SA 240 sets out the auditor's responsibility to consider fraud in an audit of financial statements. It does not make the auditor responsible for preventing fraud, and it does not expect the auditor to find every fraud that exists. What it requires is a specific mindset — professional skepticism maintained throughout the engagement — and specific procedures: a fraud-focused discussion among the engagement team, inquiries of management and those charged with governance, and a presumption that revenue recognition and management override of controls carry fraud risk unless a documented reason says otherwise.
The distinction SA 240 is built around
| Error | Fraud | |
|---|---|---|
| Intent | Unintentional | Intentional |
| Auditor's objective | Detect material misstatement regardless of cause | Same objective, but fraud is deliberately concealed, making it inherently harder to detect |
| What changes in response | Normal audit procedures | Heightened skepticism, specific procedures, and a required team discussion at planning |
What actually has to happen in the file
- 01A documented fraud discussion among the engagement teamBefore fieldwork starts, not after — specifically considering how and where the entity's financial statements might be susceptible to fraud.
- 02Inquiries of management and, separately, those charged with governanceAsked separately because management's own view of fraud risk and the audit committee's oversight of that risk are two different pieces of evidence, not one.
- 03A rebuttable presumption of fraud risk in revenue recognitionSA 240 requires treating revenue recognition as a fraud risk by default. Rebutting that presumption requires a documented rationale specific to the engagement, not a boilerplate note.
- 04Specific procedures addressing management override of controlsTesting journal entries and other adjustments for evidence of bias, reviewing accounting estimates for management bias, and evaluating the business rationale for significant unusual transactions — required on every audit, not only where a specific fraud risk was separately identified.
Regulatory requirement
The journal entry testing and management-override procedures are required on every audit under SA 240, independent of whether any specific fraud risk factor was identified elsewhere in the engagement. Skipping them because "nothing looked suspicious" is not compliant with the standard.
What changes once a fraud risk factor is actually identified
Identifying a fraud risk factor — a motive, an opportunity, a rationalisation someone might use — doesn't mean fraud exists. It means the response to that risk has to be more than a routine substantive procedure: an unpredictable element in testing (changing the sample timing or method from what would be expected), closer scrutiny of year-end journal entries, or obtaining corroboration for an explanation from a source outside the immediate finance function.
Common practice, not a requirement
"The client is well-run and we've never found anything" is not, on its own, a basis for rebutting the revenue-recognition fraud presumption or reducing the required journal entry testing — SA 240's baseline procedures apply regardless of how trustworthy management appears.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCFraud risk assessment: building it into the audit planThe fraud triangle applied practically rather than as theory, why management override is a presumed risk on every engagement, and what journal entry testing is actually looking for.
- Payroll & employee costPayroll fraud: red flags an auditor should test forGhost employees, duplicate bank accounts, unauthorized master changes before a payroll run, and the analytical procedures that surface them.
- Payroll & employee costThe ghost employee payroll testing caughtOne employee ID had drawn a full salary for eleven months with no biometric attendance record at all. The HR file for that ID was thin in a specific way.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.