What it is
AU-C 240 presumes there are risks of fraud in revenue recognition. The auditor evaluates which types of revenue, revenue transactions or assertions give rise to such risks, and if the auditor concludes the presumption does not apply in the circumstances, the reasons for that conclusion go in the documentation. The memo is where that conclusion and its reasons live.
It lists each revenue stream with its recognition pattern under ASC 606, records fraud risk factors by incentive, opportunity and rationalization, maps fraud scenarios to the assertions, and gives a conclusion for each stream: not rebutted, so a significant risk, or rebutted with stream-specific reasons. A response table covers contract review, confirmations, journal entries, cutoff and analytics, with an unpredictability element.
When to use it
- In every audit, to document the revenue conclusion alongside the engagement team’s fraud discussion.
- When the entity has several revenue streams and the answer may differ by stream.
- When management is under pressure from lenders, owners or targets.
What’s inside
- Revenue streams with amounts, recognition pattern and key judgments
- Fraud risk factors by incentive or pressure, opportunity and rationalization
- Engagement team discussion and inquiries
- Assertion-level scenarios with responses
- Conclusion by stream, planned response and results
Standard cited
This template follows AU-C 240 / ASC 606. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use. See AU-C 240 explained.
Questions
Can the revenue fraud risk be rebutted?
AU-C 240 allows the auditor to conclude the presumption does not apply, for example for a simple revenue stream with no incentive or opportunity to misstate it, but requires the reasons to be documented. The reasons have to be specific to the stream, not a general statement about the entity.
Is management override ever rebutted?
No. The risk of management override of controls is present in every audit and the auditor addresses it with specific procedures, including testing journal entries, reviewing estimates for bias and evaluating significant unusual transactions.
What is SAS 151?
SAS 151 is the AICPA’s revised fraud standard. It applies to audits of financial statements for periods ending on or after December 15, 2028, with early implementation permitted. Until then AU-C 240 as currently codified applies, which is what this memo follows.
What are the three fraud conditions?
An incentive or pressure to commit fraud, an opportunity to do so, and an attitude or rationalization that justifies it. The memo has a row for each so the team records what it found rather than a generic list.
Related templates
- Fraud Inquiry and Brainstorming Documentation (AU-C 240)
- Disclosure Checklist: Revenue (ASC 606)
- Audit Program: Accounts Receivable and Revenue
- Journal Entry Testing Workpaper (AU-C 240)
Last updated 11/05/2026. All free templates.