AU-C section 240, Consideration of Fraud in a Financial Statement Audit, deals with the auditor's responsibilities relating to fraud in a GAAS audit of a nonissuer. It came out of SAS No. 122. The AICPA's Auditing Standards Board approved SAS No. 151, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, in August 2026, and the AICPA issued it on October 14, 2026. It supersedes AU-C 240. SAS 151 applies to audits of periods ending on or after December 15, 2028, and early implementation is permitted. Until a firm adopts it, the current AU-C 240 applies.
This page paraphrases the standards; the authoritative texts are AU-C 240 and, when it applies, SAS 151. The sections below describe the current requirements first, then what SAS 151 changes.
What is the objective of AU-C 240?
The auditor's objectives are to identify and assess the risks of material misstatement of the financial statements due to fraud, to obtain sufficient appropriate audit evidence about those assessed risks by designing and implementing appropriate responses, and to respond appropriately to fraud or suspected fraud identified during the audit.
The first two objectives sit on top of AU-C 315 (risk assessment) and AU-C 330 (responses). AU-C 240 adds the fraud-specific requirements.
Is the auditor responsible for detecting fraud?
The auditor is responsible for obtaining reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by fraud or error. That is a high level of assurance, not a guarantee. Because fraud can involve collusion, forgery, deliberate omission or management override, the risk of not detecting a material misstatement from fraud is higher than the risk for error.
Management and those charged with governance have the primary responsibility for preventing and detecting fraud. The auditor's responsibility does not change that. See AU-C 200 on reasonable assurance and its limits.
The standard describes two kinds of intentional misstatement that matter to the auditor: fraudulent financial reporting (for example, manipulating records, omitting information or misapplying principles) and misappropriation of assets (theft, often hidden by false records).
Professional skepticism
The auditor maintains professional skepticism throughout the audit, recognizing that a material misstatement due to fraud could exist despite the auditor's past experience of management's honesty and integrity. The auditor does not accept records and documents as genuine unless something suggests otherwise. If a document or a response to an inquiry is inconsistent with other evidence, or conditions cast doubt on the reliability of information, the auditor investigates further.
Engagement team discussion
The key members of the engagement team, including the engagement partner, discuss how and where the entity's financial statements might be susceptible to material misstatement due to fraud, how fraud could be perpetrated, and how assets could be misappropriated. The team emphasizes the need to keep a questioning mind. Not every member needs to be at every session, and the team communicates the results of the discussion to members who were not.
The discussion applies on small audits too. For how to run one, see fraud risk assessment under AU-C 240.
Risk assessment procedures and related activities
In addition to the procedures in AU-C 315, the auditor performs procedures to obtain information used to identify the risks of material misstatement due to fraud:
- Inquiries of management about its assessment of the risk of fraud, its process for identifying and responding to fraud risks, its communications to those charged with governance, and its communications to employees on business practices and ethics, and whether it knows of any actual or suspected fraud
- Inquiries of others within the entity, such as internal audit and those charged with governance, about their views and knowledge of fraud
- Unusual or unexpected relationships identified in analytical procedures
- Fraud risk factors that exist, which are events or conditions that indicate an incentive or pressure, an opportunity, or an attitude or rationalization to commit fraud
- Other information, such as that from client acceptance and prior engagements
Fraud risk factors do not show that fraud exists. They are inputs to the judgment about whether a risk is present and how large it is.
The two presumed risks
Revenue recognition. The auditor presumes there are risks of fraud in revenue recognition and evaluates which types of revenue, revenue transactions or assertions give rise to them. The presumption can be rebutted, with the reason documented. For most entities it stands, and the work is to make it specific.
Management override of controls. The auditor treats the risk of management override as a fraud risk in every audit. It cannot be rebutted. Whatever the assessed risk, the auditor must perform at least these procedures:
- Test the appropriateness of journal entries and other adjustments, including selecting entries and adjustments made at the end of the reporting period, and test whether the entries are supported by appropriate evidence. See journal entry testing.
- Review accounting estimates for bias, including a retrospective look at significant prior-year estimates.
- Evaluate the business rationale for significant unusual transactions.
Fraud risks identified are treated as significant risks. The auditor obtains an understanding of the controls the entity has designed for them.
Responding to assessed fraud risks
The response works at two levels.
- Overall. Assign and supervise staff in line with the assessed risks, evaluate whether management's selection and application of accounting policies, especially those on subjective or complex matters, point to fraudulent financial reporting, and build an element of unpredictability into the nature, timing and extent of procedures.
