Auditing revenue: the presumed fraud risk, estimates and procedures by assertion

• Apply the presumption of fraud risk in revenue recognition and document any rebuttal
• Map each ASC 606 step to the assertions and risks it creates
• Design substantive procedures for occurrence, cutoff, accuracy and presentation
• Test revenue estimates such as variable consideration and measures of progress

Start with the fraud presumption

AU-C 240.26 requires the auditor, when identifying and assessing fraud risks, to presume that there are risks of fraud in revenue recognition and to evaluate which types of revenue, revenue transactions or assertions give rise to them. If the auditor concludes the presumption is overcome, AU-C 240.46 calls for documenting the reasons. Rebuttals are rare; the example in AU-C 240.A35 is a single type of simple revenue transaction, such as leasehold revenue from a single unit rental property.

SAS No. 151, the new fraud standard, is effective for audits of periods ending on or after December 15, 2028. The AICPA describes it as leaving the presumption of fraud risk in revenue recognition unchanged, so the revenue analysis carries over.

Do not stop at "revenue: presumed fraud risk." Be specific. Which revenue streams, which assertions, which accounts? Typical fraud risks:

• fictitious sales or side agreements near period end (occurrence, cutoff);
• holding the books open or backdating shipping documents (cutoff);
• bill-and-hold or channel stuffing without substance (occurrence, cutoff);
• manipulating estimates: variable consideration, returns, measure of progress, SSP (accuracy, valuation);
• misclassifying gross versus net (presentation).

The fraud risk presumption memo template structures this.

Understand the process and controls

Walk a transaction from contract to cash: how contracts are approved and recorded, who can set up customers and prices, how shipments or service delivery trigger billing, how credits and rebates are approved, and how period-end cutoff and estimates are reviewed. Identify controls over nonstandard contracts and manual journal entries to revenue. If you plan to rely on controls, test them; otherwise design substantive procedures to cover the risk alone.

Map the five steps to procedures

Core substantive procedures

• Occurrence: vouch a sample of recorded revenue to contracts, delivery evidence (shipping records, customer acceptance, service logs) and cash receipts. Cash received after year-end is strong evidence.
• Cutoff: select transactions shortly before and after period end and check that they are recorded in the right period. Review credit memos issued after year-end for reversals of year-end sales.
• Confirmations: confirm receivable balances, and for significant contracts confirm terms such as acceptance, return rights and absence of side agreements, following AU-C 505.
• Analytics: build expectations by month, product and customer; investigate spikes in the last weeks of the period. A substantive analytic needs a precise expectation and a threshold set in advance.
• Journal entries: test manual and top-side entries to revenue and contract liabilities, especially entries near period end, by unusual users or with round amounts.

Estimates

Revenue estimates (variable consideration, returns, measures of progress, SSP) are accounting estimates under AU-C 540. Choose one or more approaches: test how management made the estimate, develop an independent estimate or range, or use events up to the report date. Do a retrospective review of last year's estimates for indications of management bias.

Presentation and disclosure

Test gross versus net conclusions, contract asset and liability classification, and the disclosure note against the rollforwards. Read the policy note against actual contract terms.

Evaluate and conclude

Accumulate misstatements, including judgmental differences in estimates, and consider whether a pattern of misstatements points to bias. Revenue misstatements found by the auditor that management did not catch can indicate a control deficiency to communicate. See the revenue audit playbook.

Cutoff testing finds a side letter