Fraud risk and the engagement team discussion (AU-C 240)

• Run an engagement team discussion that meets AU-C 315.17 and AU-C 240.15.
• Perform the fraud inquiries required by AU-C 240.17-.21.
• Evaluate and, where justified, rebut the revenue recognition presumption.
• Describe the procedures required to address management override.

The engagement team discussion

AU-C 315.17 requires the engagement partner and other key engagement team members to discuss the application of the framework and the susceptibility of the statements to material misstatement. AU-C 240.15 requires that discussion to include an exchange of ideas, or brainstorming, about how and where the statements, including disclosures, might be susceptible to material misstatement due to fraud, how management could perpetrate and conceal fraudulent financial reporting, and how assets could be misappropriated.

The discussion should occur setting aside beliefs that management and those charged with governance are honest. It should address:

• known external and internal factors that create incentive or pressure, provide opportunity, or indicate a culture that enables rationalization;
• the risk of management override of controls;
• circumstances that might indicate earnings management and practices that could lead to fraudulent reporting;
• the importance of professional skepticism; and
• how the auditor might respond.

Communication about fraud risk continues throughout the audit. AU-C 315.18 requires the engagement partner to decide what to communicate to members who did not attend.

Required inquiries

AU-C 240.17-.21 require inquiries of:

• management about its assessment of fraud risk, its process for identifying and responding to fraud risks, communications to governance and to employees on business practices and ethics;
• management and others about knowledge of actual, suspected or alleged fraud (AU-C 240.18);
• internal audit, if it exists (AU-C 240.19); and
• those charged with governance, unless all are involved in managing the entity (AU-C 240.21). AU-C 240.20 also requires you to understand how they oversee management's fraud risk process.

AU-C 240.22 requires you to evaluate whether unusual relationships from analytics indicate fraud risk. AU-C 240.24 requires you to evaluate whether fraud risk factors are present.

Assessing fraud risks

AU-C 240.25 requires identification and assessment of fraud risks at the financial statement and assertion levels. AU-C 240.26 requires you, based on a presumption that risks of fraud exist in revenue recognition, to evaluate which types of revenue, transactions or assertions give rise to those risks. If you conclude the presumption is overcome, AU-C 240.46 requires you to document the reasons. AU-C 240.A35 gives the example that supports a rebuttal: a single type of simple revenue transaction, such as rent from a single-unit rental property. "Revenue is not complex" alone does not.

AU-C 240.27 requires assessed fraud risks to be treated as significant risks, with controls identified and their design and implementation evaluated.

Management override: always addressed

AU-C 240.32 requires, regardless of other conclusions, procedures to:

• (a) test the appropriateness of journal entries and other adjustments, including understanding the financial reporting process and controls over entries, inquiring of people involved about inappropriate activity, selecting entries at period end and considering the need to test entries throughout the period;
• (b) review accounting estimates for bias, including a retrospective review of prior-year significant estimates; and
• (c) evaluate the business rationale for significant unusual transactions.

Use the journal entry testing guide and the journal entry testing filter for selection criteria.

Documentation

AU-C 240.43-.46 require documenting the significant decisions from the discussion, the identified and assessed fraud risks, the responses and their results, communications about fraud, and any rebuttal of the revenue presumption.

Common findings

• Brainstorming documented as a list of attendees with no content.
• Inquiries of management only; governance not asked.
• Revenue presumption rebutted with no reasons.
• Journal entry testing with no documented selection criteria or no year-end entries.
• No retrospective review of estimates.

Brainstorming outcome at a contractor