Fraud risk assessment: building it into the audit plan

A fraud risk assessment identifies where in the entity's specific circumstances someone has both the pressure and the opportunity to commit fraud, and how they would rationalize it, then builds audit procedures that respond to those specific scenarios rather than a generic fraud checklist. Two elements are non-negotiable on every engagement regardless of what the assessment finds: management override of controls is treated as a presumed risk, and some form of journal entry testing is performed as the standard response to it.

The fraud triangle, applied rather than recited

The fraud triangle — pressure, opportunity, rationalization — is usually taught as theory and then never actually used to shape testing. Applied properly, each leg points to a different kind of evidence an auditor can actually go and look for in this specific entity, this year.

Management override as a presumed risk

Regardless of how the specific risk assessment comes out, management override of controls is treated as present on every engagement by default. The reasoning is structural rather than evidence-based for any particular client: management, almost by definition, has the authority to override the very controls that would otherwise catch its own actions, and that authority exists whether or not anything in this year's evidence points to it being misused.

• This is why a 'no fraud risk identified' conclusion on an engagement still requires the standard override-response procedures to be performed. The presumption is not rebuttable by a clean risk assessment.
• It is also why controls that rely on management's own review as the final check — a reconciliation 'reviewed by the CFO' with no further evidence trail — are inherently limited as a response to this specific risk. The person being relied upon not to override is the same person the risk assumes might.
• Where a specific risk factor is identified on top of the baseline presumption — unusual pressure on reported results this year, say — the response should scale up, not just repeat the standard procedures mechanically.

Journal entry testing as the standard response

Journal entry testing exists specifically because management override, almost by definition, is executed through entries outside the normal transaction processing — a manual journal rather than a system-generated posting from a sales invoice or a purchase order. Testing the standard transaction cycles will not catch an override that bypasses those cycles entirely.

1. 01Obtain the full population of journal entries for the period, not a sample selected by the clientCompleteness of the population matters more here than almost anywhere else in the audit, because the entries most worth finding are the ones nobody would voluntarily surface.
2. 02Profile the population before selecting anythingBy preparer, by approver, by account combination, by posting date and time, and by whether the entry was reversed shortly after posting. Patterns show up at this stage that a sample would miss.
3. 03Target specific characteristics known to correlate with override riskEntries posted by senior personnel outside their normal role, entries made directly to revenue or to unusual account combinations, entries posted on weekends or outside business hours, round-number entries, and entries made or reversed around period end.
4. 04Pay particular attention to entries with no supporting narrative or an inadequate oneA journal that would need a story to justify, and has none attached, is exactly the pattern this testing is designed to surface.
5. 05Trace the selected entries to underlying support and corroborate independently where possibleNot just to the documentation the preparer attaches to their own entry, since that is exactly what an override would be designed to make look adequate.
6. 06Extend procedures to significant accounting estimates, not just journal entriesManagement override often works through aggressive assumptions in an estimate rather than a journal entry at all — an impairment not recognized, a provision understated. Retrospective review of prior estimates against actual outcomes is a direct response to this.

Documenting the assessment and the response

• The specific fraud scenarios identified for this entity, not a generic restatement of the fraud triangle.
• The procedures performed in direct response to management override, including the journal entry testing population, selection criteria, and results.
• Discussion among the engagement team about fraud risk, documented as having actually happened, including dissenting views if any.
• Any instance of actual or suspected fraud identified during the engagement, however small, and how it was evaluated and reported.
• The basis for concluding that unpredictability was built into the audit approach — varying the nature, timing or extent of procedures from what might be expected, so that a pattern of testing cannot simply be anticipated and worked around.