SAS No. 151, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, is the AICPA Auditing Standards Board's rewrite of the fraud standard for audits of nonissuers. It supersedes SAS No. 122, section 240 (AU-C 240, Consideration of Fraud in a Financial Statement Audit) and amends other sections of the auditing literature. The ASB adopted it in August 2026 and the AICPA issued it on October 14, 2026.
This page covers the new standard and how to plan for it. For the requirements that apply today, including the team discussion, the revenue and management override risks and the response procedures, see AU-C 240.
When does SAS 151 take effect?
SAS 151 is effective for audits of financial statements for periods ending on or after December 15, 2028. Early implementation is permitted.
The test is the period end. A calendar-year client's December 31, 2028 audit is the first under SAS 151. A September 30, 2028 year end falls before the cutoff and stays under AU-C 240. A June 30, 2029 year end is under SAS 151. A firm that wants to implement early should update its methodology and templates first.
SAS 150, External Confirmations, also lists AU-C 240 among the sections it amends and has the same December 15, 2028 effective date. Firms planning their 2028 methodology update should handle the two together. See AU-C 505.
What stays the same?
The AICPA's announcement is explicit on three points:
- The definition of fraud does not change.
- The auditor's overall objective, reasonable assurance that the financial statements are free of material misstatement due to fraud or error, does not change.
- Management and those charged with governance remain primarily responsible for preventing and detecting fraud.
The presumption that fraud risks exist in revenue recognition is also retained. The auditor determines which revenue transactions or relevant assertions give rise to those risks. For many clients that was already the working approach; what changes is that the determination is stated in the requirement.
What does SAS 151 change?
The AICPA describes the new requirements as focused on risk assessment, responses to fraud and communication. The published summaries identify four areas.
A fraud lens in risk assessment. The risk assessment procedures in AU-C 315 are performed with a fraud perspective built in, rather than fraud being handled as a separate step afterward. Under AU-C 240 the team already considers fraud risk factors during planning. Under SAS 151 the fraud perspective sits inside the procedures that identify and assess risks of material misstatement. See AU-C 315.
Understanding the entity's fraud reporting program. If the entity has a whistleblower or other fraud reporting program, the auditor is required to understand it, including how management and, where applicable, those charged with governance deal with allegations made through it.
Responses when fraud or suspected fraud is identified. The standard adds requirements for what the auditor does on identifying fraud or suspected fraud. AU-C 240 already covers reconsidering assessed risks, evaluating implications and communicating; SAS 151 expands the requirements.
More extensive communications. Requirements for communicating with management and those charged with governance are expanded. See AU-C 260 for the communication framework the firm uses today.
The AICPA also says the standard adds more specific requirements on professional skepticism, fraud risk assessment, documentation, communication and responses. The standard itself is the authority for the paragraph-level detail, and the AICPA's executive summary and CPEA alert are the members' reference for it.
How does this compare with AU-C 240 today?
| Area | AU-C 240 now | SAS 151 |
|---|---|---|
| Revenue presumption | Presumed risk, rebuttable with documentation | Presumption retained; auditor determines which revenue transactions or assertions give rise to it |
| Fraud in risk assessment | Separate fraud procedures added to AU-C 315 work | Fraud lens applied within AU-C 315 risk assessment procedures |
| Fraud reporting program | Inquiry of management and others about knowledge of fraud | Auditor required to understand the program and how allegations are handled, if one exists |
| Fraud identified or suspected | Evaluate, reconsider risks, communicate | More requirements on responses |
| Communication | Management and those charged with governance | More extensive requirements |
The AU-C 240 column reflects the standard as it stands now. The SAS 151 column reflects only what the AICPA has published in its summaries.
How do you prepare before 2028?
These are practice suggestions, not requirements of the standard.
- Inventory your fraud procedures. List where your current files document fraud inquiries, the brainstorming session, journal entry testing and the override procedures, and see which of them sit in separate fraud forms rather than in the risk assessment file.
- Add a reporting program question to the planning inquiry. Ask whether there is a hotline or similar channel, who receives reports, how reports are logged and who sees the log.
- Tailor the revenue risk. Replace "revenue is a presumed fraud risk" with the revenue streams and assertions that carry it.
- Draft the communication. Prepare standard language for a fraud or suspected-fraud communication to management and the governance body so it is not drafted under time pressure.
- Set a methodology update date. A firm with a 2028 calendar-year adoption should complete its template changes before 2028 planning starts, so the first file is built on the new forms.
Illustration (illustrative)
A software client has subscription revenue billed annually, implementation services recognized as work is performed, and a small amount of hardware resale. Under a tailored approach, the file would identify the assertions that carry the risk, for example occurrence and cutoff on implementation revenue that depends on management's estimate of progress, and the subscription cutoff at year end. Hardware resale, simple and immaterial, would be noted as not giving rise to the risk. The planning inquiry would record that the client uses an external hotline provider, that reports go to the audit committee chair, and that the auditor read the log summary for the year. Those entries are the type of evidence the new requirement on fraud reporting programs calls for the auditor to understand.
Frequently asked questions
Does SAS 151 change the definition of fraud?
No. The AICPA states that the definition of fraud and the auditor's overall objective are unchanged.
Is the revenue fraud presumption gone?
No. The AICPA announcements say the presumption of fraud risk in revenue recognition is retained, and that the auditor determines which revenue transactions or relevant assertions give rise to it.
When does a client's first SAS 151 audit occur?
For audits of periods ending on or after December 15, 2028. A calendar-year client's 2028 audit is the first. Early implementation is permitted.
Does SAS 151 apply to reviews and compilations?
SAS 151 addresses audits of financial statements. Reviews and compilations follow the SSARS, which have their own provisions; see review engagements under AR-C 90.
What should we do about AU-C 240 until then?
Keep applying it. Until the firm adopts SAS 151, AU-C 240 is the standard in effect for every audit period that ends before December 15, 2028 and for any audit where the firm has not elected early implementation.
Sources
- AICPA, SAS No. 151, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements: AICPA & CIMA resource page (issued October 14, 2026) and news release on the ASB's approval. https://www.aicpa-cima.com/resources/article/sas-151-clarifying-and-enhancing-auditor-responsibilities-relating-to-fraud
- AICPA & CIMA news: new auditing standard clarifies and enhances CPAs' responsibilities relating to fraud in a financial statement audit. https://www.aicpa-cima.com/news/article/new-auditing-standard-clarifies-and-enhances-cpas-responsibilities-relating-to-fraud-in-a-financial-statement-audit
- Journal of Accountancy, "ASB approves standard on auditors' responsibilities relating to fraud" (August 2026). https://www.journalofaccountancy.com/news/2026/aug/asb-approves-standard-on-auditors-responsibilities-relating-to-fraud/
- AICPA, SAS No. 150, External Confirmations (July 2026), list of sections amended and effective date.
- AICPA, AU-C section 240, in AICPA Professional Standards.
Related
- AU-C 240 fraud in a financial statement audit
- Fraud risk assessment under AU-C 240
- Journal entry testing under AU-C 240
- Fraud inquiry and brainstorming memo template
- AU-C 315 risk assessment
- Management override of controls
- Fraud triangle
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · SEC reporting and PCAOB audits: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error