Auditing Standards and Fraud

Auditing Standards & Fraud
U.S. (AICPA)	AU-C Section 240
U.S. (issuers)	PCAOB AS 2401, AS 2110, AS 2415; SOX §404
International	ISA 240 (Revised), issued July 2025
ISA 240 (Revised) effective	Periods beginning on or after 15 December 2026
Standard of assurance	Reasonable, not absolute
Presumed risks	Revenue recognition; management override of controls

Auditing standards on fraud define what an independent auditor must do to obtain reasonable assurance that financial statements are free of material misstatement, whether caused by error or fraud. They do not make the auditor a guarantor and they do not turn the audit into a forensic investigation; but they require a fraud-oriented mindset, specific procedures, and documentation. Large frauds that evaded audit—Enron, WorldCom, Wirecard, Luckin—repeatedly show the gap between what the public expects and what the standards require (see Major Fraud Case Studies and Financial Statement Fraud).

1 The standards

AU-C 240 (Consideration of Fraud in a Financial Statement Audit) governs U.S. private-company audits under AICPA standards. PCAOB AS 2401 (same title) and AS 2110 (Identifying and Assessing Risks of Material Misstatement) govern audits of SEC issuers. ISA 240 applies in the many jurisdictions that adopt IAASB standards. They share a common architecture:

• Professional skepticism throughout, including setting aside past experience that management is honest.
• A team brainstorming session on how and where the entity might be susceptible to fraud.
• Inquiries of management, those charged with governance, internal audit and others about knowledge or suspicion of fraud.
• Evaluation of fraud risk factors organized by the fraud triangle (incentive/pressure, opportunity, attitude/rationalization).
• Two presumed fraud risks: improper revenue recognition (rebuttable, with documented reasons) and management override of controls (never rebuttable).
• Mandatory responses to override: test journal entries and other adjustments, review accounting estimates for bias, and evaluate the business rationale for significant unusual transactions.
• Communication of identified or suspected fraud to appropriate management levels, governance, and, where required, regulators.

For issuers, the PCAOB standards operate alongside SEC rules and the Sarbanes-Oxley Act of 2002 (SOX), which created the PCAOB itself after Enron and Arthur Andersen (see Case Studies).

2 ISA 240 (Revised)

The IAASB issued a revised ISA 240 in July 2025. According to the IAASB, it clarifies the auditor's responsibilities, strengthens a "fraud lens" in risk identification, assessment and response, and increases transparency in auditor's reports of publicly traded entities. It is effective for audits of financial statements for periods beginning on or after 15 December 2026, with early adoption permitted and encouraged.^[1] Individual jurisdictions must adopt it into local standards before it binds auditors there; for example, South Africa's regulator announced adoption in early 2026.^[2] Practitioners should verify the status in their own jurisdiction, and note that U.S. AICPA and PCAOB standards are separate instruments whose own revision status is independent of the IAASB project.

3 Auditor versus forensic accountant; the expectation gap

Dimension	Financial statement audit	Forensic engagement
Trigger	Annual/periodic requirement	Allegation, red flag, or litigation
Objective	Opinion on whether statements are materially fairly presented	Determine whether fraud occurred, who, how, how much
Materiality	Threshold-driven; small items may be ignored	Any amount may matter; intent is key
Scope	Sampling, risk-based	Often targeted and exhaustive on the suspected area
Output	Audit report	Report, workpapers, expert testimony (see Evidence and Testimony)
Independence	Required of auditor	Required for experts, differs for consultants

The expectation gap is the difference between what users believe auditors do (detect all fraud) and what standards require (reasonable assurance of detecting material misstatements). It has persisted for decades. ACFE data show that external audit is the initial detection method in only about 3% of occupational-fraud cases, versus 43% for tips.^[3] That figure does not mean audits are valueless; the ACFE also associates the presence of an external audit with materially lower losses, perhaps through deterrence. Auditors who find indicators of fraud are expected to stop, escalate, and often refer to forensic specialists, whose role and ethics are covered in Forensic Accountant Ethics.

4 SOX 404, SAB 99 and materiality

SOX §302 requires the CEO and CFO of an issuer to certify the financial statements and the effectiveness of disclosure controls; §906 adds criminal penalties for knowingly false certifications. §404(a) requires management to assess internal control over financial reporting (ICFR), conventionally against the COSO framework (see Internal Controls and Fraud Risk Assessment). §404(b) requires the external auditor to attest to ICFR for accelerated and large accelerated filers; non-accelerated filers have been permanently exempted from 404(b) since the Dodd-Frank Act of 2010. A material weakness is a deficiency, or combination, such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.

The SEC's Staff Accounting Bulletin No. 99 (1999) rejects purely numerical materiality. A common 5% of pre-tax income rule of thumb is only a starting point; qualitative factors can make small misstatements material, including those that mask a change in earnings trends, turn a loss into a profit, hide a failure to meet analyst expectations, affect compliance with loan covenants, or increase management compensation. SAB 108 (2006) requires evaluating misstatements under both the "rollover" and "iron curtain" approaches. For fraud work, SAB 99 matters because intentional misstatements are rarely "immaterial."

5 Forensic techniques in fraud-focused audit and examination

5.1 Journal-entry testing

Management override is most often executed through manual top-side entries. Procedure: (1) obtain the full general-ledger population and reconcile its total debits and credits to the trial balance (completeness); (2) filter on risk criteria; (3) vouch selected entries to support. Typical criteria: posted by users outside the finance function or by senior executives; posted in the last days of a period or after period close; round-number amounts (e.g. ending in 000); no description or unusual descriptions; unusual account pairings (debit cash/receivable, credit revenue, with a later reversal); weekend or holiday posting; entries to seldom-used accounts. Illustration: of 1,200,000 lines, 340 are posted by non-finance users, 9,800 fall in the last three days of the quarter, and 6,100 are round thousands; the intersection yields 112 lines, which are traced to approvals and source documents. The evidence is the filtered population with user IDs, timestamps and, ideally, system audit logs.

