Revenue is usually the largest number in the income statement, often the materiality benchmark, and the area where AU-C 240 presumes a risk of fraud. It is also an area where an audit program rolled forward from the pre-ASC 606 era, without tailoring to the client's contracts, may not address the risks.
This post is a procedures playbook. It assumes you know the five-step model; if you need the accounting, start with ASC 606 revenue recognition for private companies. Here the focus is on what to do in the file: from risk assessment through contract testing, analytics, gross vs net, estimates and documentation.
Start with the presumed fraud risk
AU-C 240 requires the auditor, when identifying and assessing the risks of material misstatement due to fraud, to presume that there are risks of fraud in revenue recognition and to evaluate which types of revenue, revenue transactions or assertions give rise to them. The presumption can be rebutted, but the auditor must document the reasons if it concludes that revenue recognition is not a fraud risk in the circumstances of the engagement.
A rebuttal, if made at all, should be narrow and well supported. A more useful approach is to locate the risk precisely: which stream, which assertion and which mechanism. Examples:
- Occurrence of revenue near year end at a company with bonus targets or covenant thresholds based on revenue or EBITDA.
- Cutoff of shipments at a distributor with quarterly sales pushes.
- Accuracy and valuation of variable consideration, such as rebates or price concessions, where management judgment drives the number.
- Presentation of revenue gross rather than net, where the incentive is to show a larger top line.
A fraud risk is a significant risk, so it requires procedures specifically responsive to it, and when the response is substantive procedures alone, AU-C 330 requires tests of details, so substantive analytical procedures alone are not enough. Journal entry testing addresses management override separately; see journal entry testing and fraud risk assessment.
Understand the revenue streams
Before any testing, document each revenue stream: what is sold, to whom, under what terms, through which system, and how it flows to the general ledger. For each stream, record:
- the typical contract (master agreement, purchase order, online terms, statement of work)
- the performance obligations and whether they are satisfied at a point in time or over time
- the pricing terms, discounts, rebates, rights of return and payment terms
- the systems involved and the reports you will use as populations
- the relevant controls, even if you do not plan to test them
This understanding is required under AU-C 315 as revised by SAS 145, and it drives everything that follows. Walk one transaction of each stream from order to cash.
Get and validate the population
Revenue testing is only as good as the population it draws from. Obtain a detailed sales listing (by invoice, shipment or contract) and:
- foot it and agree the total to the general ledger revenue accounts
- reconcile differences, such as manual entries, accruals and deferred revenue adjustments
- test the report's completeness and accuracy if it is system-generated, by tracing a few items from source documents to the report and from the report back to source
Manual revenue entries outside the subledger deserve their own look. They are often where unusual transactions sit.
Contract review
For material contracts and a sample of routine ones, read the contract and evaluate the client's accounting against ASC 606:
- Contract existence: is there an enforceable agreement with commercial substance and probable collection?
- Performance obligations: are distinct goods or services identified correctly, including implied promises such as installation, training or free support?
- Transaction price: are variable amounts, financing components and noncash consideration identified?
- Allocation: is the price allocated on relative standalone selling prices, and how were those prices estimated?
- Timing: is the point in time or over-time conclusion supported, and for over-time revenue, is the progress measure reasonable?
Look for side letters, extended payment terms, unusual acceptance clauses and contract modifications near year end. Ask sales personnel, not just accounting, about nonstandard terms.
Substantive analytical procedures
AU-C 520 allows substantive analytical procedures to provide audit evidence when the relationship is plausible and predictable. Revenue often lends itself to them, especially for high-volume, low-value streams. Under AU-C 520 the auditor is required to:
- evaluate the reliability of the data used to develop the expectation
- develop an expectation precise enough to identify a misstatement that could be material
- determine the amount of difference from the expectation that is acceptable without further investigation
- investigate differences above that threshold, through inquiry and corroborating evidence
Useful expectations include units sold times average price, occupancy times rate, headcount times billing rate, and monthly revenue against shipping data or cash receipts. A trend comparison against last year is useful for risk assessment but rarely precise enough to be a substantive test by itself. See substantive testing vs tests of controls.
Tests of details
Occurrence
Select from the recorded revenue population and vouch to evidence that the performance obligation was satisfied: shipping documents, proof of delivery, customer acceptance, time records or service logs, plus the contract or order and subsequent cash receipt. Size samples under AU-C 530; the sample size calculator and monetary unit sampling calculator help.
Completeness
Select from source documents (shipping logs, signed contracts, service tickets) and trace to recorded revenue. Completeness is rarely the fraud risk for revenue, but it matters for entities with incentives to defer income, such as some owner-managed companies.
