← Luxembourg

Report on the CSSF’s 2025 thematic inspection: “The risk of fraud in revenue recognition in the context of an audit of financial statements”

Published on 26 May 2026 Email this Share this on LinkedIn Share this on Facebook Communiqué Report on the CSSF’s 2025 thematic inspection: “The risk of fraud in revenue recognition in the context of an audit of financial statements” The Commission de Surveillance du Secteur Financier, as authority responsible for the public oversight of the audit profession in Luxembourg, has issued its report on “The risk of fraud in revenue recognition in the context of an audit of financial statements”, which aggregates the results of a thematic review carried out in 2025 in the Big 4 Firms, over a sample of 46 statutory audits, including 17 PIEs. In the framework of this survey, the CSSF has pursued the following objectives: This report sets out recommendations for auditors, which the CSSF encourages them to implement in light of the upcoming ISA 240 (Revised) recently adopted by the IAASB and effective for audits of financial statements for periods beginning on or after December 15, 2026. A full version of the report is available here below: 26 May 2026 The risk of fraud in revenue recognition in the context of an audit of financial statements Studies and reports PDF (1.39Mb) Relevant for Public Oversight of the Audit Profession THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS Report on the CSSF’s 2025 thematic inspection May 2026 TABLE OF CONTENTS Executive summary ........................................... 3 1. 1.1. Objectives of the thematic inspection .................................... 3 1.2. Scope of the thematic inspection .......................................... 4 1.3. Key messages .................................................................... 4 2. Overview of ISA 240 requirements with a priority focus on revenue recognition ............... 5 2.1. Auditors’ responsibilities with regards to fraud ........................ 5 2.2. Interactions between ISA 240 and other ISAs......................... 5 2.3. Risk assessment procedures ................................................. 6 2.4. Identification and assessment of RoMM due to fraud ............... 7 2.5. Respond to the significant risk of fraud in revenue recognition.. 8 3. Results of the CSSF Thematic Review................ 9 3.1. Evaluation of the fraud risk factors ........................................ 9 3.2. Identification and assessment of RoMM due to fraud ............. 10 3.3. Rebuttal of fraud risk presumption in revenue recognition ...... 11 3.4. Design and implementation of internal controls addressing fraud risks in revenue recognition ........................................................ 13 3.5. Responding to the significant risk of fraud in revenue recognition ...................................................................................... 13 APPENDIX: - Glossary of the terms - Useful links THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 2 1. Executive summary 1.1.Objectives of the thematic inspection The thematic review pursued the following objectives: While it is of common view that high-quality audits and trust in audited financial statements play a vital role in financial stability and the efficient functioning of capital markets, it is true that bankruptcies and financial scandals observed in recent years continue to undermine the system. Since these scandals are often caused by fraud and intentional behaviors, Reviewing the adequacy of the evaluation made by the auditors of the types of revenue, revenue transactions or assertions that may give rise to fraud risks in revenue recognition. it calls into question the auditor’s role and responsibilities in this area. Furthermore, evidence from global regulatory inspections continues to highlight significant performance issues in the application of the auditing standards in this regard, as reported by bodies such as the International Considering the reasonableness of the arguments put forward by the auditors to support the rebuttal of the presumed fraud risk in revenue recognition. Forum of Independent Audit Regulators that consistently flag deficiencies related to fraud procedures. Considering the above, the CSSF conducted a thematic review in 2025 Assessing the appropriateness of the audit procedures developed by the auditors to address the RoMM due to fraud in revenue recognition. focusing specifically on a very particular aspect of fraud risk, namely that relating to revenue recognition, for which ISA 240.27 states that “when identifying and assessing the RoMM due to fraud, the auditor shall, based on a presumption that there are risks of fraud in revenue recognition, evaluate which types of revenue, revenue transactions or assertions give rise to such risks […]”. Moreover, the IAASB recently adopted a revised version of the standard ISA 240 effective for audits of financial statements for periods beginning on or after December 15, 2026. In light of the upcoming regulatory changes (highlighted hereafter in the publication with the pink icon on the top left), the CSSF deemed it useful to raise awareness of auditors on this matter for them to identify opportunities to improve. REPORT ON THE THEMATIC INSPECTION ON THE RISK OF FRAUD IN REVENUE RECOGNITION 