Auditing the CECL allowance under AU-C 540 and tying the disclosures

How to audit the allowance for credit losses as an estimate under AU-C 540 (SAS 143): risk factors, the three approaches, bias, and disclosure tie-out.

4 min read · CORAA Team
Lesson 14 of 14 · 0 of 14 complete
In this lesson you will
  • Assess inherent risk for the allowance using estimation uncertainty, complexity and subjectivity
  • Design responses using the three AU-C 540 testing approaches
  • Evaluate management bias and a misstatement when the estimate falls outside the auditor range
  • Tie the Topic 326 disclosures to the allowance workpapers

The allowance is an estimate

AU-C 540, as revised by SAS No. 143, governs auditing accounting estimates for periods ending on or after December 15, 2023. It requires the auditor to understand how management makes the estimate (method, data, assumptions, controls) and to assess inherent risk with reference to estimation uncertainty, complexity and subjectivity. Inherent and control risk are assessed separately.

For CECL, the inherent risk factors map directly:

  • Estimation uncertainty. Long-term loans with forecast periods carry more than 60-day trade receivables.
  • Complexity. A roll-rate or PD model with external data is more complex than a simple aging matrix.
  • Subjectivity. Qualitative adjustments and the forecast and reversion period are the most subjective inputs.

A trade receivable allowance at a distributor carries lower risk. A loan allowance at a finance company or a bank is often a significant risk.

Retrospective review

Compare last year's allowance with what happened: write-offs from balances outstanding at the prior year-end, and recoveries. Large differences show either poor methods or bias, and inform this year's risk assessment. This is a risk assessment procedure, not a reason to second-guess judgments that were reasonable when made.

The three approaches

AU-C 540 lets the auditor respond using one or more of these:

  1. Obtain evidence from events up to the date of the auditor's report. For trade receivables, subsequent cash receipts are strong evidence. If the client has elected the ASU 2025-05 subsequent collections policy, those receipts are part of the estimate itself, so test them as data.
  2. Test how management made the estimate. Evaluate the method against 326-20 (pooling, contractual term, forecast and reversion). Test data for accuracy and completeness: agree the aging to the subledger and the subledger to the general ledger, and test historical write-off data used for loss rates. Evaluate whether assumptions, especially qualitative adjustments, are reasonable and consistent with other evidence in the audit.
  3. Develop an auditor's point estimate or range. Use independent loss rates or different pooling. A range includes only amounts supported by sufficient appropriate evidence.

If the evidence supports a range that does not include management's point estimate, the misstatement is the difference between management's estimate and the nearest point of the auditor's range (AU-C 540).

Management bias

Indicators include changes in method or assumptions without a change in circumstances, qualitative adjustments that move only in the direction that hits an earnings target, selecting the low end of every range, and an allowance that stays flat while delinquencies rise. Evaluate indicators individually and in aggregate. Bias indicators are not misstatements by themselves but affect the risk assessment and the evaluation of the financial statements as a whole.

Disclosures

Topic 326 disclosures are part of the estimate and are audited with it. Tie:

  • the description of methods and the factors that influenced the estimate, including past events, current conditions and forecasts, and changes in those factors (326-20-50-11),
  • the allowance rollforward: beginning balance, provision, initial allowance on PCD assets, write-offs, recoveries, ending balance, by portfolio segment (326-20-50-13),
  • credit quality information; vintage presentation by year of origination is not required for an entity that is not a public business entity (326-20-50-6),
  • ASU 2025-05 elections and the subsequent collections date when applicable (326-20-50-12A and 50-12B).

The CECL disclosure checklist covers the full list.

Worked example

Developing a range for Oakhurst Building Products, Inc.

Oakhurst Building Products, Inc. records a trade receivable allowance of $151,500 on $6,500,000 of receivables, using a five-year aging matrix with no adjustment. The auditor assesses inherent risk as moderate: short-term assets, a simple method, but subjectivity because two large homebuilder customers slowed payments in the fourth quarter.

Retrospective review: last year's allowance was $110,000; actual write-offs from those balances were $162,000. History understated losses.

Test of data: the aging agrees to the subledger and the general ledger. Write-off history agrees to approved write-off memos.

Auditor range: the auditor reprices the 61 to 90 day and over 90 day buckets using the last two years only, which reflect the builder slowdown, and evaluates the two homebuilders individually. The resulting range is $160,000 to $205,000.

Conclusion: management's estimate is $8,500 below the low end of the range ($160,000 - $151,500). That $8,500 is the misstatement under AU-C 540 and goes on the summary of uncorrected misstatements unless management adjusts. The auditor also notes a bias indicator (no adjustment despite known slow payers) and evaluates whether the missing review of customer-specific risk is a control deficiency to communicate under AU-C 265.

Self-check

Answer each question before you open the answer.

  1. Which three inherent risk factors does AU-C 540 name for assessing the risk of an accounting estimate such as the allowance?

    Show answer

    Estimation uncertainty, complexity and subjectivity. They drive where on the spectrum of inherent risk the allowance sits, which sets how persuasive the evidence must be.

  2. Management records $100,000 and the auditor range is $115,000 to $140,000. What is the misstatement?

    Show answer

    $15,000. When the evidence supports a range that excludes management estimate, AU-C 540 measures the misstatement to the nearest point of the range, here $115,000.

  3. Must a private company present credit quality by year of origination?

    Show answer

    No. As amended by ASU 2022-02, 326-20-50-6 requires the vintage presentation (and gross write-offs by vintage) only from public business entities.

  4. Which allowance rollforward items does 326-20-50-13 require?

    Show answer

    Beginning balance, current-period provision, initial allowance on PCD assets, write-offs, recoveries and ending balance, by portfolio segment and major security type.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required