the reliability of the evidence gathered, due to doubts about the completeness and truthfulness of the disclosures and the authenticity of the accounting documents, or the possibility of collusion between staff and management or a third party.

A53. Vietnamese Auditing Standards No. 450 and No. 700 prescribe and guide how to assess and handle errors and the impact of these errors on the auditor's opinion in the audit report.

The auditor is unable to continue performing the audit contract. (Guidance in paragraph 38 of this Standard)

A54. Examples of less common situations that may arise and may cause the auditor to consider whether to continue with the audit engagement include:

(1) The entity fails to take appropriate measures to address fraud that the auditor deems necessary in the particular circumstances, even if such fraud does not materially affect the financial statements;

(2) The auditor considers the risk of material misstatement due to fraud and the results of the audit tests show that there is a significant risk of material and pervasive fraud; or

(3) The auditor is concerned about the competence or integrity of the Board of Directors or the management team.

A55. Due to the diverse nature of the situation, this Standard cannot precisely describe the circumstances that would warrant an auditor considering withdrawal from an audit engagement. Some factors that might lead an auditor to consider withdrawing from an audit engagement include the involvement of a member of the Board of Directors or management of the audited entity in fraud (which could affect the reliability of the Board's statements) and the implications for the auditor of continuing the audit engagement.

A56. Auditors have professional and legal responsibilities in the event they are unable to continue performing an audit engagement. Depending on the specific circumstances and applicable laws, auditors may need to seek the advice of legal counsel when deciding to withdraw from an audit engagement and when determining appropriate actions, including reporting to shareholders, regulators, and other parties. The Vietnamese Code of Professional Ethics for Accountants and Auditors guides auditors to communicate with a replacement auditor when withdrawing from an audit engagement.

Notes on auditing public sector entities

A57. In many cases, when auditing entities operating in the public sector, auditors are not permitted to withdraw from the audit engagement in accordance with the law or to serve the public interest.

Written explanation (Guidance in paragraph 39 of this Standard)

A58. Vietnamese Auditing Standard No. 580 provides guidance on how to obtain appropriate disclosures from management and administration (to the extent appropriate) during an audit. In addition to acknowledging that they have fulfilled their responsibilities in preparing and presenting the financial statements, management and administration (to the extent appropriate) must acknowledge their responsibility for establishing, implementing, and maintaining internal controls to prevent and detect fraud, regardless of the size of the entity.

A59. Due to the nature of fraud and the difficulties faced by auditors in detecting material misstatements in financial statements resulting from fraud, auditors should obtain written explanations from management and administration (where appropriate) confirming that they have provided the auditor with:

(a) The Board of Directors' assessment of the risk of material misstatement in the financial statements due to fraud;

(b) The awareness of the Board of Directors and the Management Board (to the extent appropriate) of actual, suspected, or alleged fraud affecting the entity.

Discussions with the Board of Directors and the Management Board.

Discussion with the Board of Directors (Guidance in paragraph 40 of this Standard)

A60. Once evidence of the existence or likelihood of fraud has been gathered, the auditor should immediately communicate with the appropriate management level of the audited entity, even if the discovered issue may be considered to have no significant impact (e.g., the misappropriation of small-value assets by a low-level employee within the entity). Determining the appropriate management level to communicate with depends on the auditor's professional judgment and is influenced by factors such as the likelihood of collusion, the nature and severity of the fraud. Generally, the appropriate management level of the entity should be at least one level higher than those involved in the fraud.

Discuss with the Management Board (Guidance in paragraph 41 of this Standard)

A61. Auditors may communicate with management orally or in writing. Paragraph A38 of Vietnamese Auditing Standard 260 specifies the factors that auditors need to consider in deciding whether to communicate orally or in writing. Because of the nature and sensitivity of fraud involving senior management, or fraud resulting in material misstatements in the financial statements, auditors need to report such matters in a timely manner and may consider the need for written reporting.

A62. In some instances, the auditor may find it necessary to communicate with management even though the fraud discovered involves only employees and not the Board of Directors and does not result in material misstatements. Similarly, management may wish to be informed of such instances. This communication process will be effective if the auditor and management agree early on on the content and extent of the auditor's notification regarding the fraud.

A63. In cases where there are doubts about the integrity or honesty of the Board of Directors or the Management Board, the auditor should consider seeking the opinion of legal counsel to determine the appropriate course of action.

