PCAOB AS 2401 Fraud Risk: What the Auditor Must Do
Understanding the auditor's responsibilities for identifying fraud risks, exercising professional skepticism, testing management override, and documenting audit conclusions
raud remains one of the most challenging risks confronting external auditors.
Financial statement fraud may involve manipulated revenue, concealed liabilities, improper accounting estimates, unauthorized journal entries, or intentional omissions from financial statement disclosures.
These activities can be difficult to detect because the individuals responsible for preparing financial statements may also possess the authority to override internal controls.
The Public Company Accounting Oversight Board (PCAOB) addresses these risks through AS 2401, Consideration of Fraud in a Financial Statement Audit.
The standard establishes important requirements for how auditors consider fraud when planning, performing, and documenting financial statement audits.
However, an important distinction must be understood:
The auditor is not responsible for preventing every fraud. The auditor is responsible for obtaining reasonable assurance that the financial statements are free of material misstatement, whether caused by fraud or error.
That responsibility requires considerably more than asking management whether fraud has occurred.
1. What Does PCAOB AS 2401 Require?
AS 2401 addresses the auditor's consideration of fraud throughout a financial statement audit.
The standard works in conjunction with several other PCAOB auditing standards, particularly:
AS 1000: General Responsibilities of the Auditor in Conducting an Audit.
AS 2110: Identifying and Assessing Risks of Material Misstatement.
AS 2301: The Auditor's Responses to the Risks of Material Misstatement.
AS 2810: Evaluating Audit Results.
AS 1215: Audit Documentation.
The auditor must identify and assess risks of material misstatement due to fraud and design appropriate responses.
These responsibilities extend from initial audit planning through the final evaluation of audit evidence.
Fraud consideration is not a separate exercise completed once at the beginning of the engagement.
It is an ongoing responsibility.
2. Understand the Two Types of Fraud Relevant to Financial Statement Audits
AS 2401 identifies two categories of misstatements arising from fraud.
Fraudulent Financial Reporting
Fraudulent financial reporting involves intentional misstatements or omissions intended to deceive financial statement users.
Examples include:
Recognizing revenue before the applicable recognition criteria are satisfied.
Recording fictitious sales.
Improperly capitalizing operating expenses.
Manipulating reserves or accounting estimates.
Concealing liabilities.
Altering accounting records.
Omitting material disclosures.
For example, management might record fictitious revenue near year-end to meet earnings expectations.
Misappropriation of Assets
Misappropriation involves theft or improper use of organizational assets where the resulting effect causes a material misstatement of the financial statements.
Examples include:
Theft of cash.
Fraudulent vendor payments.
Misappropriation of inventory.
Unauthorized transfers of company assets.
Payments to fictitious employees.
The auditor's focus under AS 2401 is on fraud that could cause material misstatement of the financial statements.
The auditor is not conducting a general-purpose criminal investigation or making legal determinations that fraud has occurred.
3. Professional Skepticism Is a Requirement, Not an Option
AS 2401 emphasizes the importance of professional skepticism.
Professional skepticism requires a questioning mind and critical assessment of audit evidence.
Auditors should neither assume that management is dishonest nor accept management's representations without appropriate corroboration.
Consider a situation in which management reports unusually strong revenue growth during a period when the company's industry is experiencing declining demand.
Management explains that the increase resulted from successful sales initiatives.
That explanation may be accurate.
However, the auditor should evaluate whether the explanation is consistent with other available evidence.
Relevant procedures may include examining customer contracts, shipment records, subsequent collections, and unusual year-end transactions.
Professional skepticism means evaluating the evidence rather than accepting the explanation that management prefers.
4. Conduct Meaningful Fraud-Risk Discussions
The engagement team must discuss how and where the company's financial statements may be susceptible to material misstatement due to fraud.
The discussion should consider opportunities for fraudulent financial reporting and misappropriation of assets.
Potential discussion topics include:
Pressure to achieve earnings targets.
Management compensation incentives.
Significant accounting estimates.
Unusual transactions.
Weaknesses in internal controls.
Related-party transactions.
Opportunities for management override.
Industry and economic pressures.
The engagement team should also consider how fraud could be perpetrated and concealed.
For example, if revenue recognition is a significant risk, the team should discuss potential schemes involving fictitious sales, premature recognition, side agreements, or improper cutoff.
The discussion must be documented, including its timing, participants, and subject matter.
A generic statement that the team discussed fraud risks provides limited evidence of the substance of the discussion.
5. Perform Fraud-Risk Assessment Procedures
The auditor must obtain information relevant to identifying and assessing fraud risks.
This involves more than interviewing the chief financial officer.
Relevant procedures under AS 2110 include inquiries of management, the audit committee, internal audit personnel where applicable, and others within the company.
