Definition
Because management controls the books and can direct employees, it is in a position to defeat controls in ways that are hard to predict. AU-C 240 therefore treats override as a risk of material misstatement due to fraud on every audit. The required response is journal entry testing, a review of accounting estimates for bias, and an evaluation of the business rationale for significant unusual transactions.
Why it matters in an audit or review
Because management can override controls, tests of controls cannot address this risk. It applies whatever the size of the entity. For small owner-managed entities, where one person can both approve and record, override is easier, and the auditor cannot rely on the strength of controls to reduce the work.
Example
The owner asks for a $90,000 (illustrative) year-end adjustment that reduces the allowance for credit losses just enough to meet a loan covenant. The auditor compares the allowance to historical losses, reads the covenant, tests the aging and concludes the change is not supportable, so the auditor proposes that the adjustment not be made, and evaluates it as a misstatement if it is.
Common mistakes
- Treating clean control testing as an answer to override risk.
- Reviewing estimates for reasonableness but not for direction of bias between periods.
- Not asking why a transaction occurred.
FAQ
Is override only about journal entries?
No. It also covers estimates, bias and unusual transactions.
Sources
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
- AICPA, AU-C Section 450, Evaluation of Misstatements Identified During the Audit
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error