Other issues related to fraud (Guidance in paragraph 42 of this Standard)

A64. Other issues related to fraud that need to be discussed with the unit's Board of Directors may include:

(1) Concerns about the content, scope and frequency of the Board of Directors' review of the controls being implemented to prevent and detect fraud and about the risks that could make the financial statements inaccurate;

(2) The Board of Directors fails to remedy serious deficiencies discovered in internal control, or fails to properly address detected fraud;

(3) The auditor's assessment of the entity's control environment, including doubts about the competence and integrity of the Board of Directors;

(4) Actions by the Board of Directors that may indicate fraudulent financial reporting, such as the Board of Directors' selection and application of accounting policies that may indicate the Board of Directors' intent to manipulate business results to mislead users of the financial statements about the entity's performance and profitability;

(5) Concerns about the appropriateness and adequacy of approving the unit's unusual transactions.

Notify relevant regulatory and law enforcement agencies. (Guidance in paragraph 43 of this Standard)

A65. The professional responsibility of auditors regarding the confidentiality of client information may prohibit them from reporting fraud to parties other than the client. However, in certain circumstances, as required by law or relevant regulations, auditors must report fraud to the relevant regulatory and legal authorities.

A66. Depending on the specific circumstances, auditors may need to seek the advice of legal counsel to determine the necessity of reporting the fraud to relevant regulatory or legal authorities to ensure that necessary steps are taken to protect the public interest in the face of the impact of the discovered fraud.

Notes on auditing public sector entities

A67. In the public sector, depending on the requirements of the law or relevant regulations, auditors may be required to report on whether or not fraud has been detected during the audit.

Appendix 01

(Guidance for paragraph A25 of this Standard)

EXAMPLES OF FACTORS LEADING TO THE RISK OF FRAUD

This appendix provides examples of factors contributing to fraud risk that auditors commonly encounter in practice. These examples are presented according to two types of fraud (fraudulent financial reporting and misappropriation of assets) corresponding to the auditor's approach. For each type of fraud, the factors contributing to fraud risk are further categorized based on three conditions commonly present when material misstatement due to fraud occurs: (a) motive or pressure, (b) opportunity, and (c) attitude or justification for the action. In addition to the factors contributing to risk outlined in the following examples, auditors need to identify other factors contributing to risk. Not all examples are applicable to all situations, and some examples may have different meanings depending on the size, ownership structure, or specific circumstances of the entity. At the same time, the order in which examples of factors leading to fraud risk are presented does not reflect the importance or frequency of occurrence of those factors.

A. Examples of factors contributing to fraud risk related to errors arising from fraudulent financial reporting.

A.1 Engine or pressure

A.1.1 Financial stability or profitability is affected by the economic situation, industry, or operating conditions of the entity, for example:

(1) High level of competition or saturated market, accompanied by declining profits;

(2) Vulnerable to rapid changes, such as technological changes, obsolete products, or changes in interest rates;

(3) Customer demand has decreased significantly and the number of failing units in the industry or in the economy has increased;

(4) Losses from business operations that lead to the risk of bankruptcy, asset seizure or foreclosure;

(5) Continuously generating negative cash flow from business operations or inability to generate cash flow from business operations while reporting profits and growth;

(6) Rapid growth or unusual profit margins, especially when compared to companies in the same industry;

(7) New accounting, legal or related regulations arise.

A.1.2 High pressure on the Board of Directors to meet the requirements or expectations of third parties due to:

(1) Expectations of returns or trends of investment analysts, institutional investors, significant creditors, or other independent parties (especially excessive or unrealistic expectations), including expectations of the Board of Directors in press releases or overly optimistic information in annual reports;

(2) The need to mobilize additional funding sources in the form of loans or equity contributions to maintain competitiveness, including funding for research and development or large investment expenditures;

(3) The entity is about to meet listing requirements or debt payment requirements or other debt contract requirements;

(4) Adverse effects of poor financial performance reporting on large unexecuted transactions such as business combinations or tenders.

