Advanced Audit and Assurance (International) · Fraud and error

Auditor's Risk Assessment and Response to Fraud Risks

Updated 11 October 2026 · Fact-checked

Under ISA 240 you assess the risks of material misstatement due to fraud, discuss them as a team, and treat revenue recognition and management override as presumed risks. You then respond with overall measures, specific procedures, and journal entry testing, and you keep scepticism throughout.

Understand Auditor's Risk Assessment and Response to Fraud Risks

Fraud is an intentional act to gain an unjust or illegal advantage. The auditor does not prevent or detect all fraud. The auditor must obtain reasonable assurance that the financial statements are free from material misstatement, whether caused by fraud or error. Fraud is harder to find than error because it is often hidden and may involve collusion or forged documents.

The work starts at planning. You perform risk assessment procedures: enquiries of management, those charged with governance and internal audit about their view of fraud risk and any known or alleged fraud; analytical procedures, including unusual or unexpected relationships; and consideration of fraud risk factors (incentive or pressure, opportunity, rationalisation). You also understand the entity, its controls and its environment. Fraud risk factors do not prove fraud, but they raise risk.

The engagement team holds a discussion about how and where the financial statements might be susceptible to fraud. The engagement partner decides which matters are communicated to team members not present. The discussion sets the tone of scepticism and is repeated as new information emerges.

ISA 240 requires you to treat some risks as presumed fraud risks. For revenue recognition, you presume there are fraud risks in revenue. You may rebut this where it is not applicable, but you must document why. Management override of controls is always a significant risk and can never be rebutted, because management can manipulate records and override controls that otherwise look effective. Any identified fraud risk is a significant risk, so you must understand and evaluate the related controls.

Your response has three levels. Overall responses include assigning more experienced staff, using specialists such as forensic experts, more supervision, adding unpredictability to procedures, and reconsidering the nature, timing and extent of work. Specific responses are tailored to the assertion at risk, for example more substantive procedures near the year end for cut-off. Management override procedures are required: test journal entries and other adjustments, review accounting estimates for bias, and evaluate the business rationale of significant unusual transactions.

Key rules to remember

Fraud risk factors: Incentive or pressure + Opportunity + Rationalisation (attitude); Use these three headings to structure risk factors you find in a scenario.
Presumed risk: revenue: Revenue recognition = presumed fraud risk (rebuttable, with documented reason); Rebuttal is possible only with a clear reason, for example simple, non-judgemental revenue.
Presumed risk: management override: Management override = always a significant risk (not rebuttable); Three mandatory responses: journal entries, estimates bias, significant unusual transactions.
Fraud risk is a significant risk: Identified fraud risk → significant risk → evaluate related controls; Also requires substantive procedures specifically responsive to the risk.
Levels of response: Overall response + Specific procedures + Unpredictability; Cover all three when a question asks how the auditor should respond.

How to solve Auditor's Risk Assessment and Response to Fraud Risks questions

Use this method for any scenario question on fraud risk assessment and response.

1Read the requirement and note whether it asks for risks, procedures, or both, and how many marks are available.
2Scan the scenario for fraud risk factors. Sort them into incentive or pressure, opportunity, and rationalisation.
3Identify the specific risk and the assertion or balance affected, such as overstated revenue or inventory valuation.
4State whether it is a presumed risk (revenue, management override) and whether it is a significant risk.
5Give overall responses where relevant: team composition, supervision, specialists, unpredictability.
6Give specific procedures tied to the scenario facts, not generic lists. Say what you will do, on what, and why.
7Include the mandatory management override procedures if the scenario mentions management or journals.
8Show professional skills: apply facts, show scepticism, and conclude on the impact on the audit approach or reporting.

Quickest way: Risk, assertion, response in three lines

When to use it: Use when time is short and the question asks for audit procedures on a fraud risk.

Write the fraud risk factor from the scenario and the pressure, opportunity or rationalisation it shows.
Write the assertion at risk, for example occurrence of revenue or cut-off.
Write three to four procedures, each linked to a scenario fact, plus one overall response such as a more senior team member.

Common mistakes in Auditor's Risk Assessment and Response to Fraud Risks

Listing generic audit procedures that ignore the scenario.
Students memorise lists and write them out without reading the facts.
Fix: Link each procedure to a named fact, balance or person in the scenario.
Saying the auditor is responsible for preventing fraud.
Confusion between management's and the auditor's duties.
Fix: State that management and those charged with governance are responsible for prevention and detection. The auditor obtains reasonable assurance.
Rebutting management override.
Students mix it up with the revenue presumption, which can be rebutted.
Fix: Management override is always a significant risk and cannot be rebutted. Revenue can be, with documented reasons.
Describing journal entry testing without saying what to select.
Students stop at 'test journals'.
Fix: Give selection criteria: entries near the year end, round amounts, unusual accounts, entries by senior management, posted outside normal hours, and entries without descriptions. Then say you will check support and authorisation.
Treating fraud risk factors as proof that fraud occurred.
Pressure from the scenario leads to firm conclusions.
Fix: Say the factors increase the risk and justify more work. Do not accuse without evidence.
Ignoring the team discussion and unpredictability.
Students focus only on substantive tests.
Fix: Mention the team discussion at planning and add unpredictable elements, such as unannounced visits or unusual sample selection.

