Most fraud risks depend on the client. Management override does not. The standard treats it as a risk present in every entity, because the people who run the controls can also step around them. That is why a small, well-run, friendly client still gets journal entry testing.
Last reviewed: 17 October 2026. Facts checked. We opened web search results on ISA 240, including an ICAI newsletter extract and ICAEW and CPA Canada commentary. These confirm the requirement to test the appropriateness of journal entries and other adjustments irrespective of assessed risk, and inquiries about unusual activity in processing them. They did not return the exact wording of the estimates and significant unusual transactions responses, which we describe from general knowledge of the standard; confirm the wording and paragraph numbers in the ICAI text of SA 240 before quoting. The example is invented.
The idea behind the presumption
An auditor assesses fraud risk entity by entity: incentives, opportunities, attitudes. Those assessments vary. But SA 240, in line with the international standard, says the risk of management override exists in every entity because of management's position: management can manipulate records and prepare fraudulent statements by overriding controls that otherwise look effective.
Two consequences follow. First, the risk is treated as a significant risk of fraud, which means the response cannot be skipped because internal controls look good. Second, the response consists of specified procedures that apply "irrespective of the assessed risks". Trust in management does not remove them.
The three standard responses
The standard sets out three areas. We describe them in plain language.
1. Journal entries and other adjustments
Test whether entries in the ledger and adjustments made in preparing the financial statements are appropriate. The procedures include inquiring of people involved in financial reporting about inappropriate or unusual activity in processing journals, selecting entries to test, and considering whether to test entries throughout the period and not only at year end. Commentary on the UK version notes selection of entries made at period end and, in that version, post-closing entries.
How to do it well:
- Prove the population is complete first; see reconciling a journal export to the trial balance.
- Use risk indicators such as manual postings, unusual accounts, round amounts and timing; see journal entry testing procedures and red flags.
- Treat post-closing and top-side entries as their own group; see post-closing and top-side adjustments.
2. Accounting estimates
The standard directs the auditor to review accounting estimates for bias and to evaluate whether the circumstances producing the bias, if any, represent a risk of material misstatement due to fraud. It also asks for a look back at the prior year's significant estimates in light of what actually happened.
How this works in a typical Indian audit:
- List the judgemental areas: provision for expected credit losses, inventory obsolescence, useful lives, impairment, deferred tax asset recognition, provisions for litigation and warranty, fair value of unquoted investments, revenue recognised over time.
- For each, record the prior-year estimate, the actual outcome and the direction of the difference. One favourable surprise is noise. Several, all in the same direction, is a pattern.
- Look at the cumulative effect. Each estimate may sit within a reasonable range while the combined effect pushes profit upward.
- Challenge the inputs, not just the arithmetic: where did the growth rate come from, and who approved it?
3. Significant transactions outside the normal course
For significant transactions that are outside the entity's normal course of business, or appear unusual given the auditor's understanding, the standard asks the auditor to evaluate whether the business rationale suggests they were entered into to misstate the statements or hide misappropriation.
Typical candidates: large transactions with related parties, round-tripping between group entities, complex financing that changes classification, a sale near year end with generous return terms, asset swaps, a sudden new customer with outsized orders.
Questions to ask:
- Who proposed the transaction and why now?
- Is the structure more complicated than the stated purpose needs?
- Did the board or audit committee approve it, and did the minutes record the reasoning?
- Is the substance as described, as seen in contracts, emails, confirmations and cash?
- Does it help reach a target or covenant?
Related party deals have their own standard; see our post on SA 550 procedures with a worked example.
Beyond the three: the attitude
Procedures matter, but so does the posture the standard calls professional scepticism. In practice this means:
- Do not accept the first explanation. Ask for the document.
- Keep the engagement team talking. The standard expects a discussion among team members about where the statements might be susceptible to fraud. Make it specific to the client, not generic.
- Vary the audit. Include some element of unpredictability in the selection of entries, locations or procedures.
- Notice who is helping you. Unusual eagerness to select your samples for you, or reluctance to give system access, is information.
A worked example (invented)
A company's profit is just above a loan covenant. The auditor's review of estimates finds that the expected credit loss rate was cut from the prior year with no change in the ageing profile, that the useful life of plant was extended for two machines, and that a deferred tax asset was recognised on losses previously unrecognised. Each judgement can be defended in isolation.
Combined, all three increase profit and the covenant headroom. The auditor documents the cumulative effect, asks for the evidence behind each change, and compares the previous year's estimates with outcomes. If the support is thin, the auditor considers a proposed adjustment and the implications for the audit opinion. The company and figures are invented.
Documentation
The file should show the fraud risk discussion, the identification of override as a risk, the specific journal entry tests with population completeness, the estimates review with the look-back, the unusual transactions considered and what was concluded. Where evidence is missing, the file should show the consequence for the conclusion, not just the gap.
The takeaway
Override is presumed because the people who build the controls can also bypass them. The three responses are not optional extras. Do them on every audit, make them specific, and let the evidence, not the relationship, decide the conclusion.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error