Documenting the Fraud Brainstorming Session: What the File Must Show

The fraud brainstorming meeting is easy to hold and easy to document badly. A reviewer opening the file wants to know four things: who was in the room, when it happened, what was discussed, and what the team did differently because of it. A memo that says "the team discussed fraud risk; no unusual risks noted" answers none of them.

The mechanics of running the session are in fraud risk assessment under AU-C 240. This post covers the file.

What the standards require you to record

For audits of public companies, the PCAOB's fraud standard lists exactly what the auditor documents. AS 2401.83 requires documentation of:

• the planning discussion among engagement personnel about the susceptibility of the financial statements to material misstatement due to fraud, including how and when it occurred, the team members who participated and the subject matter discussed;
• the procedures performed to obtain the information needed to identify and assess fraud risks;
• the fraud risks identified at the financial statement and assertion levels, and the linkage of those risks to the auditor's response;
• if improper revenue recognition was not identified as a fraud risk, the reasons supporting that conclusion;
• the results of procedures performed to address assessed fraud risks, including those that further address management override of controls;
• other conditions that led the auditor to perform additional procedures; and
• the nature of communications about fraud made to management, the audit committee and others.

For nonissuer audits, AU-C 240 requires the engagement partner and key team members to discuss how the financial statements could be materially misstated due to fraud. The Journal of Accountancy's description of that discussion lists how management could commit and conceal fraudulent financial reporting, how assets could be misappropriated, what incentives or pressures could lead to fraud, and the risk of management override of controls.

The PCAOB list is a good template for an AU-C file even though it is not an AU-C requirement. It is specific, and a file that meets it also supports the AU-C documentation you owe.

What changes under SAS 151

The AICPA's Auditing Standards Board approved SAS No. 151 in August 2026. It supersedes AU-C 240 for audits of financial statements for periods ending on or after December 15, 2028, with earlier adoption permitted. Two changes bear on the file. Revenue stays a presumed fraud risk, but the auditor must determine which types of revenue transactions or relevant assertions give rise to that risk. And the auditor must understand the entity's whistleblower or other fraud-reporting program, if it has one, including how management and those charged with governance address allegations of fraud.

A file built now on the PCAOB list is a sound base. Add two lines to it: the revenue types or assertions that give rise to the presumed fraud risk, and the entity's fraud-reporting program, covering who receives reports and how allegations were handled in the period.

Participants and timing

The PCAOB standard defines key members as everyone with significant engagement responsibilities, including the partner, and requires that important matters from the discussion reach team members who did not attend (AS 2110.50). Where an audit has several locations, there can be several discussions. Your record should therefore show:

• date, duration and format of each session;
• attendees by name and role, including any specialist;
• how the matters were communicated to staff who were absent, and when;
• whether a second session was held near the end of fieldwork. Forensic practitioners quoted in the Journal of Accountancy recommend brainstorming throughout the audit with a closing "bookend" session, and the PCAOB standard has the engagement partner determine whether communication about fraud-risk conditions has been appropriate, noting that another team discussion might be arranged (AS 2810.29).

Content: show the thinking

AS 2110.52 says the discussion occurs with a questioning mind and sets aside prior beliefs that management is honest. It lists topics: how and where the financial statements might be susceptible to fraud, how management could perpetrate and conceal fraudulent reporting, how assets could be misappropriated, susceptibility through related party transactions, omission of or inaccurate disclosures, management bias in estimates, and the internal and external factors that create incentive, pressure or opportunity.

Record the substance under each heading. The strongest files show ideas that were raised and rejected, and why.

The linkage table

The most useful workpaper is a table that carries each fraud risk from the discussion to the procedure and the result.

Illustrative figures. A reviewer can read across every row and see that no identified risk was left without a procedure.

Mistakes reviewers find

• Copy-forward. The same participants, topics and conclusions as last year, with only the date changed.
• Attendance without content. A signature list and no discussion record.
• No linkage. Fraud risks identified in the memo that do not appear in the audit program.
• Revenue presumption dropped without a reason. The standard requires reasons if revenue is not treated as a fraud risk.
• No record of the partner's role. The partner takes part in the discussion; the file should show it.
• Skepticism asserted, not shown. Write what the team challenged.

Practical notes for small firms

On a small audit with a two-person team, the discussion can be thirty minutes and one page. The PCAOB standard allows for it: if the audit is performed entirely by the engagement partner, the partner is responsible for evaluating susceptibility to misstatement personally (AS 2110.50, note). Keep it short but specific. Carry the risks into the audit program, and refer to them in the review notes at the end.

FAQ

Is the brainstorming session required on every audit?

Yes. AU-C 240 requires the discussion, and the PCAOB standard requires it for issuer audits.

Can the fraud discussion be combined with the risk assessment discussion?

Yes. The PCAOB standard permits it as part of the broader risk discussion or separately. Cover and document the fraud elements either way.

When does SAS 151 apply?

To audits of financial statements for periods ending on or after December 15, 2028, with earlier adoption permitted.

Sources

• PCAOB, AS 2401, Consideration of Fraud in a Financial Statement Audit (paragraph .83), and AS 2110, Identifying and Assessing Risks of Material Misstatement (paragraphs .49-.53), in the PCAOB auditing standards for audits after December 15, 2024
• PCAOB, AS 2810, Evaluating Audit Results (paragraph .29), same document
• AICPA, New auditing standard clarifies and enhances CPAs' responsibilities relating to fraud in a financial statement audit (August 2026)
• AICPA, SAS 151: Clarifying and enhancing auditor responsibilities relating to fraud
• Journal of Accountancy, How auditors can apply a forensic-like approach to fraud (June 2024)

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error