5.2 Analytical review and ratio trend tests

Compute days sales outstanding (DSO = receivables / revenue × days). Suppose Q1 revenue is $50.0M with receivables of $9.0M (DSO = 9.0/50.0 × 90 = 16.2 days) while Q4 revenue is $80.0M with receivables of $30.0M (DSO = 30.0/80.0 × 90 = 33.75 days). Revenue grew 60% but receivables more than tripled: a signal of fictitious or premature sales. Add gross margin by product, cash conversion (operating cash flow / net income), and inventory days. The Beneish M-score combines eight indices (DSRI, GMI, AQI, SGI, DEPI, SGAI, LVGI, TATA) into a probability-of-manipulation score; the original 1999 study used a cutoff near −1.78, and later users often apply −2.22.^[4] It is a screening tool with false positives, not evidence of intent. See Fraud Detection Analytics and Analytical Methods.

5.3 External confirmations and independent evidence

Evidence obtained directly from third parties is stronger than evidence supplied by the client. Controls over confirmations: the auditor selects the respondent, sends the request, and receives the reply directly, verifying the respondent's address and contact independently (not from client-provided details). Red flags include replies from free-email domains, replies delivered through the client, balances "confirmed" by the client's own trustee or agent, and refusals to allow direct contact. Complement with bank statements obtained directly, customer-count and shipping-document tests, and physical inspection of inventory and, for retailers, store-level verification such as foot-traffic or point-of-sale data comparisons.

5.4 Revenue cut-off and side-agreement tests

Select shipments and invoices in the five days before and after period-end and trace to shipping documents and customer acceptance. Review credit memos and returns in the first weeks of the next period: a spike (for example, returns of 7% of prior-quarter sales versus a normal 1.5%) suggests channel stuffing. Inquire of sales, legal and operations personnel—not only finance—about side letters, bill-and-hold and extended payment terms (see Interviewing).

5.5 Related-party and unusual-transaction tracing

Search customer and vendor masters, contracts, and public registries (see OSINT and Asset Tracing) for undisclosed related parties. In the SEC's account of the Luckin scheme, sales were fabricated through related parties using three purchasing schemes; the test is to trace cash from the "customer" back to its source and see whether it originated with the reporting entity or its affiliates ("round-tripping").

5.6 Cash proof and bank-flow reconstruction

Reconstruct total receipts and disbursements from bank statements and compare with recorded revenue and expense. A gap between recorded revenue and bank deposits that is not explained by receivables is quantifiable evidence; the method is the same as the indirect proofs in Net Worth Method.

6 Going-concern red flags

PCAOB AS 2415 and AU-C 570 require the auditor to evaluate whether substantial doubt exists about the entity's ability to continue as a going concern for a reasonable period (generally one year after the financial statements are issued or available to be issued; management's own evaluation is under ASC 205-40). Indicators include recurring operating losses, negative operating cash flow alongside reported profits, working-capital deficiency, loan covenant violations, defaults, reliance on short-term borrowings to finance long-term assets, inability to pay suppliers on normal terms, loss of a key customer or licence, pending litigation, and unusually large related-party funding. In fraud cases, a mismatch between reported profit and persistent cash shortfalls is among the most reliable signals.

7 Audit failures: Wirecard and Luckin

Wirecard. The German payments company collapsed in June 2020 after admitting that €1.9 billion in balances supposedly held in trustee accounts in Asia did not exist. Auditor Ernst & Young (EY) had audited the company for years. Germany's audit oversight body (APAS) found violations of professional obligations in EY's audits for 2016–2019 and, per press reports, imposed a two-year ban on new listed-company audit clients and a €500,000 fine; investors have sought damages exceeding €700 million from EY.^[5] The lesson for confirmation procedures is that evidence routed through third parties selected by the client is weak evidence. The criminal trial of former CEO Markus Braun and two co-defendants began in Munich in December 2022; reporting in autumn 2026 indicated closing arguments were planned for late October with a verdict to follow, so no outcome should be assumed here.^[5]

Luckin Coffee. On 16 December 2020 the SEC announced that the China-based chain had fabricated more than $300 million of retail sales from at least April 2019 through January 2020, inflating expenses to conceal the fabrication, and that Luckin agreed to pay a $180 million penalty without admitting or denying the allegations.^[6] The fraud became public after a short-seller report built on thousands of store-hours of video observation and receipt collection—an OSINT-style counting of actual customers—preceded the company's own disclosure. It illustrates a technique available outside the audit: independent physical verification of the revenue driver (see Anti-Corruption OSINT).

See also: Internal Controls and Fraud Risk Assessment, Financial Statement Fraud, International Forensic Standards, Red Flags, Litigation Support and Damages.

References

1. IAASB (July 2025). "IAASB Revises Fraud Standard to Enhance Public Trust" and ISA 240 (Revised). iaasb.org
2. ACTS (2026). "IRBA Adopts Revised ISA 240 on Auditor Fraud Responsibilities." acts.co.za
3. ACFE (2024). Occupational Fraud 2024: A Report to the Nations. acfe.com
4. Beneish, M. D. (1999). "The Detection of Earnings Manipulation." Financial Analysts Journal 55(5), 24–36.
5. Börsen-Zeitung. "Wirecard trial enters its third year." boersen-zeitung.de; EY sanction reporting: allnews.ch
6. SEC (16 Dec 2020). Press Release 2020-319, Luckin Coffee. sec.gov