Responding to Fraud Risks Through Detection, Response, and Documentation

Fraud risk affects more than the list of procedures in an audit program. It changes the auditor’s skepticism, staffing, supervision, timing, sample selection, communication with governance, and documentation. Once a fraud risk is identified, the audit file should show a clear path from the risk to the response.

AUD questions often ask whether the auditor should do something general, such as “be skeptical,” or something specific, such as test journal entries, inspect side agreements, expand cutoff testing, or add unpredictability. Choose the response that directly addresses the fraud path described in the fact pattern.

Fraud Brainstorming

The engagement team discusses how fraud could cause a material misstatement. The discussion should include both fraudulent financial reporting and misappropriation of assets, but it should not stop at broad categories. A useful brainstorming result identifies the account, assertion, possible scheme, and planned response.

The auditor should update the fraud risk assessment when new information arises. Fraud assessment is not completed once planning ends.

Required and Tailored Responses

Fraud responses can be overall responses or assertion-level responses.

The auditor should not respond to fraud risk with management representations alone. Representations are useful, but they do not replace audit evidence.

Unpredictability

Unpredictability reduces the chance that management or employees can anticipate and avoid the auditor’s procedures. It is especially useful when fraud could be concealed through routine timing or predictable testing.

Examples include:

• Performing procedures at unexpected locations.
• Testing transactions from unusual periods.
• Selecting accounts or locations not tested in prior years.
• Performing surprise inventory counts.
• Changing the nature of evidence requested.
• Expanding journal-entry search criteria.

Unpredictability should still be purposeful. Random variation is less persuasive than a changed procedure tied to a plausible fraud risk.

Journal Entry Testing

Journal entry testing is central to fraud response because management override often occurs through manual entries or consolidation adjustments. The auditor commonly focuses on entries that are unusual, unsupported, posted late, posted by unexpected users, posted to suspense accounts, or made to accounts affected by fraud pressure.

The auditor should evaluate both the entry and the business purpose. A valid entry can still require additional evidence if the timing, preparer, amount, or account combination is unusual.

Documentation Expectations

Documentation should make the fraud-risk logic reviewable. A reviewer should be able to see why the risk was identified, what procedure responded to it, what evidence was obtained, and whether the result changed the risk assessment.

    flowchart LR
	    A["Fraud risk identified"] --> B["Affected account and assertion"]
	    B --> C["Planned response"]
	    C --> D["Procedure performed"]
	    D --> E["Evidence and conclusion"]
	    E --> F["Reassessment if needed"]

Documentation commonly includes:

• The fraud brainstorming topics and participants.
• Identified fraud risks and affected assertions.
• Overall and assertion-level responses.
• Journal-entry testing approach and criteria.
• Procedures over estimates and significant unusual transactions.
• Communications with management and those charged with governance.
• Any changes to risk assessment during the audit.

Example: Revenue Side Agreements

A software company has aggressive growth targets and several large contracts signed near year-end. The engagement team identifies a fraud risk that revenue could be recorded before performance obligations are satisfied or despite side agreements granting cancellation rights.

The auditor may respond by:

• Inspecting contracts and amendments for unusual terms.
• Confirming terms directly with customers when appropriate.
• Testing revenue cutoff around year-end.
• Reviewing credit memos and returns after year-end.
• Searching for side agreements outside the standard contract repository.
• Discussing the risk with the audit committee.

The audit file should connect the identified fraud risk to occurrence, cutoff, and presentation or disclosure procedures.

Common Exam Traps

• Treating fraud brainstorming as optional or purely administrative.
• Choosing management inquiry when more persuasive evidence is available.
• Responding to fraud risk only by increasing sample size, without changing procedure nature.
• Ignoring journal entries because transaction-level controls appear effective.
• Failing to document changes when fraud risk is identified after planning.
• Treating misappropriation of assets and fraudulent financial reporting as the same risk.

Key Takeaways

• Fraud risk response must be tied to a specific fraud path.
• Unpredictability should be purposeful and risk-based.
• Journal-entry testing addresses management override.
• Documentation should show the link from risk identification to procedures and conclusions.

Fraud Risk Detection, Response, and Documentation Quiz