3 1.2.Scope of the thematic inspection 1.3.Key messages The CSSF assessed a total of 46 statutory audits from Big 4 Firms1 The CSSF has identified several areas for auditors to consider and including 17 PIE audits. A breakdown by industry sector is also provided recommend them to improve their audit procedures to remediate the in the illustration below: observations arising from this inspection and notably: to strengthen their risk assessment procedures to effectively identify and evaluate the specific fraud risk factors present in the facts and circumstances of their engagements. Commercial and industrial sector (52%)2 PFS (17%) Financial sector Credit institutions (20%) Insurance (9%) Private equity (2%) 2 to perform a robust and detailed evaluation to determine which specific products, revenue transactions or assertions present risks of fraud in the revenue recognition process. to refrain from systematically rebutting the fraud risk presumption in revenue recognition in the financial sector and to review the appropriateness of the rationales used. 4 1 3 to identify internal controls that specifically address revenue fraud risks and ensure their designs are appropriate and that they have been adequately implemented; and : Big 4 firms are Deloitte Audit S.à r.l., ERNST & YOUNG S.A., KPMG Audit S.à r.l. and 1 PricewaterhouseCoopers Assurance SCOP. : 42% of audit files from the commercial and industrial sector relate to group audits and 2 consolidated financial statements. to tailor and modify the nature, timing and extent of their audit procedures to adequately address the specific RoMM due to fraud in revenue recognition. 5 To adequately fulfill their responsibilities in this area, auditors will need to be particularly vigilant and maintain a critical mindset throughout their engagement. The CSSF encourages them to take advantage of the changes and clarifications made to the ISA 240 (Revised) to challenge their procedures and work efforts to appropriately address the RoMM that may result from fraud during their statutory audit engagements. THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 4 2. Overview of ISA 240 requirements with a priority focus on revenue recognition 2.1.Auditors’ responsibilities with regards to fraud “An auditor conducting an audit in accordance with ISAs is responsible for obtaining reasonable assurance that the financial statements taken as a whole are free from material misstatement, whether caused by fraud or error” (ISA 240.5). While fraud is a broad legal concept, for the purposes of the ISAs, the auditor is concerned with fraud that causes a material misstatement in the financial statements (ISA 240.3). The risk of not detecting a material misstatement resulting from fraud is higher than the risk of not detecting one resulting from error because fraud may involve sophisticated and carefully organized schemes designed to conceal it and may be accompanied by collusion (ISA 240.6). Despite those inherent limitations, the auditor is responsible for maintaining professional skepticism throughout the audit, recognizing the fact that audit procedures that are effective for detecting error may not be effective in detecting fraud (ISA 240.8). The IAASB clarified in ISA 240 (Revised) the auditor’s responsibilities relating to fraud when conducting an audit in accordance with ISAs, which are to “(

  1. a)plan and perform the audit to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement due to fraud […] and (
  2. b)communicate and report about matters related to fraud”. This means that the detection of material misstatement arising from fraud is inherently part of the 2.2.Interactions between ISA 240 and other ISAs ISA 240 expands on how ISA 315 (Revised 2019) and ISA 330 are to be applied in relation to RoMM due to fraud (ISA 240.1). See also NonAuthoritative Guidance: The Fraud Lens – Interactions Between ISA 240 and Other ISAs | IAASB. The CSSF will further explain these interactions in the next pages, going through each step of the below illustrative chart: Risk assessment procedures • Obtain information for use in identifying the RoMM due to fraud • Make inquiries with management and TCWG • Identify unusual or unexpected relationships • Evaluate fraud risk factors Identifying and assessing RoMM due to fraud • Identify RoMM before consideration of any controls • Presume that there are risks of fraud in revenue recognition and evaluate which types of revenue, revenue transactions or assertions give rise to such risks • Treat those assessed RoMM due to fraud as significant risks Respond to significant risks of fraud in revenue recognition • Overall responses • Further audit procedures in response to the assessed RoMM due to fraud at the assertion level Obviously, the audit procedures do not end with the responses implemented to address the RoMM. Considering the iterative nature of an audit, if the auditor obtains new information which is inconsistent with the audit evidence on which the auditor originally based the identification or assessments of the RoMM, the auditor shall revise the identification or assessment and determine whether additional procedures are necessary. auditor’s responsibilities (see Basis for conclusion- IAASB - ISA 240 (Revised) – paragraph 15) THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 