AU-C 240 requires the auditor to ask specific fraud questions of management (paragraphs .17 and .18), of internal audit if the entity has an internal audit function (.19), and of those charged with governance (.20 and .21). The questions are risk assessment procedures. They are not optional and they are not satisfied by a line in the representation letter. This article lists what each paragraph requires and gives sample questions for each respondent.
Inquiry is only one input. The engagement team discussion, analytics and the review of fraud risk factors sit alongside it. See our guide to fraud risk assessment under AU-C 240 and the note on documenting the fraud brainstorming session.
What must the auditor ask management?
Paragraph .17 lists five inquiries:
- (a) management's assessment of the risk that the financial statements may be materially misstated due to fraud, including the nature, extent and frequency of the assessments
- (b) management's process for identifying, responding to and monitoring fraud risks, including specific risks identified or brought to its attention, and classes of transactions, balances or disclosures where fraud risk is likely
- (c) management's communication, if any, to those charged with governance about those processes
- (d) management's communication, if any, to employees about business practices and ethical behavior
- (e) whether the entity has entered into any significant unusual transactions and, if so, their nature, terms and business purpose (or lack of one), and whether they involved related parties
Paragraph .18 adds inquiry of management, and of others within the entity as appropriate, about whether they know of any actual, suspected or alleged fraud affecting the entity.
Sample questions for management
- How often do you assess the risk that the financial statements could be misstated due to fraud? Who does it and how is it written down? (.17a; A14 notes that no assessment at all can indicate how little importance management places on internal control)
- Which revenue streams, accounts or locations do you consider most exposed to fraud? (.17b; A16 for multiple locations)
- What have you done about the fraud risks you named, and how do you monitor them? (.17b)
- What do you tell the board or owners about fraud risk, and when? (.17c)
- How do you tell staff what is acceptable? Is there a code of conduct, a hotline or an annual acknowledgment? (.17d)
- Were there any transactions this year outside the normal course of business, or unusual in timing, size or nature? Who was the counterparty, and why was the entity doing it? (.17e)
- Do you know of any actual, suspected or alleged fraud, theft or manipulation of results, this year or earlier? Has anyone raised a concern? (.18)
- Did anyone ask you to change a number, delay an entry or support a particular result? (.18)
For small entities, A15 observes that management's focus may be on employee fraud and misappropriation of assets. Ask about cash handling, who signs checks and who reconciles accounts, and then also ask the owner-manager the management-fraud questions.
What must the auditor ask internal audit?
Paragraph .19 requires inquiry of appropriate individuals in the internal audit function about:
- their views about the risks of fraud
- whether they know of any actual, suspected or alleged fraud
- whether they performed procedures during the year to identify or detect fraud
- whether management responded satisfactorily to findings from those procedures
- whether they are aware of significant unusual transactions
Sample questions for internal audit
- Which areas did you consider highest risk for fraud this year? What drove that view?
- Did any audit, hotline report or investigation involve suspected fraud? Where does each stand?
- What fraud-detection procedures did you run (vendor and employee matching, duplicate payment tests, journal entry analytics)?
- For each finding, what did management do and by when?
- Are you aware of unusual transactions, side letters or entries made at management's direction?
What must the auditor ask those charged with governance?
Unless all of those charged with governance are involved in managing the entity, paragraph .20 requires an understanding of how they oversee management's fraud risk processes and controls, and paragraph .21 requires inquiry of those charged with governance (or the audit committee or, at least, its chair) about their views of fraud risks, their knowledge of actual, suspected or alleged fraud, and whether the entity entered into significant unusual transactions. The paragraph states the purpose: these inquiries are made in part to corroborate management's responses.
Where a single owner manages the entity and no one else has a governance role, A23 says ordinarily no action exists for the auditor, because there is no oversight separate from management.
Sample questions for the audit committee chair or board
- How does the board oversee management's identification and handling of fraud risk? What does it receive and how often?
- Does the board or committee receive tips or complaints? What were the most recent ones and how were they resolved?
- Do you know of any actual, suspected or alleged fraud?
- Which transactions this year did you review or approve that fell outside ordinary operations?
- Do you have any concerns about management's selection of accounting policies or about pressure on results?
- Is there anything you want the auditor to look at?
Meet the committee or its chair privately. Appendix C (A78) lists management's unwillingness to permit the auditor to meet privately with those charged with governance as a circumstance that may indicate the possibility of fraud. The communication side is covered in our guide to AU-C 260 required communications.
Whom else should you ask?
Paragraph A19 lists operating personnel outside financial reporting, employees at different levels of authority, those who initiate, process or record complex or unusual transactions and their supervisors, in-house legal counsel, a chief ethics officer or equivalent, and the person charged with dealing with allegations of fraud. A18 explains why: inquiries of management are unlikely to reveal management fraud, while others may give a different perspective and may corroborate management's answers or point to override of controls.
A short, identical question to several people is more useful than a long interview with one: "Have you seen or heard of anything that did not look right in how results were reported this year?"
How should the inquiries be run and documented?
- Format. A17 says inquiries are most effective in person, and the auditor may give the interviewee the questions in advance and take written answers.
- Record. Note the date, the respondent's name and role, who was present, the questions asked and the answers. Keep the respondent's words where an answer is specific.
- Link. Connect each answer to a risk assessment conclusion: a risk identified, a risk assessed as lower, or no change.
What if the answers conflict or are vague?
Paragraph .14 requires the auditor to investigate further when responses to inquiries of management, those charged with governance or others are inconsistent or otherwise unsatisfactory, for example vague or implausible. Paragraph A20 adds that management can be in the best position to perpetrate fraud, so the auditor may judge it necessary to corroborate responses with other information.
A conflict is a finding to resolve, not a note to carry. If management says no unusual transactions occurred and the board minutes approve a large asset sale, trace the sale. If the controller says no entries were changed after close and the system shows post-closing postings, test them under the top-side and post-closing entries procedure. Inconsistent, vague or implausible responses and denial of access to key IT staff are among the circumstances in Appendix C that may indicate fraud.
Frequently asked questions
Do the inquiries have to be in person?
No. A17 says in-person discussion is most effective. Written responses to prepared questions are also permitted.
Does a written representation replace the inquiries?
No. Representations are evidence at the end of the audit. The inquiries are risk assessment procedures that feed the planning. See management representation letters.
Is there an equivalent in PCAOB standards?
Yes. AS 2110 paragraphs .54 to .58 require inquiries of the audit committee or equivalent, management, internal audit and others, and paragraph .58 requires evidence to address inconsistencies in responses.
Sources
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit, paragraphs .14, .17 to .21 and application material A14 to A20, A23 and A78: https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- PCAOB, AS 2110, Identifying and Assessing Risks of Material Misstatement, paragraphs .54 to .58: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2110
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error