A.1.3 Information showing that the personal financial situation of the Board of Directors or Management Board is affected by the company's performance due to:

(1) Large financial benefits in the unit;

(2) The majority of the income of the Board of Directors and Management (such as bonuses, stock options and profit-sharing arrangements) is uncertain and dependent on the achievement of targets for stock prices, business results, financial performance or cash flow. This income is dependent on the achievement of targets relating only to certain specific accounts or selected activities of the entity, although in general these accounts or activities may not be material to the entity;

(3) Personal guarantee for the unit's debts.

A.1.4 High pressure on the Board of Directors or executive personnel to achieve the financial targets set by the Board of Management, including reward policies based on revenue or profit margins.

A.2 Opportunities

A.2.1 Characteristics of the industry or the entity's activities that may create opportunities for financial reporting fraud often arise from:

(1) Significant transactions with related parties outside of the ordinary course of business or with related entities that have not been audited or have been audited by a different auditing firm;

(2) Strong financial power giving a dominant advantage in a particular industry allows the entity to impose conditions on suppliers or customers, which may lead to unreasonable or unusual transactions;

(3) Assets, liabilities, revenues, or expenses are determined based on significant accounting estimates involving subjective judgments or other uncertainties;

(4) Transactions of unusual or very complex value, especially those occurring near the end of the accounting period;

(5) Major activities are organized or carried out between countries with different business environments and cultures;

(6) Using intermediary business units without a clear reason;

(7) Opening bank accounts, establishing subsidiaries or branches in tax-incentive locations without clear reasons.

A.2.2 The monitoring of the Board of Directors' activities is ineffective due to the following reasons:

(1) The monopoly of management by one person or group of people without additional control procedures;

(2) The Board of Directors' oversight of financial reporting and internal control is ineffective.

A.2.3 Complex or unstable organizational structure, as shown below:

(1) Difficulty in identifying the organization or individual with control over the unit;

(2) The organizational structure is too complex, including unusual legal entities or management levels;

(3) Frequent changes in the Board of Directors, Management Board or legal advisors.

A.2.4 Ineffective internal controls are due to the following reasons:

(1) Lack of oversight of controls including automatic controls and interim financial reporting controls;

(2) Frequent turnover or ineffective recruitment of accounting staff, internal audit staff or information technology staff;

(3) Ineffective accounting system and information system.

A.3 Attitude or justification for an action

(1) Management communicates, implements, supports or requires the implementation of corporate culture or professional ethical standards in an inappropriate and ineffective manner;

(2) Members of the Board of Directors who lack professional expertise in finance but interfere excessively or impose their will in the selection of accounting policies or the determination of significant accounting estimates;

(3) There has been a history of violations of securities laws or other laws and regulations, or the entity has been sued, or the Board of Directors or Management Board has been accused of fraud or violations of laws and regulations;

(4) The Board of Directors is overly concerned with maintaining or increasing the stock price or earnings trend of the business;

(5) The Board of Directors makes no commitment to analysts, creditors and third parties to achieve overly high or unrealistic forecasts;

(6) The Board of Directors was unable to promptly correct serious deficiencies identified in internal control;

(7) The management's interest in using inappropriate measures to reduce reported profits for tax-related reasons;

(8) Moral deficiencies in members of the Board of Directors;

(9) The Board of Directors is also the owner, not separating personal transactions from business transactions;

(10) Disputes between shareholders in a small unit;

(11) The Board of Directors has repeatedly attempted to justify inappropriate accounting practices based on materiality;

(12) Tensions in the relationship between the Board of Directors and the current or former audit firm, as shown by the following situations:

a. Frequent conflicts with the current or previous auditing firm regarding accounting, auditing, or reporting issues;

b. There are unreasonable demands placed on auditors, for example, unrealistic pressure regarding the timeframe for completing the audit or issuing the audit report;

c. Restrictions on auditors such as limited access to staff, access to information, or the ability to inform the Board of Directors;

d. The Board of Directors engages in conduct that controls auditors, restricts the scope of the audit, or limits the selection or contact with assigned staff to participate in or advise on the audit.

B. Examples of factors leading to risks associated with misappropriation of assets

The risk factors associated with misappropriation of assets are also categorized according to three conditions commonly present when fraud occurs: motive or pressure, opportunity, and attitude or justification for the action. When misappropriation of assets arises, the risk factors associated with misappropriation of assets also appear. For example, misappropriation of assets or fraud in the preparation and presentation of financial statements often occur in entities lacking effective oversight of management and weak internal controls. The following are examples of risk factors associated with misappropriation of assets.

