Software revenue audits turn on contract wording. Contracts bundle a license, support, hosting, and services, and revenue lands in one quarter or spreads across three years depending on how a single sentence in the contract reads. The presumed fraud risk in revenue recognition applies to these audits.
This guide covers the classification decisions, the allocation arithmetic, and what to test.
Step one: license or service
A contract can give the customer software or give the customer access to software the vendor runs. The distinction drives everything that follows.
Under ASC 985-20-15, a license exists within a hosting arrangement only when both conditions hold: the customer has the contractual right to take possession of the software during the hosting period without significant penalty, and it is feasible for the customer to run the software on its own hardware or contract with an unrelated party to host it. If either condition fails, the arrangement is a service (SaaS) and revenue is recognized as the service is provided over time. The license is not a separate promise.
Read the contract for the possession right. Escrow release conditions, source or object code delivery, and termination clauses are the evidence. The conclusion needs a written memo for each product line, and the auditor reads a sample of contracts to test whether the memo matches the paper.
Step two: functional or symbolic IP
Once a license exists, ASC 606 asks what kind of intellectual property it is (ASC 606-10-55). Functional IP has significant standalone functionality and most of its value comes from that functionality. Software is the standard example. Symbolic IP, such as a brand, derives its value from its association with the licensor's activities.
Functional IP is a right to use the IP as it exists when granted. Revenue is recognized at a point in time, when control transfers, and cannot begin before the customer is able to use and benefit from the license, which is the start of the license period. That is why a three-year term license can produce most of its revenue in the first quarter.
An exception in ASC 606-10-55 treats functional IP as a right to access only when two criteria are both met: the functionality is expected to change substantively during the term because of activities of the entity that do not transfer a promised good or service, and the customer is contractually or practically required to use the updated IP. Updates that transfer a promised good or service do not count toward the first criterion. A fixed-term license delivered with a digital key and run on the customer's server, with separately promised support, is a point-in-time license. The support is a separate performance obligation and does not change the license's classification.
Step three: separate the performance obligations
Evaluate each promise for distinctness (ASC 606-10-25): is it capable of being distinct, and is it separately identifiable within the contract? Common elements:
- License. Distinct when the customer can benefit from it on its own.
- Post-contract customer support (PCS). Technical support and unspecified updates. If PCS and the license are highly interdependent, they are one obligation. Otherwise PCS is a separate obligation recognized over time.
- Implementation and customization. Distinct unless the services significantly modify the software or are essential to its functionality, in which case the license and services combine and recognition moves over time.
- Hosting. A separate service if the hosting right is not part of a license under ASC 985-20-15.
- Options for more users or modules. A material option at a discount is a separate performance obligation (ASC 606-10-55).
Step four: allocate by standalone selling price
The transaction price is allocated to the obligations in proportion to their standalone selling prices (SSPs). A license sold only in bundles has no observable standalone price, so the SSP is estimated. The residual approach is available only when the selling price is highly variable or uncertain, as ASC 606-10-32 defines those conditions. Where a vendor has an observable standalone price, that price is preferred.
Worked example (illustrative numbers). A vendor signs a three-year term license, effective January 1, with support. Total price is $900,000 billed $300,000 per year in advance. SSPs: license $800,000, support $200,000, total $1,000,000.
- Allocation: license 80% x $900,000 = $720,000. Support 20% x $900,000 = $180,000, or $60,000 per year.
- Year 1 revenue: license $720,000 at January 1, plus support $60,000 over the year, totaling $780,000.
- Year 1 billings: $300,000. The $480,000 difference is a contract asset, or a receivable if the right to payment is unconditional.
- Years 2 and 3: $60,000 of support revenue each year, against $300,000 of billings, which draws down the contract asset.
The auditor recalculates the allocation, agrees the SSPs to the vendor's pricing analysis, and tests the contract asset roll-forward. Because payment is spread over years after delivery, evaluate whether the contract has a significant financing component. Present the contract asset separately from receivables, and test it for impairment. See contract costs and ASC 606 disclosures.
Variable consideration and usage
Usage-based fees, true-ups, price concessions, and refund rights are variable consideration. Include an estimate only to the extent a significant reversal is not probable (ASC 606-10-32, the constraint). Test historical concessions and whether discounts offered at quarter end are practice. See variable consideration and the constraint.
Risk areas
Cutoff. Delivery or the start of the license period decides the date. Test the date the customer received the key or access, and the date the license term began.
Side agreements. Rights of return, acceptance clauses, extended payment terms, free periods, and unwritten commitments to deliver future features.
Reseller transactions. Test whether the reseller is the customer, whether the end customer exists, and whether the reseller's payment depends on resale.
Modifications. Mid-term upgrades, co-terming, and renewals. Distinguish a new contract from a modification of the existing one.
Related contracts. Contracts with the same customer entered at or near the same time are combined when they meet the ASC 606-10-25 criteria.
Audit procedures
- Obtain the contract population and a revenue disaggregation by product, type, and period. Tie it to the general ledger.
- Select contracts by risk, including large, non-standard, and quarter-end deals. Read the full contract, amendments, and order forms.
- Test the performance obligation conclusions and the license-versus-SaaS memo.
- Recalculate the SSP allocation and the revenue schedule.
- Test delivery evidence: key delivery emails, portal download logs, and customer acceptance.
- Confirm contract terms and balances with customers, including whether side agreements exist. A confirmation asking about "any other agreements" is worth sending for the largest deals.
- Test the deferred revenue and contract asset roll-forwards. See deferred revenue schedule.
- Perform journal entry testing on manual revenue entries near period end.
Red flags
- A high share of annual revenue booked in the last two weeks of a quarter.
- Contracts signed after quarter end but recorded before it.
- License start dates that do not match delivery.
- Extended payment terms with no financing analysis.
- Support terms that change without a pricing change.
- Reseller sales at quarter end followed by credit memos after the period.
- SSP ranges updated after the fact.
PBC items to request
- Contract register and signed contracts for the sample
- Revenue waterfall and deferred revenue and contract asset schedules
- License versus SaaS policy memo and SSP analysis
- Delivery evidence: keys, download logs, acceptance emails
- Credit memos and cancellations after year end
- Reseller agreements and sell-through reports
- Billing system reports and a reconciliation to the general ledger
- Sales commission schedules for the contract cost test
- Representation letter
Sources
- FASB ASC 606-10-25, 606-10-32 and 606-10-55, Revenue from Contracts with Customers (contract combination, performance obligations, variable consideration, SSP allocation, licenses of intellectual property, options)
- FASB ASC 985-20-15, hosting arrangements that include a software license
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Part of CORAA University · Specialized engagements: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error