5 Examples: 2.3.Risk assessment procedures Risk assessment procedures Identifying and assessing RoMM due to fraud Respond to significant risks of fraud in revenue recognition significant declines in customer demand and increasing business failures in either the industry or overall economy; - use of business intermediaries for which there appears to be no clear business justification; - rapid growth or unusual profitability especially compared to that of other companies in the same industry. In accordance with ISA 240 and ISA 315, the auditor shall perform risk assessment procedures to obtain an understanding of the entity and its environment, the applicable financial reporting framework and the entity’s system of internal control to be in a position to adequately identify the RoMM due to fraud (ISA 240.17). When performing risk assessment procedures, the auditor shall pay particular attention to the existence of any events or conditions that indicate an incentive or pressure to commit fraud, an ability to rationalize fraudulent action or provide an opportunity to commit fraud. Indeed,  fraud risk factor as control risk factor Fraud risk factors may also relate to conditions within the entity’s system of internal control, such as limitations or deficiencies in the entity’s internal control, which could create fraud opportunities or foster certain attitudes or rationalizations. Examples: - reporting process and internal control is not effective; these events or conditions are fraud risk factors that the auditor shall evaluate with due care. While fraud risk factors may not necessarily - RoMM due to fraud (ISA 240.25, A24 & A26). accounting and information systems that are not effective, including situations involving significant deficiencies in internal control; indicate the existence of fraud, they have often been present in circumstances where frauds have occurred and therefore may indicate oversight by those charged with governance over the financial - management failing to remedy known significant deficiencies in internal control on a timely basis. One interesting point to outline here is that fraud risk factors are dual and At this stage, the auditor shall be looking at risk factors, and not at may be inherent risk factors or control risk factors (ISA 240.A26 & App. 1): events or conditions which may reduce the risks. This state of mind is key since a misstatement due to fraud differs fundamentally from a  fraud risk factor as inherent risk factor Fraud risk factors may relate to incentives, pressures or opportunities arising from conditions that create susceptibility to misstatement before consideration of controls. Such factors are inherent risk factors, insofar as they affect inherent risk, and may be due to management bias. They may also arise from other identified inherent risk factors. misstatement due to an error: while the entity’s controls may be in place to prevent, or detect and correct on a timely basis, more or less predictable misstatements, a fraudster deliberately bypass internal controls and may use sophisticated and carefully organized schemes designed to conceal its fraudulent actions. Even an adequate segregation of duties can be circumvented when the fraudster acts with collusion with a collaborator or with third parties. THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 6 In light of the aforementioned, the auditor shall be vigilant and identify rise to such risks. Indeed, fraud in revenue recognition may exist in internal control deficiencies and other control fraud risk factors which may entities of all sizes, and revenue is an area highly susceptible to fraud facilitate fraudulent activities to ensure that all RoMMs due to fraud have which requires specific attention by the auditor. been identified. Conversely, the robustness of the entity’s system of internal control and the absence of any control fraud risk factors are not a valid rationale for ignoring or minimizing the inherent fraud risk factors that may be present in the facts and circumstances of the engagement and that the auditor shall adequately identify and evaluate. Material misstatement due to fraudulent financial reporting relating to revenue recognition often results from an overstatement of revenues through, for example, premature revenue recognition or recording fictitious revenues. It may result also from an understatement of revenues through, for example, improperly shifting revenues to a later period (ISA 240.A29). 2.4.Identification and assessment of RoMM due to fraud Such presumption may be rebutted in limited situations as foreseen in ISA 240.A31 that gives a single example in the case where there is a single type of simple revenue transaction, for example, leasehold revenue from a single unit rental property. Risk assessment procedures Respond to significant risks of fraud in revenue recognition Identifying and assessing RoMM due to fraud • Assess inherent risk and determine significant risk: When it comes to the assessment, it is important to remember the separate assessment of inherent risk and control risk required by ISA 315 (Revised 2019). • Identify RoMM due to fraud: Based on the understanding obtained and fraud risk factors identified, the auditor shall identify the RoMM due to fraud at both financial statement level and assertion