Cutoff
Test transactions on both sides of year end to confirm they are recorded in the right period, based on when control transferred, not when the invoice was printed. Pay attention to shipping terms, bill-and-hold arrangements and consignment. See cutoff testing for the detailed procedure.
Confirmations
Confirming receivable balances or contract terms with customers provides evidence on occurrence and on terms that might not be in the file, such as side agreements. Positive confirmations of significant contract terms can be more useful than balance confirmations where side letters are a risk. See audit confirmations.
Credit memos and returns after year end
Review credit memos, returns and significant price adjustments issued after year end. A large credit memo in January against a December sale suggests the sale should not have been recognized, or that a returns reserve was understated.
Gross vs net (principal vs agent)
When another party is involved in providing goods or services, the entity must determine whether it is a principal (reports revenue gross) or an agent (reports its fee or commission net). Under ASC 606 the determination is based on whether the entity controls the specified good or service before it is transferred to the customer. Indicators of control include:
- the entity is primarily responsible for fulfilling the promise
- the entity has inventory risk before transfer or after return
- the entity has discretion in establishing the price
Audit procedures: identify arrangements with third-party fulfillment, drop shipping, marketplaces or pass-through costs; read the contracts; evaluate each indicator; and check that the conclusion is applied consistently. Gross vs net errors do not change net income but can be material to revenue, gross margin and any covenant or valuation based on revenue.
Estimates in revenue
Variable consideration, standalone selling prices, progress toward completion and returns reserves are accounting estimates under AU-C 540. For each:
- understand how management made the estimate and what data it used
- test the data, including historical rebate and return rates
- evaluate whether the constraint on variable consideration was applied, meaning amounts are included only to the extent it is probable that a significant reversal will not occur
- perform a retrospective review of last year's estimates against actual outcomes
For over-time revenue using an input method such as cost-to-cost, test costs incurred, the estimate of total costs and changes in estimates. Loss contracts need specific attention.
Contract balances
Roll forward deferred revenue and contract assets from the prior year: additions from billings, releases to revenue and other movements. Test a sample of year-end deferred revenue to contracts and billing terms. Unusual drops in deferred revenue near year end can signal acceleration. Test the allowance on contract assets with receivables. See CECL under ASC 326.
Disclosures
ASC 606 disclosures for nonpublic entities are reduced but not minimal: disaggregation of revenue (with relief for nonpublic entities), contract balances, performance obligations and significant judgments. Read the draft footnote against the requirements and the audit evidence, using a GAAP disclosure checklist.
Documentation reviewers look for
- a fraud risk documented by stream and assertion, with a specific response
- a population tied to the general ledger, with completeness and accuracy evidence
- contract review documentation that addresses each step of the model
- analytics with a documented expectation, threshold and investigation
- clear tie-out of misstatements to the summary under AU-C 450
Each paper should state its objective, procedures, results and conclusion, as described in audit working papers.
Frequently asked questions
Is revenue always a fraud risk in an audit?
AU-C 240 requires the auditor to presume that there are risks of fraud in revenue recognition. The presumption can be rebutted, but the auditor must document the reasons, and rebuttals should be specific to the entity.
Can substantive analytics alone cover revenue?
Not for a significant risk such as the presumed fraud risk. When the response to a significant risk consists only of substantive procedures, AU-C 330 requires those procedures to include tests of details, alone or combined with analytics. Analytics can cover lower-risk streams if the expectation is precise enough.
What evidence supports occurrence of revenue?
Evidence that the performance obligation was satisfied, such as shipping documents, proof of delivery, customer acceptance or service records, together with the contract or order and subsequent cash receipt.
How do auditors test principal vs agent conclusions?
They identify arrangements involving other parties, read the contracts, evaluate whether the entity controls the good or service before transfer using the ASC 606 indicators, and confirm the conclusion is applied consistently.
Why review credit memos issued after year end?
Credit memos and returns after year end can show that a sale recorded before year end did not occur, was overstated, or that the returns or price concession reserve was understated.
Sources
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (presumed revenue fraud risk; documentation)
- AICPA, AU-C Section 315 (as revised by SAS No. 145); AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks; AU-C Section 520, Analytical Procedures
- AICPA, AU-C Section 530, Audit Sampling; AU-C Section 540, Auditing Accounting Estimates and Related Disclosures; AU-C Section 450; AU-C Section 505
- FASB ASC 606-10-25 (contract criteria), 606-10-32 (variable consideration and constraint), 606-10-55-36 to 55-40 (principal versus agent), 606-10-50 (disclosures)
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error