Finding Undisclosed Related Parties: Procedures, Sources and What to Do When One Appears

The hardest related party question is not whether a disclosed transaction was accounted for correctly. It is whether the list of related parties is complete. Management gives the auditor the names it knows or chooses to share. The auditor's job is to test that list against records management does not control. This post is a working program. For the broader topic and disclosure rules see related party transactions audit and ASC 850 related party disclosures. The standard is AU-C 550.

Step 1: Discuss it in the team meeting

At planning, the engagement team discusses where the financial statements are vulnerable to material misstatement from related party relationships, including how fraud might occur through them. Record who raised what. A junior who knows the owner's brother runs a vendor needs a forum to say so.

Step 2: Make the inquiries

Ask management about:

• The identity of related parties, including changes from the prior period.
• The nature of each relationship.
• Whether the entity had transactions with them in the period and the type and purpose.

Ask others in the entity as well, such as the controller, purchasing, sales leaders and in-house counsel. Ask governance. Ask the controls questions: how management identifies related parties, how it approves significant related party transactions and how it approves transactions outside the normal course of business. Written conflict-of-interest declarations from officers and directors, if they exist, are part of the control. If the client has none, that is an observation for the deficiency evaluation.

Step 3: Read records that tend to reveal relationships

The standard singles out three: bank and legal confirmations, and minutes of shareholders and governance. Beyond those, check:

Step 4: Run data tests

If the client's accounting data is available, run matches:

• Vendor and customer addresses, phone numbers and bank accounts against the employee and officer master files.
• Names of counterparties against the names of owners, officers, directors and their known family members.
• Round-dollar or recurring payments to individuals.
• Transactions with new vendors in the last quarter, or vendors with no other business history.
• Prices that deviate from other vendors for the same goods or services.

A hit is a lead, not a conclusion. The follow-up is inquiry and inspection.

Step 5: Identify unusual transactions

Look at significant transactions outside the normal course of business: large sales near year end with unusual terms, asset transfers to or from owners, loans without interest, below-market leases, management fees, side agreements. For each, inspect the contract, evaluate the business rationale, check whether the terms match management's explanation, and confirm the proper authorization. A transaction with no apparent business purpose may indicate fraudulent reporting or concealment.

Step 6: If you find a party management did not disclose

Follow this response sequence:

1. Tell the engagement team promptly. Others may have seen the same name elsewhere.
2. Ask management to identify all transactions with the newly found party for evaluation, where the framework has related party requirements.
3. Ask why the controls did not catch it. The answer is evidence about the control environment.
4. Perform substantive procedures on the new party and its transactions: vouch, confirm, evaluate terms.
5. Reconsider whether other undisclosed parties exist, and expand procedures as needed.
6. If the nondisclosure looks intentional, treat it as a fraud risk indicator and evaluate the implications for the audit, including reliability of management's representations. See fraud risk assessment.
7. Communicate to governance significant matters on related parties. See AU-C 260 communications.
8. Update the representation letter to cover related party identification and disclosure. See representation letter drafting.

Arm's length statements

If management asserts in the financial statements that a related party transaction occurred on terms equivalent to arm's length, the auditor needs evidence for the assertion. Management supports it with comparable transactions, appraisals or market quotes. ASC 850 allows the statement only if it can be substantiated; if management cannot substantiate it, the assertion is removed from the note. The auditor does not accept the assertion on representation alone.

Worked example

A landscaping company's vendor listing shows $412,000 paid to "Greenway Equipment Services." The senior's data test matches the vendor's bank account to the account of the owner's spouse as shown on a payroll direct deposit setup.

• The senior tells the manager that day and the team is notified.
• The manager asks the CFO. The CFO says Greenway is owned by the owner's spouse and supplies equipment maintenance, and "everyone knows." Management had not listed it.
• Inspection of invoices shows monthly billing of about $34,333 (twelve bills, $412,000 in total) with no work orders. Comparison to two other vendors' quotes shows rates 40 percent above market.
• The auditor asks why the controls did not catch it. The company has no related party policy.
• The partner evaluates the matter as an indicator of fraud risk. Procedures expand to other payments to people with common addresses and to the owner's expense accounts.
• The related party note is revised to disclose the relationship, the amounts and the terms, without any arm's length assertion.
• Governance and the owner's advisors are briefed. The representation letter adds a specific paragraph.

Documentation

The file shows the names of identified related parties, the procedures that identified them, the inquiries with dates and responders, the data tests with results, the evaluation of significant transactions, the disclosure evaluation and the communications. For the standard, see AU-C 550.

CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.

Sources

• AICPA, AU-C Section 550, Related Parties; AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
• FASB, Accounting Standards Codification Topic 850, Related Party Disclosures
• AUASB, ASA 550 Related Parties (the international-standard equivalent of AU-C 550), paragraphs 15 and 22: standards.auasb.gov.au
• Open Exam Prep, related parties and significant unusual transactions: open-exam-prep.com
• U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026: gao.gov

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error