- Assertion level. Design procedures that answer the specific risk. A risk of fictitious revenue calls for different work than a risk of misappropriated cash or understated reserves.
Unpredictability can be simple: changing the timing of a procedure, testing an account that would otherwise be skipped, or choosing items in a different way from last year.
Evaluating audit evidence
Near the end of the audit the auditor evaluates whether analytical procedures indicate a previously unrecognized fraud risk. When a misstatement is found, the auditor considers whether it may be due to fraud. If it might, the auditor considers the implications for the rest of the audit, especially the reliability of management's representations, because an instance of fraud is unlikely to be isolated. If the auditor identifies a misstatement due to fraud involving management, the auditor reconsiders the assessed risks and the nature, timing and extent of the response, whatever its size.
If the auditor encounters exceptional circumstances from a misstatement due to fraud or suspected fraud that bring into question the auditor's ability to continue the engagement, the auditor considers the professional and legal responsibilities that apply, including whether withdrawal is appropriate where law permits. See AU-C 450 on evaluating misstatements.
Written representations
The auditor obtains written representations from management (and, where appropriate, those charged with governance) that they acknowledge responsibility for the design, implementation and maintenance of internal control to prevent and detect fraud, have disclosed their assessment of the risk of material misstatement due to fraud, and have disclosed their knowledge of fraud or suspected fraud involving management, employees with significant internal control roles, and others where fraud could materially affect the statements.
Communications
If the auditor identifies a fraud or obtains information that a fraud may exist, the auditor communicates on a timely basis to the appropriate level of management. Fraud involving senior management, employees with significant roles in internal control, or others where the fraud results in a material misstatement is communicated to those charged with governance. See AU-C 260.
The auditor also considers whether there is a responsibility to report to a party outside the entity. Law or regulation may require it, and confidentiality duties may limit it. Legal advice may be needed when the position is unclear.
Documentation
The auditor documents the team discussion (how and when, who took part, what was covered), the procedures to identify and assess fraud risks, the risks identified at the financial statement and assertion levels, the reasons if the revenue presumption was rebutted, the overall and assertion-level responses and their results including the override procedures, and communications about fraud. See AU-C 230.
What does SAS 151 change?
SAS No. 151 supersedes AU-C 240 and sets out the auditor's responsibilities relating to fraud in more detail. Per the AICPA and Journal of Accountancy summaries, the changes include:
- a fraud lens added to the risk assessment procedures the auditor performs under AU-C 315
- a requirement to understand an entity's program for reporting fraud, if it has one, including how management and, where applicable, those charged with governance deal with allegations made through it
- new requirements on how the auditor responds when fraud or suspected fraud is identified
- more extensive requirements for communicating with management and those charged with governance
- the presumption of fraud risk in revenue recognition retained, with the auditor determining which revenue transactions or assertions give rise to it
- added requirements on professional skepticism and documentation
The definition of fraud and the auditor's overall objective of reasonable assurance do not change.
Effective date. SAS 151 is effective for audits of financial statements for periods ending on or after December 15, 2028. Early implementation is permitted. For a calendar-year client, 2028 is the first year it must apply.
SAS 151 also amends various other sections of the AU-C literature. The list above reflects the AICPA and Journal of Accountancy summaries of the standard.
File checks on fraud work
These are practice checks, not requirements of the standard. Weaknesses to look for:
- Team discussion documented with only a date and a list of names
- The revenue presumption stated as "not rebutted" with no tailoring to the actual revenue streams
- Journal entry testing that does not describe how the population was shown to be complete
- Management override procedures that do not link to specific criteria
- Fraud inquiries of management documented with the same wording every year
Related
- Fraud risk assessment under AU-C 240
- Journal entry testing under AU-C 240
- Benford's Law analyzer
- AU-C 315 risk assessment and SAS 145
Sources
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (AICPA Professional Standards)
- AICPA, SAS No. 151, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements (supersedes AU-C 240; periods ending on or after December 15, 2028; early implementation permitted)
- AICPA & CIMA, "SAS 151: Clarifying and enhancing auditor responsibilities relating to fraud" (October 2026), https://www.aicpa-cima.com/resources/article/sas-151-clarifying-and-enhancing-auditor-responsibilities-relating-to-fraud
- Journal of Accountancy, "ASB approves standard on auditors' responsibilities relating to fraud" (August 2026), https://www.journalofaccountancy.com/news/2026/aug/asb-approves-standard-on-auditors-responsibilities-relating-to-fraud/
- AICPA, AU-C 200, 230, 260, 315, 330 and 450 (cross-referenced sections)
Part of CORAA University · Planning and risk assessment: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error