level for classes of transactions, account balances and disclosures. The identification of RoMM is performed before consideration of any related controls (i.e., the inherent risk) and is based on the auditor’s preliminary consideration of misstatements that have a reasonable possibility of both occurring and being material if they For identified RoMM at the assertion level, the auditor shall assess inherent risk by assessing the likelihood and magnitude of misstatement and determine whether any of them are significant risks (ISA 315 (Revised 2019).31 & 32). However, ISA 240.28 requires the auditor to treat those assessed RoMM due to fraud as significant risks regardless of the likelihood and magnitude of misstatement. This means that the auditor shall, to the were to occur (ISA 315.A186). extent not already done, identify the entity’s controls that address such However, for revenues, ISA 240.27 establishes a key presumption: implemented. there are risks of fraud in revenue recognition, and auditor is required to risks, and evaluate their design and determine whether they have been evaluate which type of revenues, revenue transactions or assertions give THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 7 Since the determination of significant risks is done at the level of the Considering that fraud risk in revenue recognition is to be considered as inherent risk, regardless of the control risk, the perceived strength of the a significant risk, the auditor is expected to obtain more persuasive control environment or even the existence of effective control activities evidence (ISA 330.7(b)). whose operating effectiveness was tested in accordance with ISA 330, cannot be a valid justification to rebut the presumption of fraud risk in revenue recognition. Indeed, they do not have any impact neither on the evaluation of which type of revenues, revenue transactions or assertions Overall responses can help the auditor to respond to the significant risk of fraud in revenue recognition such as: - or more experienced individuals to the engagement. give rise to RoMM due to fraud in revenue recognition, nor on the determination that such risk is a significant risk. Assigning additional individuals with specialized skill and knowledge - Incorporating an element of unpredictability in the selection of the nature, timing and extent of audit procedures to be performed. • Assess the control risk: Furthermore, the auditor’s responses to address the assessed RoMM due The assessment of control risk is required only when the auditor plans to to fraud at the assertion level may include changing the nature, timing test the operating effectiveness of controls or when substantive and extent of audit procedures (ISA 240.A38): procedures alone cannot provide sufficient appropriate evidence (ISA 315 (Revised 2019).34 & ISA 330.8). For that reason, the positive assessment of the operating effectiveness of controls and of the control risk only influences the nature, timing, and - Nature: obtain audit evidence that is more reliable and relevant or obtain additional corroborative information. - Timing: because an intentional misstatement, for example, a misstatement involving improper revenue recognition, may have extent of substantive audit procedures and serves to inform how the been initiated in an interim period, the auditor may elect to apply auditor responds to the risks, rather than whether a risk exists or not. substantive procedures to transactions occurring earlier in or throughout the reporting period. The auditor may also focus on 2.5.Respond to the significant risk of fraud in revenue significant or unusual transactions occurring near period-end, which may be indicative of potential manipulation. recognition Risk assessment procedures Identifying and assessing RoMM due to fraud Respond to significant risks of fraud in revenue recognition - Extent: increase sample sizes or perform analytical procedures at a more detailed level. In accordance with ISA 330, the auditor shall design and perform further audit procedures whose nature, timing and extent are responsive to the assessed RoMM due to fraud at the assertion level (ISA 240. 31). THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 8 3. Results of the CSSF Thematic Review 3.1.Evaluation of the fraud risk factors The IAASB has decided in ISA 240 (Revised): • of RoMMs due to fraud at the financial statements and • Insufficient rationale in the evaluation of fraud risk factors In some audit files, risk assessment procedures lacked the sufficient assertion levels take into account fraud risk factors and updated the examples of fraud risk factors provided for; • inappropriate for the auditor to rebut the presumption within the audited entities. Indeed, in those cases, pre-populated fraud that there are RoMMs due to fraud in revenue recognition; risk factors were proposed to the audit team that accepted or rejected decision reached. to clarify that the significance of fraud risk factors related to revenue recognition ordinarily makes it details necessary to understand the specific fraud risk factors present them without a documented and comprehensive rationale supporting the to emphasize that the procedures performed by the auditor to obtain audit evidence for the identification and assessment and • to clarify that the