Auditors should also consider analytical procedures, unusual relationships, identified fraud risk factors, and other information obtained during the audit.
Example: Inconsistent Financial Results
Assume a company reports:
Indicator | Current-year change |
Revenue | +18% |
Accounts receivable | +42% |
Operating cash flow | -15% |
Industry sales | -3% |
These hypothetical results do not establish that fraud has occurred.
However, the differences may warrant further investigation.
The auditor should consider whether revenue is properly recognized, receivables are collectible, and management's explanations are supported.
Analytical procedures help identify areas requiring attention.
They do not independently establish the absence or existence of fraud.
6. Evaluate the Fraud Triangle
AS 2401 discusses three conditions commonly associated with fraud.
Incentive or Pressure
Individuals may face pressure to achieve financial targets or avoid unfavorable outcomes.
Examples include earnings expectations, debt covenant requirements, or compensation arrangements.
Opportunity
Fraud may be possible because of inadequate controls, excessive access privileges, weak oversight, or management's ability to override established procedures.
Attitude or Rationalization
Individuals may justify improper conduct as temporary, necessary, or otherwise acceptable.
These three conditions are commonly called the fraud triangle.
They provide a useful framework for identifying fraud risk factors.
However, the presence of a risk factor does not prove fraud, and the absence of obvious factors does not eliminate fraud risk.
Auditors must evaluate the circumstances and supporting evidence.
7. Revenue Recognition: A Presumed Fraud Risk
Revenue recognition is one of the most important areas of fraud-risk assessment.
AS 2110.68 requires the auditor to presume that there is a fraud risk involving improper revenue recognition and evaluate which types of revenue, revenue transactions, or assertions give rise to such risks.
This does not mean that every revenue assertion automatically represents an identified fraud risk.
It means the auditor must perform a meaningful assessment.
Potential fraud risks include:
Fictitious sales.
Premature revenue recognition.
Improper cutoff.
Undisclosed side agreements.
Improper treatment of returns.
Manipulation of contract terms.
Incorrect recognition of variable consideration.
Can the Auditor Conclude Revenue Recognition Is Not a Fraud Risk?
Yes, in appropriate circumstances.
However, AS 2401.83 requires documentation of the reasons supporting the conclusion when improper revenue recognition has not been identified as a fraud risk in a particular circumstance.
A statement such as "revenue is straightforward" is not necessarily sufficient support.
The auditor should explain the relevant facts and reasoning.
The presumption must be evaluated—not ignored.
8. Management Override: A Fraud Risk That Requires Specific Procedures
Management override is especially important because senior management may possess the authority to circumvent controls that otherwise appear effective.
AS 2401.57–.67 addresses procedures specifically designed to respond to management override.
These procedures include three major areas.
A. Examining Journal Entries and Other Adjustments
Auditors must design procedures to examine journal entries and other adjustments for evidence of possible material misstatement due to fraud.
Potential risk indicators include:
Entries posted near period-end.
Entries made by unusual users.
Entries posted outside normal business hours.
Entries involving seldom-used accounts.
Entries containing unusual descriptions.
Entries made without appropriate supporting documentation.
Consolidation adjustments outside the general ledger.
The auditor should understand the financial reporting process and controls over journal entries.
The auditor must use professional judgment to determine which entries require testing.
Testing only a few randomly selected journal entries without considering fraud risk characteristics may not adequately address the requirement.
B. Reviewing Accounting Estimates for Bias
Management can manipulate financial results through accounting estimates.
Examples include:
Allowances for credit losses.
Inventory reserves.
Impairment assessments.
Warranty liabilities.
Fair value estimates.
Contingent liabilities.
Auditors must review accounting estimates for possible bias that could result in material misstatement due to fraud.
This includes considering whether differences between estimates and subsequent outcomes reveal possible management bias.
Individual estimates may appear reasonable while collectively producing results favorable to management.
The auditor should evaluate that possibility.
C. Evaluating Significant Unusual Transactions
Significant transactions outside the normal course of business may create opportunities for fraudulent financial reporting.
The auditor should evaluate whether the business purpose, or lack of one, suggests possible fraudulent financial reporting or concealment of asset misappropriation.
For example, a company might enter into an unusual transaction with a related party shortly before year-end.
The auditor should understand the transaction's terms, business rationale, accounting treatment, and supporting evidence.
Management's explanation alone may not provide sufficient appropriate audit evidence.
9. Fraud Risks Must Be Linked to Audit Procedures
Identifying a fraud risk does not complete the auditor's responsibility.
AS 2301 requires the auditor to design and perform procedures that respond to assessed risks.
Consider a company with a fraud risk involving fictitious year-end revenue.
