Fraud Risk Assessment Under AU-C 240: Brainstorming, Fraud Risk Factors, Presumed Risks and Responses

Every audit carries some risk that the financial statements are misstated because someone intended them to be. AU-C 240, Consideration of Fraud in a Financial Statement Audit sets out how the auditor identifies and responds to that risk in a nonissuer audit. It works alongside the risk assessment requirements of AU-C 315, as revised by SAS No. 145, but adds specific steps: a team discussion focused on fraud, targeted inquiries, a presumed risk in revenue recognition, a risk of management override, and a set of procedures performed on every audit regardless of the assessed risk.

The auditor is not a fraud examiner, and an audit is not designed to detect all fraud. But AU-C 240 requires professional skepticism throughout, recognizing that a material misstatement due to fraud could exist despite the auditor's past experience with the honesty and integrity of management. This guide walks through the process and the documentation. It paraphrases AU-C 240.

A replacement standard is on the way. In August 2026 the ASB approved SAS No. 151, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, which supersedes AU-C 240. It is effective for audits of periods ending on or after December 15, 2028, with early implementation permitted. It keeps the definition of fraud, the audit objective and the presumed fraud risk in revenue recognition, and enhances requirements on skepticism, fraud risk assessment (including understanding any program for reporting fraud), responses to identified or suspected fraud, communication and documentation. This guide describes AU-C 240 as it applies until then; firms adopting early should work from the new standard.

Two types of fraud the auditor considers

AU-C 240 focuses on intentional acts that cause a material misstatement of the financial statements. Two types are relevant:

Fraudulent financial reporting is usually committed by management, often through override of controls. Misappropriation is more often committed by employees in small amounts, though it can be material in a small entity with weak segregation of duties.

The fraud triangle and fraud risk factors

AU-C 240 groups fraud risk factors into three conditions, commonly called the fraud triangle. Fraud risk factors are events or conditions that indicate an incentive or pressure to commit fraud, an opportunity to do so, or an attitude or rationalization that justifies it. Their presence does not mean fraud exists, but they are often present when it does.

Incentives and pressures

• Financial stability or profitability threatened by economic, industry or operating conditions, such as declining margins or recurring operating losses
• Excessive pressure on management to meet the requirements or expectations of third parties: debt covenants, lender targets, buyers in a pending sale, or investors expecting earnings
• Management or owners' personal finances tied to the entity's results, such as bonuses or earn-outs based on earnings, or personal guarantees of entity debt
• For misappropriation: personal financial obligations of employees with access to cash or assets, or adverse relationships between the entity and employees, such as expected layoffs

Opportunities

• Significant related party transactions not in the ordinary course of business, or with related entities that are unaudited or audited by another firm
• Significant estimates involving subjective judgments that are difficult to corroborate
• Significant, unusual or highly complex transactions, especially close to period end
• Ineffective monitoring of management, such as domination by a single person or small group without compensating controls, or ineffective oversight by those charged with governance
• Deficient internal control, including weak segregation of duties over cash, purchasing or payroll
• For misappropriation: large amounts of cash on hand, small high-value inventory, easily convertible assets, and inadequate record keeping

Attitudes and rationalizations

• Ineffective communication or enforcement of the entity's values or ethical standards by management
• Nonfinancial management's excessive participation in the selection of accounting policies or significant estimates
• Known history of violations of securities or other laws, or claims of fraud
• Management's excessive interest in maintaining or increasing the stock price or earnings trend
• Recurring attempts to justify marginal or inappropriate accounting on the basis of materiality

The engagement team discussion

AU-C 240 requires a discussion among key engagement team members, including the engagement partner, about how and where the entity's financial statements might be susceptible to material misstatement due to fraud, including how fraud might occur. The discussion is often called fraud brainstorming. It can be combined with the broader risk discussion required by AU-C 315, but the fraud elements must be covered and documented.

The discussion should cover, paraphrased:

• how management could perpetrate and conceal fraudulent financial reporting, and how assets could be misappropriated
• known external and internal factors that might create incentives, pressures or opportunities for fraud
• the risk of management override of controls
• how the auditor might respond, including adding unpredictability to the nature, timing and extent of procedures
• setting aside any belief that management and those charged with governance are honest
• the importance of maintaining professional skepticism throughout the audit

Running a useful brainstorming session

A fraud discussion that only reads a checklist aloud adds little. Practical points:

• Bring the facts. Preliminary analytics, the prior-year summary of misstatements, covenant calculations, organization chart and key-person changes.
• Ask "how would you do it?" For each significant account, ask the team how someone in a particular role could misstate it and hide it.
• Include the staff. Juniors who did the cash and expense testing last year often know where the weak spots are.
• Record specifics. "Revenue recognition presumed risk" is a label. "Sales manager can issue credit memos after year end without approval, and commissions are paid on gross sales" is a risk you can design a test for.

Inquiries and other risk assessment procedures

AU-C 240 requires inquiries of management, and of others within the entity as appropriate, about:

• management's assessment of the risk that the financial statements may be materially misstated due to fraud
• management's process for identifying and responding to fraud risks, including specific risks identified
• management's communication with those charged with governance and with employees about fraud risks and ethical behavior
• knowledge of any actual, suspected or alleged fraud affecting the entity

Inquiries of those charged with governance, of internal audit if one exists, and of other appropriate personnel, such as operations staff, in-house counsel or employees involved in unusual transactions, can produce information management did not volunteer.