three conditions that are generally present when fraud exists (i.e. an incentive or pressure to commit fraud; a perceived opportunity to commit fraud and an Observed lack of consideration for fraud risk factors attitude or rationalization that justifies the fraudulent action) Although the Company is subject to a shareholders’ agreement combination. setting a certain revenue target, whose achievement has a have to be considered individually and not only in significant impact on profit distribution among shareholders, the auditor failed to identify any specific fraud risk factors applicable to the Company and rebutted the fraud risk in the accounting for revenue. Furthermore, once a fraud risk factor is identified, the conclusions as to whether such factor constitute actual RoMM due to fraud were often insufficiently supported in the audit documentation, making it difficult to understand situation in which an identified fraud risk factor does not result in an identified RoMM due to fraud. THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 9 3.2.Identification and assessment of RoMM due to fraud • Lack of granularity in the analysis of revenues, revenue transactions or assertions giving rise to fraud risks In one-third of audit files, the auditors’ analysis lacked the necessary granularity to effectively evaluate which specific products, revenue transactions or assertions may give rise to fraud risks in revenue recognition. This statement is particularly relevant for group audits, where Good practices identified The CSSF also identified the following good practices: • In addition to the standard checklists, a memorandum was prepared to provide a granular view of the revenue cycle the group auditor’s documentation does not always demonstrate a including: sufficient understanding of the various business activities carried out by  the group. Without such an in-depth understanding gained by the auditor, their associated processes. (s)he won’t be in a position to adequately identify where the RoMM due to fraud in revenue recognition for his/her mandate are.  monetary and non-monetary data. robust risk assessment is critical in determining whether the fraud risk presumption in revenue recognition could be rebutted.   concluded, in its basis for conclusion on ISA 240 (Revised) that “Concerns regarding auditors limiting the identification and assessment of RoMMs due to fraud in revenue recognition to manual journal entries and the cut-off assertions An understanding of each type of journal entries recorded for revenues. Moreover, in too many instances, the risk of fraud in revenue recognition This point was raised to the attention of the IAASB, which An understanding of the various counterparties to such revenues. • Fraud risk limited to manual journal entries or to the cutoff assertion However, the appropriateness of this judgment is not always established. A detailed preliminary analytical review, including a qualitative and quantitative analysis and using both The IAASB clarified while reviewing ISA 240 that performing a is limited to the manual journal entries or to the cut-off assertion. An in-depth documentation of all revenue categories and • The auditor obtained and analysed the entity’s risk matrix, including fraud risks. This enabled the auditor to understand which fraud risks had been identified by the entity, whether they were appropriate to the nature and complexity of the entity, and how the entity had addressed them. This procedure assisted the auditor to identify and assess the RoMM due to fraud at the were viewed as a “performance issue” and that ISA 240 (Revised) clearly requires auditors to carefully identify and assess the specific RoMMs due to fraud in revenue recognition.” THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 10 only influences the nature, timing, and extent of substantive audit 3.3.Rebuttal of fraud risk presumption in revenue procedures and is already a response to the identified RoMM due to recognition fraud. Furthermore, the CSSF remind that even with robust internal controls, a fraudster deliberately bypasses internal controls and may • Inappropriate rationales used to rebut the presumption use sophisticated schemes designed to conceal its fraudulent actions. The CSSF identified rationales to rebut the presumption of fraud risk in (iii) A highly automatic process implies robust internal controls covering IT risks (either manual, IT dependant or both) and for that reason revenue recognition that it deemed inappropriate. items mentioned in (
  3. ii)are also applicable. Furthermore, the CSSF  For credit institutions, insurance and reinsurance entities, the reminds ISA 240.A43 that states “[…] automated processes and following rationales were often used when rebutting the presumption controls may reduce the risk of inadvertent error but do not of fraud risk in revenue recognition: - Revenues transactions considered as non-complex and based on override such automated processes, for example, by changing simple calculation; the amounts being automatically passed to the general ledger or to - Robust internal controls in place within the entity; or - Revenues recorded based on a highly automatic process. These rationales alone are considered not sufficient to rebut the presumption of fraud risk for the following reasons: (
