Act 2006, the Charities Act 2011 together with the Charities SORP (FRS 102). We assessed the required compliance with these laws and regulations as part of our audit procedures on the related financial statement items. In addition, we considered provisions of other laws and regulations that do not have a direct effect on the financial statements but compliance with which might be fundamental to the charitable company’s and the group’s ability to operate or to avoid a material penalty. We also considered the opportunities and incentives that may exist within the charitable company and the group for fraud. The laws and regulations we considered in this context for the UK operations were General Data Protection Regulation (GDPR) and Employment legislation. Auditing standards limit the required audit procedures to identify non-compliance with these laws and regulations to enquiry of the trustees and other management and inspection of regulatory and legal correspondence, if any. We identified the greatest risk of material impact on the financial statements from irregularities, including fraud, to be within the timing of recognition of income and the override of controls by management. Our audit procedures to respond to these risks included enquiries of management, internal audit, legal counsel and the audit and risk committee about their own identification and assessment of the risks of irregularities, sample testing on the posting of journals, reviewing accounting estimates for biases, reviewing regulatory correspondence with the Charity Commission and reading minutes of meetings of those charged with governance. Owing to the inherent limitations of an audit, there is an unavoidable risk that we may not have detected some material mis-statements in the financial statements, even though we have properly planned and performed our audit in accordance with auditing standards. For example, the further removed non-compliance with laws and regulations (irregularities) is from the events and transactions reflected in the financial statements, the less likely the inherently limited procedures required by auditing standards would identify it. In addition, as with any audit, there remained a higher risk of non-detection of irregularities, as these may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal controls. We are not responsible for preventing non-compliance and cannot be expected to detect non-compliance with all laws and regulations. 72 Independent auditor’s report