B.1 Engine or pressure

Management or employees may face pressure from personal financial obligations when they have access to cash or other assets that are easily stolen, leading them to embezzle these assets.

When a negative relationship arises between an organization and employees who have access to cash or other assets that are vulnerable to theft, it creates an incentive for them to embezzle the funds. For example, such a negative relationship could arise from the following situations:

(1) Knowing or anticipating that they will be forced to resign;

(2) Recent or anticipated changes to employee salary and bonus plans;

(3) Promotions, salary increases, or other reward policies are not as desired.

B.2 Opportunities

B.2.1 Certain characteristics or circumstances make assets vulnerable to theft or embezzlement. For example, the opportunity for embezzlement increases in the following situations:

(1) Holding or handling a large sum of money;

(2) Small-sized, high-value inventory with high market demand;

(3) Assets that are easily converted into cash such as bearer bonds, diamonds, computer chips;

(4) Fixed assets that are small in size, easy to sell on the market, or lack a basis for identifying the owner.

B.2.2 Ineffective internal controls over assets can increase the likelihood of asset misappropriation, for example, in the following situations:

(1) Unclear assignment of tasks or inadequate independent inspection tasks;

(2) Inadequate oversight of the expenses of the Board of Directors, such as travel expenses or other expenses;

(3) Lack of supervision by the Board of Directors over employees responsible for assets, especially in remote areas;

(4) Inadequate review of the job applications of employees who have access to assets;

(5) Property records are not kept in full;

(6) Ineffective authorization and approval of expenditure and asset procurement transactions;

(7) Lack of protective measures for cash, investment assets, inventory, fixed assets;

(8) The inventory and reconciliation of assets are incomplete and untimely;

(9) Transaction records and documents are not kept complete, timely and appropriately;

(10) No mandatory leave is required for key supervisory personnel;

(11) The Board of Directors does not have a good understanding of information technology, which makes it easy for IT staff to embezzle;

(12) Lack of control over data information generated by computer systems, including control and review of computer system logs.

B.3 Attitude or justification for the action

(1) Disregard for the need to monitor or mitigate the risk of misappropriation of assets;

(2) Disregard for internal control over the risk of misappropriation of assets due to control manipulation or failure to take measures to remedy identified deficiencies in internal control;

(3) Actions that show dissatisfaction or discontent with the unit or the way the unit treats its employees;

(4) Changes in behavior or lifestyle that may indicate misappropriation of assets;

(5) Petty thefts are easily overlooked.

Appendix 02

(Guidance for paragraph A40 of this Standard)

EXAMPLES OF AUDIT PROCEDURES FOR THE RISK OF MATERIAL MISCONDUCT DUE TO FRAUD THAT HAVE BEEN ASSESSED

This appendix provides examples of audit procedures for assessed risks of material misstatement due to fraud, arising from fraudulent financial reporting or misappropriation of assets. Not all of the procedures listed below are suitable for every audit situation. Furthermore, the order in which the procedures are arranged does not reflect their importance.

A. Consideration at the data base level

The specific measures for the auditor's assessment of the risk of material misstatement due to fraud will vary depending on the type or combination of risk factors or conditions identified, and the group of transactions, account balances, disclosures, and assertions that the risk may affect.

Examples of specific corrective actions:

(1) Visiting the site or performing certain unannounced or unscheduled inspection procedures. For example, observing inventory counts at locations without prior notice of auditor involvement or conducting unscheduled cash counts on a specific date;

(2) Require inventory count at the end of the accounting period or at a date close to the end of the period to minimize the risk of changes in balances during the period between the end of the inventory count and the end of the reporting period;

(3) Adjust the audit method in the current year. For example, contact directly (meet in person, call, email) with key customers and suppliers in addition to written contacts such as sending confirmation letters, requesting confirmation or seeking further information in other forms;

(4) Conduct a detailed review of end-of-quarter or end-of-period entries and examine entries that appear unusual in nature or value;

(5) Investigate the possibility of related parties and financial sources supporting large and unusual transactions, especially those occurring near or at the end of the accounting period;

(6) Perform basic analytical procedures on individual figures. For example, compare sales revenue and cost of goods sold by location, by product line or by month with the figures expected by the auditor;

(7) Interview personnel involved in the areas where the risk of material misstatement due to fraud has been identified to gather their opinions on the risk, the likelihood and the manner in which the controls can identify the risk;