  4. i)overcome the risk that individuals may inappropriately Although the revenues transactions are non-complex and based on simple calculation, there are different streams of revenues, a substantial number of transactions in each stream of revenues and a substantial number of agreements, interest rates or types of the financial reporting system. Furthermore, where IT is used to transfer information automatically, there may be little or no visible evidence of such intervention in the information systems.”  For commercial and industrial entities, the following rationales were often used when rebutting the presumption of fraud risk in revenue recognition: - Revenues transactions considered as non-complex; - Revenues transactions based on factual invoices or contractual engagements; or commissions. Moreover, such revenues account for interests and commissions being generally a recognized KPI management is monitoring in credit institutions, insurance and reinsurance. (
  5. ii)The robust internal controls should not have any positive impact on the identification of the RoMM due to fraud in revenue recognition since, as explained in part 2 of this document, such identification is performed before consideration of any related controls i.e. regardless of the perceived strength of the control environment or even the effectiveness of control activities tested in accordance with ISA 330. The positive assessment of the operating effectiveness of controls - No estimate from management. These rationales alone are considered not sufficient to rebut the presumption of fraud risk in revenue recognition, especially where the audited entity has different streams of revenues, a substantial number of transactions in each stream of revenues and a substantial number of agreements. Moreover, such revenues account for turnover being generally a recognized KPI management is monitoring in commercial and industrial entities. THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 11 • Disproportionate rebuttal rate in the financial sector As part of its project to revise the extant ISA 240, the IAASB was determined to shift the focus from the auditor developing a rebuttal to emphasizing the importance of performing robust Rebuttal percentage 60 risk 20 assessment and clarified, that presumption that there are RoMM due to fraud in revenue recognition are limited. 40 30 and circumstances where it may be appropriate to rebut the 50 50 identification For that purpose, the IAASB added a new example, bringing the 17 number of examples provided in the revised standard to two. It 10 is worth noting that those examples refer to very simple and 0 Commercial sector straightforward revenues: Financial sector • Leasehold revenue from a single unit of rental property, or multiple rental properties, with a single tenant; and The rebuttal of the fraud risk presumption in revenue recognition appears • disproportionately high in the financial sector, which the CSSF calls into Simple or straightforward ancillary revenue sources which are determined by fixed rates or externally published rates question considering the specific risk profiles of the audited entities and (e.g. interest or dividend revenue from investments with existing risk factors observed in the inspected audit files. level 1 inputs). The IAASB further pointed out that the above sources of revenues were not considered as key performance indicators for management. • Good practices identified The CSSF identified the following good practices when the fraud risk presumption in revenue recognition was rebutted: - Consultation made to validate the approach and ensure the rationales for rebutting the presumption are acceptable; - Proactive communication to notify the engagement quality reviewer of the rebuttal with underlying rationales. THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 12 3.4.Design and implementation of internal controls addressing fraud risks in revenue recognition 3.5.Responding to the significant risk of fraud in revenue recognition • Inadequate control responses to fraud risks • Lack of specificity in fraud-risk responses Identified fraud risks shall be considered as significant risk for an audit Where the presumed fraud risk in revenue recognition was not rebutted, engagement. Therefore, when fraud risk in revenue recognition is not it is difficult to establish the link between the identified RoMM due to fraud rebutted, auditors have to identify internal control measures in place to and the responses implemented and to understand how those responses address such risk and evaluate their design and implementation. In effectively address those fraud risks, especially when audit procedures different instances, the internal controls identified by auditors to address are considered by auditors as responding both to the RoMM due to fraud revenue fraud risks appear overly generic and inadequate. There is and to the RoMM due to error. often a lack of clarity regarding how these generic or standardised controls, as designed and maintained by management, effectively prevent or detect the specific fraudulent activities in revenue recognition. Furthermore, it is often unclear how the auditor’s responses incorporated tailored modifications to the nature, timing, and extent of audit procedures. While the extent of the