What it is
A SaaS audit starts with the contract: what the customer bought, when service started, how much was billed and how much is revenue. Billings, revenue and deferred revenue diverge as soon as customers pay annually in advance, and revenue recognition is a presumed fraud risk (AU-C 240).
The program covers performance obligations and stand-alone selling prices, ratable and usage-based recognition, contract modifications, deferred revenue and contract assets, capitalized commissions under ASC 340-40, internal-use software, stock compensation, customer concentration and going concern for cash burn. Steps carry an assertion, sample-size note, W/P reference and sign-off.
When to use it
- Planning the audit of a subscription software or technology company.
- When the company has multi-element contracts, implementation services, usage fees or capitalized sales commissions.
- To document how you test the billing system and the deferred revenue rollforward.
What’s inside
- Revenue and contracts: performance obligations, allocation, modifications and cutoff
- Receivables, deferred revenue and contract balances
- Capitalized contract costs, software development, stock compensation and other balances
- Tie-outs and general procedures
Standard cited
This template follows AU-C 330 / ASC 606 / ASC 340-40. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use. See AU-C 330 explained.
Questions
How do you test revenue from a billing system?
Treat the billing and revenue subledger as information produced by the entity. Test completeness and accuracy of the reports, then select contracts and agree term, price, start date and performance obligations to the signed agreement and recompute revenue and deferred revenue. The deferred revenue workbook in this library supports the recompute.
When are sales commissions capitalized?
Incremental costs of obtaining a contract, such as commissions paid because a contract was won, are capitalized if the entity expects to recover them, and amortized consistently with the transfer of the related goods or services (ASC 340-40-25). A practical expedient allows expensing when the amortization period is one year or less.
Why is a SOC 1 report relevant?
Hosting, payment and billing providers can be service organizations whose controls affect the financial statements. If you plan to rely on their controls, obtain the SOC 1 report and evaluate its scope, the user control considerations and the period covered (AU-C 402).
Related templates
- Deferred Revenue Rollforward and Ratable Recompute
- Audit Program: Accounts Receivable and Revenue
- Journal Entry Testing Workpaper (AU-C 240)
- Going Concern Evaluation Memo (AU-C 570 / ASC 205-40)
Last updated 11/05/2026. All free templates.