Join the waitlist
Glossary/Fraud and ethics

Element of unpredictability

The element of unpredictability is a deliberate change in the nature, timing or extent of audit procedures from year to year, so management cannot anticipate the testing and conceal misstatement.

CORAA TeamUpdated November 5, 2026

Definition

AU-C 240 requires the auditor to incorporate an element of unpredictability when selecting the nature, timing and extent of procedures. Examples include testing balances not otherwise material, varying sample sizes, using different locations, performing procedures on a surprise basis, or changing the dates of observation. The aim is to reduce the chance that fraud is hidden in the areas the client knows will be tested.

Why it matters in an audit or review

An audit repeated on the same pattern each year teaches the client where to hide errors. Unpredictability also supports skepticism by prompting the team to ask why an approach is used. The plan can record that unpredictability is built in without spelling out each surprise in advance.

Example

For several years the auditor has confirmed the ten largest receivables. This year, the team also confirms two small balances over $5,000 (illustrative) and makes an unannounced visit to the second warehouse the week before the count date. Neither change was shared with the client in advance.

Common mistakes

  • Making a token change that has no relation to risk.
  • Telling management the details of the change.
  • Logging unpredictability in the plan with no evidence it happened.

FAQ

Does unpredictability mean random testing?

Not necessarily. It means varying the approach, which can be a judgment-based choice.

Sources

  • AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (unpredictability in the selection of procedures and examples in the application material)

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

AU-C 240

Related terms

  • Management override of controls
    Management override of controls is the risk that management bypasses controls that otherwise work, by posting false entries or biasing estimates, and AU-C 240 treats it as present in every audit.
  • Journal entry testing
    Journal entry testing is the audit procedure of examining journal entries and other adjustments for evidence of material misstatement due to fraud, required on every audit as a response to management override risk.
  • Further audit procedures
    Further audit procedures are the tests of controls and substantive procedures the auditor designs and performs in response to the assessed risks of material misstatement at the assertion level.
  • Key item testing
    Key item testing selects specific items for testing, such as large, unusual or high-risk entries, using judgment; results apply only to the items tested and cannot be projected to the rest of the population.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required