A generic audit program that tests a small sample of sales transactions may not adequately address the specific risk.
The audit response might include:
Testing transactions recorded immediately before and after year-end.
Confirming relevant customer balances or transaction terms.
Examining evidence of shipment or service delivery.
Reviewing subsequent credit memos and returns.
Investigating unusual manual revenue entries.
Evaluating side agreements or contract modifications.
The procedures should address the specific ways a material misstatement could occur.
A fraud risk without a corresponding audit response represents a gap in the audit approach.
10. Evaluate Fraud Risks at the Assertion Level
Fraud-risk assessment should identify the relevant financial statement assertions affected.
For example:
Fraud risk | Relevant assertions | Possible audit response |
Fictitious revenue | Occurrence | Examine customer and delivery evidence |
Premature revenue recognition | Cutoff, occurrence | Test transactions around period-end |
Unrecorded liabilities | Completeness | Search for unrecorded liabilities |
Overstated inventory | Existence, valuation | Observe inventory and test valuation |
Manipulated reserves | Valuation | Evaluate assumptions and management bias |
Unauthorized journal entries | Depends on affected accounts | Perform risk-focused journal-entry testing |
The assertions shown are illustrative. The actual assertions and procedures depend on the facts and circumstances.
The workpaper should demonstrate the linkage between the fraud risk, affected assertions, and procedures performed.
This linkage is particularly important during PCAOB inspections.
11. What Must the Auditor Do When Possible Fraud Is Identified?
The auditor's responsibilities do not end when a suspicious transaction is identified.
The auditor must evaluate the circumstances and determine whether additional procedures are necessary.
AS 2810 addresses the evaluation of identified misstatements that may indicate fraud.
If a misstatement appears intentional and its effect could be material or cannot readily be determined, the auditor must obtain additional evidence to determine whether fraud occurred or is likely to have occurred and evaluate its effect on the financial statements and audit report.
The auditor should also consider:
Whether management representations remain reliable.
Whether the original fraud-risk assessment requires revision.
Whether additional transactions should be examined.
Whether controls can still be relied upon.
Whether the matter affects other accounts or disclosures.
Whether collusion may have occurred.
Whether the audit opinion or engagement continuation is affected.
A small intentional misstatement involving senior management may have implications extending well beyond its monetary amount.
12. Communicating Fraud to Management and the Audit Committee
AS 2401.79–.82 establishes important communication responsibilities.
When the auditor determines that evidence indicates fraud may exist, the matter should be communicated to an appropriate level of management, even when the suspected matter appears inconsequential.
Fraud involving senior management, and fraud causing material misstatement, must be reported directly to the audit committee in a timely manner and before issuance of the auditor's report.
The auditor must also consider relevant communications concerning significant deficiencies, material weaknesses, and fraud-related risks.
In certain circumstances, legal or regulatory requirements may create reporting obligations beyond management and the audit committee.
The auditor should evaluate those obligations carefully.
An auditor should not allow concerns about management relationships to interfere with required fraud communications.
13. Fraud Documentation: What PCAOB Inspectors Expect to See
AS 2401.83 establishes specific fraud-related documentation requirements.
The audit documentation should address:
Engagement team fraud discussions: When they occurred, who participated, and what was discussed.
Fraud-risk assessment procedures: The inquiries, analytical procedures, and other work performed.
Identified fraud risks: Risks at the financial statement and assertion levels, linked to the auditor's responses.
Revenue recognition: The reasons supporting any conclusion that improper revenue recognition is not an identified fraud risk.
Results of fraud procedures: Including procedures addressing management override.
Additional fraud indicators: Unusual conditions or relationships and the auditor's responses.
Fraud communications: The nature of communications with management, the audit committee, and others.
The broader documentation requirements of AS 1215 also apply.
An experienced auditor should be able to understand what was done, what evidence was obtained, and how the engagement team reached its conclusions.
Example: An Inadequate Workpaper
"Fraud risks were considered. No issues noted."
This statement does not demonstrate the procedures performed or the evidence supporting the conclusion.
Example: A More Defensible Workpaper
"The engagement team identified a fraud risk involving premature revenue recognition for contracts containing customer acceptance provisions. The team tested selected year-end transactions, inspected contractual acceptance terms, examined supporting delivery documentation, and evaluated subsequent credit memos. The procedures and results are documented in workpapers REV-12 through REV-16. No exceptions were identified in the items tested."
This example provides a clearer connection between the risk, procedures, evidence, and conclusion.
It remains necessary for the referenced workpapers to support the statements made.
14. Common Fraud-Audit Deficiencies
Several recurring weaknesses can undermine compliance with AS 2401.
Generic Fraud-Risk Assessments
The engagement team uses the same fraud-risk checklist for every client without adequately considering the entity's specific circumstances.