Worked examples

Example 1

You are the audit senior on Zenith Retail Co. Management bonuses depend on revenue growth of at least 10%. Revenue grew 11%. In the last month before the year end, sales were 30% higher than the monthly average, mainly from a few large wholesale customers, and the finance director posts many manual adjustments. Identify the fraud risks and describe the audit responses. (10 marks)

Show the solution

Fraud risk factors: pressure from the bonus target close to the threshold, and opportunity from manual adjustments controlled by the finance director.
Revenue is a presumed fraud risk. The year-end spike and bonus link suggest overstatement through early recognition, so the risk is not rebutted. Assertions: occurrence and cut-off.
Management override is always a significant risk, and the finance director's manual adjustments increase it.
Overall responses: involve a more experienced team member in revenue, hold a team discussion on this risk, and add unpredictability, such as testing customers not usually selected.
Revenue procedures: test cut-off by checking despatch notes and delivery terms for sales before and after the year end; confirm balances with the large wholesale customers; review credit notes and returns after the year end; compare monthly sales and margins with prior periods.
Override procedures: select manual journals using criteria such as year-end posting, round sums and entries by the finance director, and check support and authorisation; review estimates such as returns provisions for bias; examine significant unusual transactions for business rationale.
Evaluate the controls over revenue and journals, since these are significant risks, and consider enquiries of those charged with governance.

Answer: There are significant fraud risks in revenue (overstatement and cut-off) and management override, driven by the bonus pressure and the finance director's control over adjustments. Respond with senior staffing, unpredictability, detailed cut-off and confirmation testing, targeted journal entry testing, estimate bias review and testing of unusual transactions.

Example 2

Describe how you would perform journal entry testing at Harbor Foods Ltd to respond to the risk of management override. (6 marks)

Show the solution

Understand the process: how journals are initiated, authorised, recorded and posted, and the controls over them.
Obtain a complete population of journals from the ledger and test its completeness by reconciling it to the trial balance.
Choose criteria: entries at or near the year end, post-closing entries, round amounts, unusual account combinations, entries by senior management or users who do not normally post, and entries with no description.
Use data analytics tools to filter the population against those criteria, and select items.
For each item, examine supporting documents, check authorisation and agree the business reason.
Extend testing to journals throughout the period if risk indicates, and evaluate unexplained items with scepticism, considering whether they indicate fraud.

Answer: Reconcile the journal population to the ledger, select high-risk entries using criteria such as year-end timing, round amounts and unusual users, trace them to support and authorisation, and evaluate any unexplained items for signs of fraud.

Exam tips

Mention both presumed risks whenever fraud appears: revenue (rebuttable) and management override (never rebuttable).
Tie every procedure to a fact in the scenario. Generic lists earn few marks.
Structure answers as risk, assertion, response. It scores clearly and saves time.
Use the professional skills marks: show scepticism, apply the facts and conclude on the effect on the audit approach.
If asked about discussion or communication, include the team discussion at planning and escalation to those charged with governance if fraud is suspected.

Practice questions from Fraud and error

Auditor's Risk Assessment and Response to Fraud Risks in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Auditor's Risk Assessment and Response to Fraud Risks: frequently asked questions

Can I rebut the revenue fraud risk in ISA 240?

Yes. The revenue presumption can be rebutted if you conclude that fraud risk is not present, for example for simple, non-judgemental revenue. You must document the reasons. In an exam, rebut only when the scenario clearly supports it.

Why is management override always a significant risk?

Management can override controls that appear effective because they control the accounting records. The risk exists in every entity. For that reason ISA 240 requires set procedures that do not depend on your assessment of controls.

What are the mandatory procedures for management override?

You test the appropriateness of journal entries and other adjustments, review accounting estimates for bias, and evaluate the business rationale for significant transactions outside the normal course of business. You do these whatever your other risk assessments say.

What should I do if I suspect fraud during the audit?

Gather more evidence, discuss with the appropriate level of management or those charged with governance, consider legal and ethical reporting duties, and reassess the risks and audit approach. Where management may be involved, communicate with those charged with governance.