additional audit procedures to respond to the RoMM due to fraud is often limited to an unpredictability testing (consisting of adding items to the initial sample), the timing and nature of those audit procedures are generally unchanged regardless of whether the auditor concludes that the presumption of fraud risk in revenue recognition applies in the circumstances of the engagement. Consequently, it is difficult to distinguish fraud-risk-specific responses from standard audit procedures that would have been performed to respond to the RoMM due to error. THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 13 Example highlighting the difficulty to distinguish fraudrisk-specific responses In line with this last comment, the CSSF also observed that the specific In the below example, audit responses to address the RoMM due to fraud in revenue recognition have also been observed in other audit engagements, where the risk of fraud in revenue recognition was rebutted. It confirms the difficulty to distinguish fraud-risk-specific responses from standard audit procedures that are implemented to address the RoMM due to examples of audit procedures to address the RoMM due to fraud suggested in ISA 240 were not very often implemented in the audit engagements reviewed. For instance, the following procedures, supplemented in the revised standard, could be performed more often by the auditors: • Confirming with customers certain relevant contract terms and the error and also suggests that the auditor does not perform absence of side agreements, because the appropriate accounting often enough procedures when the fraud risk is not rebutted. is influenced by such terms or agreements and basis for rebates or the period to which they relate are often poorly documented. For example, This example is extracted from the sole PIE engagement from acceptance criteria, delivery and payment terms, the absence of future our sample where the auditor considered the fraud risk in or continuing supplier obligations, the right to return the product, revenue recognition as a key audit matter for the engagement. guaranteed resale amounts, and cancellation or refund provisions For this Group, revenues are composed of high volumes of very often are relevant in such circumstances; low value individual transactions, and the auditor narrowed the risk of intentional misstatements to the recognition of fictitious • sales. The auditor’s testing procedures included in particular: • • • • Understanding the internal control system and analysing the Conducting interviews with personnel outside of the financial reporting function, for example, sales and marketing personnel; • Examining customer correspondence files at the entity for any unusual principles adopted by the Group in terms of recognizing terms or conditions that raise questions about the appropriateness of revenue from contracts with customers. revenue recognized; and Conducting, on a sample basis, tests of selected internal • Altering the audit approach in the current year. For example, controls, important for determining the occurrence of contacting major customers and suppliers orally in addition to sending revenue transactions and the correct value of revenues from written confirmation, sending confirmation requests to a specific party contracts with customers. within an organization, or seeking more or different information. Understanding and validating types of documents used for accounting of revenues and identification of types of journal The IAASB further clarified, in ISA 240 (Revised).A129, that entries outside standard operating activity of the Group. “[…] When obtaining more persuasive audit evidence to respond Testing of the selected non-standard journal entries of revenue accounts that have impacted revenue for the year by understanding the rationale for these journals. to assessed RoMM due to fraud, the auditor may increase the quantity of the evidence, or obtain evidence that is more relevant and reliable, for example, by placing more emphasis on obtaining third party evidence or by obtaining audit evidence from a number of independent sources”. THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 14 Appendix Glossary of the terms Useful links: CSSF Commission de Surveillance du Secteur Financier ISA 240 as adopted by the CSSF in Luxembourg - CSSF Regulation No 24-02 of 26 January 2024 – CSSF IAASB International Accounting and Auditing Standard Board ISA International Standard on Audit ISA 240 and ISA “The Auditor’s Responsibilities Relating to Fraud in an 240 (Revised) ISA 315 (Revised 2019) ISA 330 ISA 240 (Revised) as adopted by the IAASB - ISA 240 (Revised), The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements | IAASB IAASB’s basis for conclusion on ISA 240 (Revised) Audit of Financial Statements” “Identifying and Assessing the Risks of Material Misstatement” “The Auditor’s Responses to Assessed Risks” IT Information Technology KPI Key Performance Indicator PFS Professional of the Financial Sector PIE Public-Interest Entity RoMM Risk of Material Misstatement TCWG Those Charged With Governance THE RISK OF FRAUD IN REVENUE RECOGNITION IN THE CONTEXT OF AN AUDIT OF FINANCIAL STATEMENTS 15

🔗 Vers la source officielle

AI explanation based on the official legal text. Indicative, not a substitute for legal advice.