Responding to the presumed fraud risk in revenue
How an audit team responds to the presumed risk of fraud in revenue recognition under ISA 240, when the presumption can be rebutted, and what to document.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Many audit files contain the sentence "Revenue recognition is presumed to be a significant risk due to fraud (ISA 240)". Far fewer contain a response that would actually catch a revenue fraud. The risk is copied in at planning, the revenue section contains the same tests as every other year, and the link between the two is a cross-reference that nobody follows.
ISA 240 requires the auditor to presume that there are risks of fraud in revenue recognition, to evaluate which types of revenue, transactions or assertions give rise to them, and to respond specifically. The presumption is a starting point for thinking about how this client's revenue could be manipulated, not a box to tick.
Why the presumption exists, and when it may be rebutted
Revenue is where pressure to show a good result often turns into misstatement. It drives profit, covenants, bonuses and the price of a business. For owner-managed companies, the incentive can run the other way, towards understating revenue to reduce tax.
The presumption can be rebutted, but only where the auditor concludes there is no risk of material misstatement due to fraud in revenue recognition, and the reasons must be documented. ISA 240's own example is an entity with a single type of simple revenue transaction, such as rental income from a single let property. A trading company with many customers, discounts, rebates and year-end pressure will rarely qualify.
The presumption about management override of controls is different: it cannot be rebutted, and its required responses, including journal entry testing, apply on every audit. The IAASB has issued a revised ISA 240 that strengthens the response to fraud risks; firms should update their methodology to it.
Revenue schemes seen in small businesses
Responses work better when the team has a specific scheme in mind. Common ones:
- Fictitious sales to real or invented customers, often reversed after year end.
- Premature recognition: invoicing before goods are delivered or work is done, or recognising bill-and-hold sales without the customer's request.
- Side agreements: rights of return, extended credit or rebates agreed outside the contract.
- Channel stuffing: pushing excess stock to distributors near year end, with an understanding it can come back.
- Round-tripping: money sent out to a related party and returned as "sales".
- Unrecorded cash sales: takings kept out of the books, for personal use or to reduce tax.
- Lapping: receipts from one customer used to cover money taken from another.
Ask, for this client: who could do it, how, and where would it show?
Targeted substantive procedures
A response is targeted when it would detect the scheme the team has in mind. Examples:
| Scheme | Targeted procedure |
|---|---|
| Fictitious sales | Analyse sales by customer; investigate new customers with large year-end sales; match receivables to receipts after year end |
| Premature recognition | Cut-off testing either side of year end; credit notes raised after year end; delivery evidence for late invoices |
| Side agreements | Confirm contract terms, not just balances, with significant customers; ask sales staff and in-house lawyers about terms |
| Channel stuffing | Compare year-end sales to distributors with prior periods; review returns after year end |
| Unrecorded cash sales | Reconcile till and point-of-sale records to bankings; analyse gross margin by month and branch |
Disaggregated analytics, by month, product, branch or customer, are far more likely to reveal manipulation than a comparison of annual totals. Build some unpredictability in: change the timing, the locations visited or the basis of selection from last year.
Achekam's Audit Intelligence can help focus detailed testing: it risk-scores a loaded population, such as the year's sales invoices, and proposes a sample. A reviewer who did not prepare the plan approves it before the draw, and every draw can be reproduced from its stored seed. The cut-off part of the response is covered in testing revenue cut-off at year end.
Management override and journal testing
Many revenue frauds are completed with a journal: a manual entry to revenue and receivables at year end, a reversal of a provision for returns, a reclassification from deferred income. ISA 240 requires the auditor to test the appropriateness of journal entries and other adjustments, with particular attention to entries made at the end of the period.
In Achekam, staff load a whole-population journal extract as CSV and map its columns, and Achekam flags entries such as manual, weekend, after-hours and post-close postings for staff to select and test. The CSV is not stored; its hash and row count are. For revenue, add criteria of your own: manual entries crediting revenue, entries to revenue from unusual accounts, and entries posted by people who do not normally post to revenue. The mechanics are covered in journal entry testing on a whole population.
Documenting the response and any consultation
ISA 240 requires the file to show the identified fraud risks, the overall and specific responses, the results, and, where the revenue presumption is rebutted, the reasons.
On the revenue work item, each procedure is marked done only with a written response and its documents, or set aside with a reason, and steps are never deleted. Make the response to each targeted procedure name the scheme it was designed to detect, so the reviewer can see the link from risk to test.
Staff can ask AI to draft a procedure's response or a conclusion on the working paper, and the draft goes into the file only when a person saves it. Useful for wording; the judgement whether the evidence rules a scheme out is the team's.
When something looks wrong, such as a large credit note after year end with no convincing explanation, or a customer who denies a side agreement the sales manager described, the matter deserves a formal record. Staff can take a technical consultation from question to conclusion and closure, and record a difference of opinion with each party's position, escalation and resolution.
The IAASB's page on ISA 240 (Revised) describes the revised standard, which clarifies the auditor's responsibilities, strengthens the response to fraud risks and adds transparency in the auditor's report.
Start at planning
At the next planning meeting, replace the standard sentence with a short paragraph: how revenue at this client could be misstated through fraud, by whom, and which procedure will look for it. If the team cannot write it, the response is not yet designed.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
