Advanced Auditing, Assurance and Professional Ethics · General Auditing Principles and Auditors Responsibilities

Risks of Material Misstatement Due to Fraud (SA 240)

Updated 5 October 2026 · Fact-checked

Under SA 240, you identify and assess the risks of material misstatement due to fraud using fraud risk factors (incentive or pressure, opportunity, rationalisation). You presume fraud risk in revenue recognition, treat management override of controls as always present, and respond with overall responses, tailored procedures and unpredictable tests.

Understand Risks of Material Misstatement Due to Fraud

Fraud is an intentional act by management, those charged with governance, employees or third parties, involving deception to gain an unjust or illegal advantage. Two types matter for the financial statements: fraudulent financial reporting (misstating numbers or disclosures) and misappropriation of assets. Error is unintentional. Intent is the difference.

You cannot see intent directly. So SA 240 asks you to look for fraud risk factors. These are events or conditions that suggest an incentive or pressure to commit fraud, an opportunity to do it, or an attitude or rationalisation that justifies it. Examples: bonus tied to profit targets, weak controls over cash, and management that treats aggressive accounting as acceptable.

SA 240 then tells you how to turn those factors into risks. You discuss within the engagement team how and where the financial statements could be misstated by fraud. You make enquiries of management, those charged with governance and internal audit. You consider unusual or unexpected relationships found in analytical procedures. Then you identify and assess the fraud risks at the financial statement level and at the assertion level.

Two items are built into the standard. First, you presume that there are risks of fraud in revenue recognition. You evaluate which types of revenue, transactions or assertions give rise to it. If you conclude that the presumption does not apply, you document why. Second, management override of controls is a risk in every audit. Management can override controls that otherwise look effective, because it is in a position to manipululate records directly. You treat these risks as significant risks, so you must understand the related controls.

Your response has three layers: overall responses (such as assigning more experienced staff and showing more professional skepticism), audit procedures that address the assessed assertion-level risks, and procedures for management override that are always performed. Include an element of unpredictability in the procedures.

Key rules to remember

Fraud risk factors: Incentive or pressure + Opportunity + Attitude or rationalisation; Use these three heads to classify every factor in a case. Fraud is more likely when all three are present.
Presumed risk: revenue: Revenue recognition: presume fraud risk unless rebutted and documented; The presumption can be rebutted for a type of revenue or an assertion, with reasons documented. Fraud risks identified are treated as significant risks.
Mandatory procedures for management override: Journal entries + Accounting estimates (bias) + Significant unusual transactions; Test appropriateness of journal entries and other adjustments, review estimates for bias, and evaluate the business rationale of significant transactions outside the normal course.
Layers of response: Overall responses + Assertion-level procedures + Override procedures; Add unpredictability in the nature, timing or extent of procedures.
Fraud vs error: Intentional act = fraud; unintentional = error; The auditor does not make legal determinations of whether fraud occurred.

How to solve Risks of Material Misstatement Due to Fraud questions

Use this order for any case or theory question on fraud risk. It keeps the answer in provision, facts and conclusion form.

1Read the case and underline every fact that could be a fraud risk factor, such as targets, weak controls, dominant management or unusual transactions.
2Classify each fact as incentive or pressure, opportunity, or attitude or rationalisation. Say which one it is.
3State the SA 240 requirement that applies: team discussion, enquiries, analytical procedures, presumed revenue risk or management override.
4Conclude on the risk: say that the risk of material misstatement due to fraud is significant, and at which level (financial statement or assertion).
5List the response: overall responses first, then specific procedures for the identified assertion, then the override procedures.
6Add unpredictability and, where relevant, the need to document the reasons if you rebut the revenue presumption.
7If fraud is found or suspected, mention evaluating the effect on the audit, communicating with management or those charged with governance, and considering the written representations.

Quickest way: Factor – Risk – Response in three lines

When to use it: Use for 4 to 6 mark questions or MCQs where you have little time.

Tag the facts as I (incentive), O (opportunity) or R (rationalisation) in the margin.
Write the risk: revenue presumed, or override, or a specific asset misappropriation.
Write the response in a single list: overall, specific, override tests, unpredictability. For MCQs, pick the option that treats the risk as significant and does not rely on management's explanations alone.

Common mistakes in Risks of Material Misstatement Due to Fraud

Saying the auditor is responsible for preventing and detecting all fraud.
Students mix up the auditor's duty with management's.
Fix: Write that management and those charged with governance are primarily responsible for prevention and detection. The auditor obtains reasonable assurance and is not a guarantor.
Treating revenue fraud risk as optional.
Students think it applies only if the case mentions it.
Fix: State that it is presumed. If you conclude it does not apply, you must document the reasons.
Assessing management override as low if controls look strong.
Students link the risk to control strength.
Fix: Override risk is present in every audit and cannot be rebutted. Always perform the mandatory procedures.
Listing only fraud triangle labels without matching them to case facts.
Memorised answers replace application.
Fix: Quote the fact, then name the factor type. This earns case-scenario marks.
Giving only overall responses and no specific procedures.
Students forget the three layers.
Fix: Always give overall responses, assertion-level procedures and override procedures, with an unpredictable element.
Concluding that the auditor must decide whether a legal fraud has occurred.
The word fraud suggests a legal finding.
Fix: Say that the auditor assesses whether the financial statements are materially misstated, whether due to fraud or error, and does not make legal determinations.