The auditor also considers:

• unusual or unexpected relationships identified in analytical procedures, including those related to revenue
• whether other information, such as client acceptance evaluations or prior-year findings, indicates fraud risk factors
• the results of the AU-C 315 risk assessment, including the evaluation of the control environment

Revenue recognition and management override

Revenue recognition

AU-C 240 requires the auditor, based on a presumption that there are risks of fraud in revenue recognition, to evaluate which types of revenue, revenue transactions or assertions give rise to such risks. The presumption can be rebutted, but only with a documented reason. An example where rebuttal may be reasonable is a single, simple revenue stream, such as rental income from one long-term lease of a single property.

In many audits the presumption stands, and the work is to make it specific. Under ASC 606, common fraud risks include:

• fictitious sales or customers, particularly near year end
• shipments held at a warehouse under bill-and-hold arrangements without substance
• side agreements that change terms, such as rights of return or extended payment
• improper cutoff, recording next-period sales in the current period
• manipulation of estimates of variable consideration or percentage of completion

If the auditor concludes the presumption does not apply, the reasons must be documented.

Management override of controls

Management is in a unique position to commit fraud by overriding controls that otherwise appear to operate effectively. AU-C 240 treats this risk as present in all entities. Unlike the revenue presumption, it is not rebuttable. Regardless of the assessed risk of management override, the auditor must perform procedures to:

1. Test the appropriateness of journal entries and other adjustments recorded in the general ledger and made in preparing the financial statements. See journal entry testing for criteria and population checks.
2. Review accounting estimates for biases that could result in material misstatement due to fraud, including a retrospective review of management's judgments and assumptions related to significant prior-year estimates.
3. Evaluate the business rationale of significant unusual transactions, those outside the normal course of business or otherwise unusual given the auditor's understanding of the entity, and whether the rationale suggests they may have been entered into to engage in fraudulent financial reporting or conceal misappropriation.

These three procedures are required on every audit, including small ones.

Responding to assessed fraud risks

Fraud risks are treated as significant risks. The response operates at two levels.

Overall responses

• assigning personnel with knowledge, skill and ability commensurate with the assessed risks, and more supervision
• evaluating whether management's selection and application of accounting policies, particularly those involving subjective measurements and complex transactions, may indicate fraudulent financial reporting
• incorporating an element of unpredictability in the selection of the nature, timing and extent of audit procedures

Assertion-level responses

Tailor the procedures to the specific risk. Examples:

Unpredictability can be simple: testing an account below performance materiality, changing the timing of a procedure, visiting a location without notice, or selecting items in a different way from last year.

Use the audit risk assessment worksheet to link each fraud risk to the assertion it affects and the planned response.

Evaluating evidence and misstatements

At the end of the audit, AU-C 240 requires the auditor to evaluate whether analytical procedures performed near the end of the audit indicate a previously unrecognized risk of fraud.

When a misstatement is identified, the auditor evaluates whether it may indicate fraud. If it might, the auditor evaluates the implications for other aspects of the audit, particularly the reliability of management's representations, recognizing that an instance of fraud is unlikely to be isolated. A misstatement involving senior management, whatever the amount, calls for reconsidering the assessed risks and the evidence already obtained. See AU-C 450 on evaluating misstatements.

Communications

If the auditor has identified a fraud, or obtained information indicating that a fraud may exist, AU-C 240 requires communication to the appropriate level of management on a timely basis. Fraud involving senior management, fraud involving employees with significant roles in internal control, and fraud by others that causes a material misstatement are communicated to those charged with governance. The auditor also considers whether there is a responsibility to report to a party outside the entity, which may arise from law, regulation, a successor auditor inquiry or a government audit requirement; seek legal advice where appropriate.

What to document

AU-C 240 requires documentation of, paraphrased:

• the engagement team discussion: how and when it occurred, who participated and the subject matter discussed
• the procedures performed to obtain information to identify and assess fraud risks
• the specific risks of material misstatement due to fraud identified, at the financial statement and assertion levels
• if the revenue recognition presumption was rebutted, the reasons
• the overall and assertion-level responses, and the results of the procedures, including those addressing management override
• communications about fraud to management, those charged with governance, regulators and others

These sit within the overall risk assessment under AU-C 315. See SAS 145 risk assessment for the broader framework and audit working papers for how firms organize the file.

Frequently asked questions

What are the three fraud risk factors in AU-C 240?

AU-C 240 groups fraud risk factors into three conditions: incentives or pressures to commit fraud, opportunities to commit it, and attitudes or rationalizations that justify it. These are often called the fraud triangle.

Can the auditor rebut the presumed fraud risk in revenue recognition?

Yes, but only with a documented reason. The presumption may be rebutted in limited cases, such as a single simple revenue stream, while the risk of management override cannot be rebutted.

What procedures are required for management override of controls?

On every audit, the auditor tests journal entries and other adjustments, reviews accounting estimates for bias including a retrospective review, and evaluates the business rationale of significant unusual transactions.

Is fraud brainstorming required on small audits?

Yes. AU-C 240 requires a discussion among key engagement team members on every audit. On a very small engagement it may involve only the partner and one staff member, but it must take place and be documented.

Is the auditor responsible for detecting fraud?

The auditor is responsible for obtaining reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by fraud or error. Because fraud involves concealment, there is an unavoidable risk that some material misstatements due to fraud will not be detected.

Sources

• AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (including Appendix A, Examples of Fraud Risk Factors)
• AICPA, SAS No. 151, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements (approved August 2026; effective for audits of financial statements for periods ending on or after December 15, 2028, early implementation permitted)
• Journal of Accountancy, ASB approves standard on auditors' responsibilities relating to fraud (August 2026): https://www.journalofaccountancy.com/news/2026/aug/asb-approves-standard-on-auditors-responsibilities-relating-to-fraud/
• AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (as revised by SAS No. 145)
• AICPA, AU-C Section 450, Evaluation of Misstatements Identified During the Audit
• FASB ASC 606, Revenue from Contracts with Customers

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error