(8) Discuss with other independent audit firms (if any) that are auditing the financial statements of one or more subsidiaries, divisions or branches about the scope of work required to address the risk of material misstatement due to fraud from transactions or activities between these entities;

(9) If the work of the expert becomes significant to a financial reporting item with a very high risk of misstatement due to fraud, the auditor should perform additional procedures relating to the expert's assumptions, methods or findings to determine that such assumptions, methods or findings are reasonable, or to nominate additional experts to perform this work;

(10) Perform analytical procedures on selected items on the balance sheet of the audited prior year financial statements (such as provisions for inventory devaluation) to assess whether accounting judgments and estimates are consistent with information obtained during the audit;

(11) Perform audit procedures on accounts or reconciliation documents prepared by the entity, including interim reconciliation documents;

(12) Implement computer-assisted auditing techniques such as data search techniques to examine anomalies in a population;

(13) Check the accuracy of the accounting records and transactions generated by the computer;

(14) Seek additional audit evidence from sources outside the audited entity.

B. Specific measures for handling errors resulting from fraud in the preparation and presentation of financial statements.

Examples of specific actions to be taken in response to an auditor's assessment of the risk of material misstatement due to fraud in the preparation and presentation of financial statements are as follows:

B.1 Revenue Recognition

(1) Perform basic analysis procedures on revenue using individual figures, for example, comparing revenue by month and by product line or business unit in the current accounting period with previous accounting periods. Computer-assisted audit techniques can be very useful in identifying unusual or unexpected revenue relationships or transactions;

(2) Confirm with the audited entity's client certain terms of the contract and any “supplementary agreements” not provided, as accounting is often affected by terms or agreements that are not fully documented in the records. For example, acceptance criteria, terms of completion and payment, future obligations of the seller; right to return products; guaranteed resale value…;

(3) Interview the unit's sales staff, marketing staff or legal counsel regarding sales or deliveries at the end of the accounting period and their awareness of unusual terms or conditions relating to these transactions;

(4) Be present at one or more locations at the end of the accounting period to witness goods that have been shipped or are ready for shipment (or returned goods awaiting processing) and perform year-end split checks on sales and inventory;

(5) In case revenue transactions are accounted for by computer, check the control system to ensure that revenue transactions are accounted for fully and appropriately.

B.2 Inventory Quantity

(1) Examine the unit's inventory records to identify locations or types of goods that require special attention during and after the inventory count;

(2) Conduct unannounced inventory checks at any location or at all locations on the same day;

(3) Require inventory count at the end of the accounting period or at a date close to the end of the period to minimize the risk of changes in balances during the period between the end of the inventory count and the end of the reporting period;

(4) Perform additional procedures during inventory observation, for example, inspect the inside of containers, the way goods are arranged (e.g., in hollow squares) or labeled, and the quality of liquid goods (purity, grade, concentration) such as perfumes or specialty chemicals. Experts should be employed to perform this inspection;

(5) Compare the ending inventory quantity with previous periods by group, by type of inventory, by location or by other criteria, or compare the actual inventory quantity with the accounting records;

(6) Use computer-assisted auditing techniques to further examine the inventory reporting process, for example, classify by label code to check the label control system or by item serial number to check for the possibility of omissions or double counting during inventory counting.

B.3 Management's Accounting Estimates

(1) Use experts to make an independent estimate to compare with the Board of Directors' estimate;

(2) Interview individuals outside the Board of Directors and the accounting department to confirm the Board of Directors' ability and intention to implement plans related to accounting estimates.

C. Specific measures for handling errors resulting from misappropriation of assets.

Depending on the specific circumstances, auditors may apply different remedial measures. Generally, remedial measures for assessed risks of material misappropriation of assets will be focused on certain account balances and transaction types. While some of the measures outlined in parts A and B of this appendix may be applied to misappropriation of assets, the scope of work must remain linked to the specific information regarding the identified risks related to misappropriation of assets.