Worked examples

Example 1

Case: Alpha Ltd's managing director holds 70% of the shares and also chairs board meetings. The MD's bonus depends on reaching revenue of ₹500 crore. Around year-end, sales invoices of ₹18 crore were booked in the current year for goods shipped in the first week after year-end. Internal controls over journals are weak. Identify the fraud risk factors and state your response.

Show the solution

Incentive or pressure: the bonus depends on a revenue target of ₹500 crore.
Opportunity: the MD dominates the board and journal controls are weak.
Risk: cut-off manipulation of revenue. The goods were shipped after year-end, so the ₹18 crore relates to the next period. Revenue for the current year is overstated by ₹18 crore and should be reversed, or treated as a misstatement and adjusted.
Link to the incentive: the case gives no total revenue figure, so you cannot quantify the effect of the ₹18 crore on the ₹500 crore target. Say only that if reported revenue is close to ₹500 crore, the ₹18 crore could be decisive. Do not assert that the target depends on this amount. The early booking of revenue near year-end, alongside a revenue-linked bonus, still supports the fraud risk.
Revenue fraud risk is presumed and here it is clearly supported. It is a significant risk at the assertion level (occurrence and cut-off).
Management override is also relevant because journals can be posted by management with little oversight.
Response: assign more experienced team members and increase supervision, and show more professional skepticism.
Specific procedures: test shipping documents, goods dispatch records and customer acknowledgements around year-end to establish the date control passed; trace the ₹18 crore invoices to dispatch dates; ask management to correct the cut-off error and evaluate the uncorrected amount if they refuse.
Override procedures: test journal entries and adjustments posted near the year-end, especially manual ones to revenue; review estimates for bias; evaluate the business rationale of unusual transactions.
Make some tests unpredictable, for example selecting unexpected locations or dates, and communicate with those charged with governance.

Answer: Incentive (bonus tied to the ₹500 crore revenue target) and opportunity (dominant MD, weak journal controls) indicate a significant risk of fraudulent revenue recognition. The ₹18 crore belongs to the next period, so current-year revenue is overstated by that amount and should be adjusted. The case gives no total revenue figure, so the effect on the target cannot be quantified; if reported revenue is close to ₹500 crore, the ₹18 crore could be decisive. Respond with overall responses, detailed cut-off tests, journal entry testing and unpredictable procedures.

Example 2

Case: While auditing Beta Ltd, you note that revenue consists only of fixed-fee monthly subscriptions, received directly in the entity's bank account in the same month as the service. You propose not to treat revenue as a fraud risk. Can you do so, and what must you do?

Show the solution

SA 240 presumes fraud risks in revenue recognition. The presumption is rebuttable, but only where you conclude, after a considered evaluation, that there is no fraud risk for that type of revenue, transaction or assertion.
Simple collection alone is not enough. Evaluate other fraud risk factors too, such as incentives or pressures on management, the recognition period (for example, whether any subscriptions are received in advance and need deferral), and the opportunity to alter timing or amount.
Here, revenue is fixed in price, billed and received in the same month as the service, and paid directly into the bank. If your evaluation finds no advance subscriptions, no deferral issue and no other fraud risk factors, there may be little scope for manipulation of timing or amount.
If you conclude that the presumption does not apply to this revenue, you must document the reasons for that conclusion.
You still cannot rebut management override of controls. Perform the journal entry, estimates and unusual transactions procedures.
Remain alert: if you later find indications of manipulated revenue, or find advance subscriptions that affect the recognition period, revisit the assessment.

Answer: You may rebut the presumption only if a considered evaluation, covering the recognition period and other fraud risk factors and not just simple collection, supports it, and you must document the reasons. Management override cannot be rebutted, so the mandatory override procedures are still required.

Exam tips

In case scenarios, quote the fact and name the factor type (incentive, opportunity or rationalisation). That is how marks are earned.
Always mention that revenue risk is presumed and override is always present. Examiners test both together.
For response questions, structure the answer in three layers and add unpredictability.
For MCQs, choose options that treat fraud risks as significant risks and keep professional skepticism. Reject options that say management's explanation is enough.
Keep fraud and error distinct, and do not suggest the auditor gives a legal view on fraud.

Practice questions from General Auditing Principles and Auditors Responsibilities

Risks of Material Misstatement Due to Fraud in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risks of Material Misstatement Due to Fraud: frequently asked questions

What are the three fraud risk factors in SA 240?

They are incentive or pressure, opportunity, and attitude or rationalisation. They are often called the fraud triangle. Use them to classify the facts in a case.

Can the revenue fraud presumption be rebutted?

Yes. If you conclude it does not apply to a type of revenue, transaction or assertion, you document the reasons. Without that documented reasoning, treat it as a fraud risk.

Can management override of controls be rebutted?

No. Management is always in a position to override controls, so the risk is present in every audit. You always perform procedures on journal entries, estimates and significant unusual transactions.

Is the auditor responsible for detecting every fraud?

No. Management and those charged with governance are primarily responsible for prevention and detection. The auditor obtains reasonable assurance that the financial statements are free from material misstatement, whether due to fraud or error.