UK Financial Reporting Council Revises Audit Standards on Legal & Regulatory Compliance

A new wave of professionals is transforming Governance, Risk, and Compliance from a rigid framework into a dynamic force for trust, innovation, and resilience. Governance, Risk, and Compliance (GRC) has long been associated with boardrooms and bureaucracy—a domain reserved for executives and auditors. But that image is changing fast.

The UK's Financial Reporting Council has revised two auditing standards governing how auditors consider possible breaches of laws and regulations, replacing a more procedural approach with one that places greater weight on the risks identified during an audit.

The revisions, published October 29, concern ISA (UK) 250, which addresses the consideration of laws and regulations in financial statement audits, and ISA (UK) 270, which covers communication and reporting to authorities outside public interest entities.

Both standards were the subject of a consultation earlier this year. The FRC subsequently expanded the accompanying guidance after stakeholders raised questions about implementation, including the risk that firms might interpret the requirements inconsistently or apply them more extensively than intended.

The changes concern an established difficulty in financial statement auditing. A breach of law does not necessarily produce a material misstatement, but some breaches can have financial consequences that auditors must consider. Determining which risks warrant further attention requires an understanding of the company, the applicable legal requirements and the potential effects on its accounts.

The FRC wants that work more closely connected to the risk assessment process auditors already follow. The revised standards are intended to improve their interaction with ISA (UK) 315, which governs the identification and assessment of risks of material misstatement.

According to the regulator, the new approach should be more scalable than the existing procedural standards, giving auditors greater scope to exercise professional judgment rather than follow requirements in a checklist fashion.

The revisions also account for developments in UK legislation, including the Economic Crime and Corporate Transparency Act 2023, which the FRC specifically identified in its announcement.

Consultation Prompts Changes to Guidance

The FRC's spring consultation produced feedback about the practical application of the proposed standards. In response, the regulator strengthened the application material throughout both documents, seeking to clarify how auditors should interpret the requirements across different engagements.

The additional guidance emphasizes proportionality and scalability, two considerations the FRC regards as important to the revised approach. Its stated aim is to reduce inconsistent interpretation and the possibility of over-implementation. The regulator has also published a separate document addressing common questions and concerns raised during the consultation.

Although the standards are being revised together, they address different responsibilities. ISA (UK) 250 concerns the auditor's consideration of laws and regulations when auditing financial statements. ISA (UK) 270 deals specifically with communication and reporting to an appropriate authority outside the entity in audits of public interest entities.

The FRC intends the revisions to improve how those responsibilities operate alongside the wider audit risk assessment framework.

The revised standards will apply to audits of financial statements for periods beginning on or after December 15, 2027. The FRC said it will continue working with stakeholders before that date to support consistent and proportionate implementation.