An example of audit procedures for an auditor's assessment of the risk of material misstatement due to misappropriation of assets is as follows:

(1) Inventory of cash or securities at or near the end of the accounting period;

(2) Direct confirmation with the audited entity's customers regarding transactions with the entity during the accounting period (including debt agreements, sales returns, payment dates);

(3) Analyze the recoverability of written-off debts;

(4) Analyze inventory shortages by location or by type of item;

(5) Compare the ratios related to inventory with other units in the same industry or with industry practices;

(6) Check the documents that serve as the basis for accounting reductions in the inventory accounting book recorded using the perpetual inventory method;

(7) Compare the list of suppliers with the list of employees to find duplicate addresses or contact phone numbers;

(8) Check payroll payment documents to find if the address or ID card number, tax code or account number of the employee is duplicated;

(9) Review personnel records that have little or no evidence of activity, for example, lack of performance evaluation records;

(10) Analyze sales discounts or sales returns to detect unusual situations;

(11) Confirm with the third party regarding special terms in the contract;

(12) Gather evidence that the contract has been performed in accordance with the terms of the contract;

(13) Review the reasonableness of large and unusual expenditures;

(14) Review the approval and value of large debts of Board members, Directors and related parties;

(15) Review the level and appropriateness of expenditures by the Board of Directors and the Management Board.

Appendix 03

(Guidance for paragraph A49 of this Standard)

EXAMPLES OF SITUATIONS SHOWING THE POTENTIAL FOR FRAUD

This appendix provides examples of situations that may indicate the possibility of material misstatement in financial reporting due to fraud.

A. Differences between reality and accounting records, including:

(1) Transactions that are not fully and timely recorded, or are recorded incorrectly in value, in the wrong accounting period, incorrectly classified, or not in accordance with the unit's policy;

(2) Account balances or transactions that are undocumented or unapproved;

(3) Adjusting entries at the end of the accounting period that have a material effect on the financial results;

(4) Evidence that unauthorized personnel have accessed the unit's accounting system or records;

(5) Disclosing or complaining to the auditor about allegations of fraud.

B. Contradictory or insufficient evidence, including:

(1) Lost accounting documents and records;

(2) There are documents that are likely to be distorted;

(3) Only provide documents in the form of copies or in electronic form (soft files) instead of providing the original;

(4) No explanation or unclear explanation for large discrepancies found during reconciliation;

(5) There are unusual changes in the Balance Sheet, changes in trends or significant changes in financial ratios or correlations in the financial statements, for example, accounts receivable growing faster than revenue;

(6) There is inconsistent or unclear feedback from the Board of Directors or staff regarding interview requests or analysis procedures;

(7) Unusual discrepancies between the entity's accounting records and third-party confirmations;

(8) There are many credit entries and many other adjusting entries in the accounts receivable ledger;

(9) Differences between the accounts receivable ledger and the balance summary, or differences between the customer's ledger and the audited entity's ledger are not explained or are inadequately explained;

(10) Cancelled checks that are lost or not sent back to the unit along with the bank statement (Credit, Debit);

(11) Inventory or assets lost in large quantities;

(12) Electronic evidence is missing or lost, inconsistent with the unit's data management practices or policies;

(13) The number of debt confirmation letters received was less or more than expected;

(14) It is not possible to provide evidence of key information system development or program change testing and related activities performed in the current year.

C. Unusual or problematic relationships between the auditor and the Board of Directors include:

(1) The Board of Directors refuses or restricts the auditor's access to records, documents, accounting books, facilities, certain employees, customers, suppliers or other individuals who may be able to help the auditor obtain audit evidence;

(2) The Board of Directors places unreasonable time pressure on the auditor to resolve complex or contentious issues;

(3) The Board of Directors complains about the performance of the audit or the Board of Directors threatens members of the audit team, especially in relation to the auditor's critical assessment of audit evidence or the resolution of potential disagreements with the Board of Directors;

(4) Unusual delays by the entity in providing documents and information as requested by the auditor;

(5) Not providing auditors with access to important electronic documents for examination using computer-assisted audit techniques;

(6) Denying auditors access to key IT personnel or IT equipment, including security, operations and system development personnel;

(7) Not willing to supplement or amend the financial statement notes to make the notes more complete and understandable;

(8) Unwillingness to promptly rectify identified deficiencies in internal control.

D. Other situations

(1) The Board of Directors is unwilling to agree to allow the auditor to work privately with the Board of Management;

(2) Accounting policies that differ from industry practices;

(3) Frequently changing accounting estimates without proper justification;

(4) The unit makes concessions to violations of professional ethics./.

*****