ISA 240 (Revised): which audits it covers and a six-gate transition plan

01When does ISA 240 (Revised) take effect, and which audits does it cover?

The IAASB published ISA 240 (Revised) on 8 July 2025. Paragraph 16 makes it effective for audits of financial statements for periods beginning on or after 15 December 2026. ISA 570 (Revised 2024) on going concern, published on 9 April 2025, takes effect from the same date.

The test is when the financial period begins. The date the audit report is signed does not move an audit into or out of scope. A December year-end audit of 2026, signed in the following spring, is still an audit of a period that began before the effective date. Check each engagement against its period start, not its reporting deadline.

02How does Malta define auditing standards, and who sets the date elsewhere?

The IAASB sets the international effective date. How a standard takes effect in each jurisdiction depends on that jurisdiction's own law or standard-setter. In Malta, the relevant definitions are in the Accountancy Profession (Accounting and Auditing Standards) Regulations (S.L. 281.02: Legal Notice 19 of 2009, as amended by Legal Notice 233 of 2016). Regulation 4 defines compliance with generally accepted auditing standards as adherence to international auditing standards. Regulation 2 defines those as the ISAs and related standards issued from time to time by the IAASB, insofar as they are relevant to the statutory audit.

For auditing standards, the regulation does not name individual ISAs or set dates of its own. Regulation 4 has two provisos. An ISA adopted by the EU under the Statutory Audit Directive on the same subject would apply instead. For small undertakings, the auditing standards are applied in proportion to the scale and complexity of their activities. Ask your technical owner to confirm which version applies to your Maltese engagements and from which period, and record the source and the date checked.

Some jurisdictions issue their own version. The UK's Financial Reporting Council published ISA (UK) 240 (Revised March 2026) on 30 April 2026, effective for periods beginning on or after 15 December 2026. If your firm audits under more than one national framework, record the applicable version and date for each one.

On early adoption, the IAASB encourages jurisdictions to consider adopting ISA 240 (Revised), ISA 570 (Revised 2024) and the narrow-scope amendments for publicly traded entities early, as one package. The standard's effective-date paragraph says nothing about firms applying it early. Whether you may do so depends on the framework that governs the engagement.

03What changes in ISA 240 (Revised)?

ISA 240 (Revised) applies to audits of financial statements of every kind of entity. It builds on ISA 315 (Revised 2019) and ISA 330 rather than standing apart from them. The IAASB fact sheet groups the changes into seven areas. The table follows them, with revenue and management override in a row of their own and key audit matters combined with documentation, and maps each row to the paragraphs that carry it and the part of your methodology it touches. Use the final standard for the requirements; the fact sheet and this table are orientation aids.

Fraud-related reporting is not the same for every entity. Where the auditor communicates key audit matters under ISA 701, as for listed entities, the standard adds requirements on fraud-related key audit matters (paragraphs 60 to 62). The IAASB's narrow-scope amendments, effective from the same date, move requirements written for listed entities to publicly traded entities, a definition aligned with the IESBA Code.

04How do you turn the changes into a methodology gap list?

Work from your current methodology, not from a blank page. For each row in the table above, record the existing step, the change needed, the template or system affected, who reviews the change and what evidence shows it is done. Start with one complete engagement path: planning discussion, inquiries, risk assessment, responses, communication and completion.

Mark the dependencies. The new requirement to understand the whistleblower programme changes the request list, the risk assessment form and the communication plan. If the request changes but the reviewer's checklist does not, the change will not hold. Keep requirements apart from tool features: testing every journal entry is something some tools offer, but paragraph 49 asks for evidence that the population is complete, period-end entries and a decision on testing throughout the period.

• The paragraph and requirement, taken from the final standard.
• Your current step and its template reference.
• The change, written as an instruction a preparer can follow.
• The templates, checklists and software settings affected.
• The owner, the reviewer and the evidence that the change is complete.
• The engagements and cohorts the change applies to.

05How should you prepare the engagement team?

Paragraph 23 asks the engagement partner to determine that the engagement team collectively has the competence, time and specialised skills to assess and respond to fraud risks. Training is part of the transition plan. Give preparers, managers and engagement partners role-specific instructions: where a concern is recorded, who can change its status, and what the next person needs to see.

Rehearse with a fictional case in which an explanation conflicts with another record. Ask the team to record the issue, preserve the information, escalate it and decide the next work under the updated methodology. Include a version in which the first explanation changes after review. The aim is to make responsibilities and communication visible, not to reward a quick label of fraud or no fraud. The auditor does not make legal determinations of whether fraud has occurred (paragraph 6).

Choose the training focus from your own quality findings. ICAEW's 2026 monitoring insights, published on 29 June 2026, listed revenue audit procedures under ISA 240 among the most common weaknesses in the UK files it reviewed: walkthroughs, independent evidence and covering every relevant assertion. That is a UK monitoring observation, but it is a sensible place to start in your own files.

06How do you change templates and software without losing evidence?

Many firms will update templates, checklists and audit software alongside the methodology. ICAEW's 2026 monitoring insights, published on 29 June 2026, treat technology change as a quality risk. The head of audit in its Quality Assurance Department stressed disciplined change management, including when a firm moves from one audit methodology to another, and noted that some of the smallest firms had lost or lacked original documentation after moving from paper files to audit software.

Test the template path and the evidence path together. Paragraph 68 asks the file to show the sources of the auditor's understanding, the rationale for significant judgements and the fraud-related matters communicated. In the pilot, check that the new templates capture each of those, and that a reviewer can follow them without asking the preparer to reconstruct them. If a document is replaced, the earlier version and any open question should stay available. Files planned under the extant standard must stay readable next to revised ones.

Where Vacei fits: on its audit portal, Vacei's AI, VEE, prepares materiality, the risk register and the audit programme for the auditor's approval. Every step VEE takes is recorded, and a qualified person reviews and signs. Vacei's outsourced audit support prepares the working papers in the firm's own methodology and templates, so an updated methodology has to reach the provider before the first in-scope file. None of this establishes compliance with ISA 240 (Revised). Whatever software or provider you use, your own pilot is what shows whether the changed path works.

07How do you run the transition gate by gate?

Use the planner to move through six gates: applicability, portfolio mapping, methodology, team readiness, pilot, and release with a first-cohort review. A gate passes only when every criterion is ticked, so an unfinished item shows up as the next action instead of disappearing into an average. Give each gate an owner.

Schedule backwards from the planning of your first in-scope cohort. In the worked example, that is the December cohort. The methodology, team and pilot gates need to close before those engagements are planned, with time left to resolve technical questions.

After the first in-scope engagements, review whether teams used the intended methodology and whether reviewers could follow the evidence. Record corrections and update the guidance. A completed planner does not establish compliance with ISA 240 (Revised), prove that fraud will be detected or decide an audit opinion.