Element of Unpredictability in Audit Procedures: What AU-C 240 Requires and How Small Firms Apply It

AU-C 240 paragraph .29(c) requires the auditor, in determining overall responses to the assessed risks of material misstatement due to fraud at the financial statement level, to "incorporate an element of unpredictability in the selection of the nature, timing, and extent of audit procedures." The requirement is not met by repeating last year's program with a different sample start. It is met when something about the audit is not what the client's staff would predict from prior years.

The reason is stated in application paragraph A42: individuals within the entity who are familiar with the audit procedures normally performed on engagements may be better able to conceal fraudulent financial reporting. A client who knows the auditor always tests the 10 largest invoices and always counts inventory on the last day knows where not to hide anything.

What examples does the standard give?

Paragraph A42 lists four ways to achieve unpredictability:

• performing substantive procedures on selected account balances and assertions not otherwise tested due to their materiality or risk
• adjusting the timing of audit procedures from that otherwise expected
• using different sampling methods
• performing audit procedures at different locations or at locations on an unannounced basis

Appendix B (A77) adds examples of responses to the assessed fraud risks, several of which also introduce unpredictability:

• visiting locations or performing certain tests on a surprise or unannounced basis, such as observing inventory at locations where attendance was not previously announced or counting cash on a surprise basis
• requesting that inventories be counted at the end of the reporting period or on a date closer to period end
• altering the audit approach in the current year, such as contacting major customers and suppliers orally in addition to sending written confirmation, or sending confirmation requests to a specific party within an organization
• performing substantive analytical procedures using disaggregated data, such as comparing sales and cost of sales by location, line of business or month
• conducting interviews of personnel involved in areas in which a fraud risk has been identified

For issuers, AS 2301 paragraph .05(c) states the same requirement and names examples that include testing accounts, disclosures and assertions that would not otherwise be tested based on amount or risk, varying the timing, selecting items for testing that have lower amounts or are otherwise outside customary selection parameters, performing procedures on an unannounced basis, and, in multi-location audits, varying the location or the nature, timing and extent of procedures from year to year. AS 2401 paragraph .53 repeats several of these as responses to assessed fraud risks.

Is it the same as responding to a specific risk?

No. Paragraph .29 deals with overall responses at the financial statement level. The specific responses to assessed risks at the assertion level come under paragraph .30 and A43 to A46. Unpredictability applies regardless of which risks were identified. A clean fraud risk assessment still requires an element of unpredictability, because the point is to weaken the client's ability to predict the work, not to answer a known risk.

How do you apply it on a small-firm audit?

The risk in a small firm is that the program is a template rolled forward each year. Four practical moves cost little:

1. Change what you test. Pick one balance or assertion that its size and risk would ordinarily leave untested, such as a small expense account, a prepaid, a clearing account or the cutoff of a minor class, and perform a substantive procedure on it. Make a different choice next year.
2. Change when you test. If the client expects year-end work in the second week of February, do a surprise cash count or a walkthrough of receiving in the middle of the year, or move a test from after the close to the week of the close.
3. Change how you select. Move from a top-amount selection to a mix: some items by risk, some by random draw, some from the low end. See audit sampling methods for the options.
4. Change who you talk to. Ask the warehouse lead about inventory, a clerk about returns, a salesperson about year-end shipments. Call a few customers in addition to mailing confirmations.

An illustrative rotation

This table shows how one engagement team could vary a standard program across three years. It is an example design, not a requirement of the standards.

Each year's plan still has to be responsive to that year's risks. Variation is added to the risk-based plan, never substituted for it.

How do you document it without defeating the purpose?

Paragraph .44(a) requires documenting the overall responses to the assessed fraud risks at the financial statement level and the nature, timing and extent of audit procedures. Documentation records what was done and why, after the fact. It should not hand the client a schedule.

• Keep the approach and the choices in the planning file, which is the auditor's, not the client's.
• Do not put the surprise date in anything shared with the client, such as the PBC list or the engagement calendar.
• Record in the file that unpredictability was incorporated and describe the specific element: which account or assertion was added, which timing changed, which location or method varied.
• Record the results of the added procedures like any other substantive test. If an extra procedure produced nothing, say so. If it produced an exception, follow it through.

The planning memo is the natural home. See the audit planning memo guide and the discussion of the engagement team's brainstorming in fraud risk assessment under AU-C 240. Application paragraph A13 lists "a consideration of how an element of unpredictability will be incorporated into the nature, timing, and extent of the audit procedures to be performed" among the matters the paragraph .15 team discussion may cover.

Frequently asked questions

Does unpredictability mean every audit must have a surprise visit?

No. A surprise visit is one example among several. Using different sampling methods, testing an account not normally tested or adjusting timing each satisfies the same requirement.

Does AU-C 240 require it on every audit?

Yes. Paragraph .29(c) applies when determining overall responses to the assessed risks of material misstatement due to fraud, and paragraph .25 requires assessing those risks in every audit.

Can a recurring audit repeat the prior program with different sample items?

New random draws alone do little to change what the client can predict. Add a change in what is tested, when, where or how.

Sources

• AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit, paragraphs .15, .25, .29(c), .30, .44 and application material A13, A42 to A46 and A77 (Appendix B): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
• PCAOB, AS 2301, The Auditor's Responses to the Risks of Material Misstatement, paragraph .05(c): https://pcaobus.org/oversight/standards/auditing-standards/details/AS2301
• PCAOB, AS 2401, Consideration of Fraud in a Financial Statement Audit, paragraph .53: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2401

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error