Insufficient Revenue Recognition Analysis
The auditor does not meaningfully evaluate the revenue recognition fraud presumption.
Weak Journal-Entry Testing
The auditor fails to understand the journal-entry population, overlooks relevant adjustments, or does not select entries based on identified fraud risk characteristics.
Inadequate Evaluation of Management Bias
Accounting estimates are tested individually without sufficiently considering patterns that may indicate management bias.
Failure to Investigate Contradictory Evidence
The auditor accepts management explanations despite evidence that appears inconsistent with those explanations.
Missing Risk-to-Procedure Linkage
Fraud risks are identified, but the workpapers do not demonstrate how audit procedures responded to them.
Insufficient Documentation
The audit file contains conclusions without adequate supporting procedures, evidence, or explanations.
These deficiencies can affect the sufficiency and appropriateness of audit evidence and the defensibility of the engagement team's conclusions.
15. Using Artificial Intelligence to Support Fraud-Risk Auditing
Artificial intelligence can assist auditors with fraud-risk identification and analysis.
Potential applications include:
Analyzing journal-entry populations.
Identifying unusual transactions.
Comparing financial results with industry trends.
Reviewing contract terms for unusual revenue provisions.
Identifying inconsistencies in management explanations.
Developing fraud-risk brainstorming questions.
Summarizing fraud-related audit evidence.
Drafting preliminary fraud-risk documentation.
Example AI Prompt
"Review the attached financial statements, trial balance, and journal-entry listing. Identify potential risks of material misstatement due to fraud under PCAOB AS 2401. Consider revenue recognition, management override, unusual transactions, accounting estimates, and relevant fraud risk factors. For each potential risk, identify the affected assertions, supporting indicators, and possible audit responses. Distinguish factual observations from hypotheses requiring additional evidence."
AI may help identify patterns or anomalies.
However, AI-generated observations are not automatically reliable audit evidence.
The auditor must validate the underlying data, evaluate the relevance of the identified risks, and independently determine appropriate audit responses.
For journal-entry testing, auditors should also consider using validated data analytics procedures to identify entries meeting specified risk criteria.
AI can assist with interpretation, but it should not replace reliable population testing, reconciliation, or professional judgment.
16. Practical Fraud-Risk Audit Workpaper Checklist
Before completing the engagement, the auditor should be able to answer the following questions.
Audit responsibility | Key question |
Fraud brainstorming | Was a meaningful engagement team discussion conducted and documented? |
Fraud-risk inquiries | Were appropriate inquiries performed beyond management? |
Fraud risk factors | Were relevant incentives, opportunities, and rationalizations considered? |
Revenue recognition | Was the fraud presumption properly evaluated? |
Management override | Were journal entries, estimates, and significant unusual transactions appropriately addressed? |
Risk linkage | Were identified fraud risks linked to responsive procedures? |
Audit evidence | Were significant management explanations corroborated? |
Audit results | Were unusual findings evaluated for possible fraud implications? |
Communications | Were required fraud matters communicated appropriately? |
Documentation | Does the audit file support the procedures, evidence, and conclusions? |
This checklist is a practical review aid and does not replace the full requirements of the applicable PCAOB standards.
17. Final Thoughts: Fraud Auditing Requires More Than a Checklist
PCAOB AS 2401 establishes an important foundation for the auditor's responsibility to consider fraud in financial statement audits.
The standard requires auditors to maintain professional skepticism, identify fraud risks, respond appropriately, evaluate the results, and document their conclusions.
It also recognizes a fundamental reality:
Management can override controls, manipulate accounting records, and influence the financial reporting process even when an organization appears to have a well-designed internal control system.
This is why journal-entry testing, evaluation of accounting estimates, and examination of significant unusual transactions are important components of the auditor's fraud response.
Auditors must also recognize that fraud risks can evolve throughout the engagement.
New evidence may require reassessment of risks, additional audit procedures, or changes to previously reached conclusions.
The objective is not to complete a checklist demonstrating that fraud was considered.
The objective is to obtain sufficient appropriate evidence to support reasonable assurance that the financial statements are free of material misstatement due to fraud or error.
The most important fraud-audit question is not whether the auditor identified a fraud risk. It is whether the auditor performed and documented procedures sufficient to address that risk.
PCAOB Standards and Authoritative References
About Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) provides Continuing Professional Education (CPE) programs for external auditors, internal auditors, accounting professionals, compliance personnel, and information technology professionals.
Our programs cover PCAOB auditing standards, audit evidence, fraud-risk assessment, internal controls, audit documentation, engagement quality reviews, and practical applications of artificial intelligence in auditing.
Explore upcoming CPE events at www.compliance-seminars.com.
Comments