Auditing revenue, receivables and cash

Revenue is the largest number on most income statements and the most common subject of financial statement fraud. Receivables and cash are where revenue turns into money. Auditors therefore organize much of their work around the revenue cycle: from a customer order through shipment, invoicing, collection and deposit. This lesson applies the tools of earlier lessons, assertions, risk assessment, controls testing, sampling and analytics, to Fairhaven's revenue cycle. Because revenue fraud is a presumed significant risk, the tests here are more extensive and more specific than in most other areas. ACCT-212 covered the accounting for revenue under the five-step model; here we test whether that model was applied correctly to real transactions.

Risks in the revenue cycle

Overstatement is the main risk for revenue and receivables, because management's incentives usually push toward higher sales and profit. Common schemes include recording fictitious sales, recognizing revenue before control passes to the customer (for example on bill-and-hold arrangements or goods shipped after year end), channel stuffing, where excess goods are pushed to distributors near year end with side agreements allowing returns, and failing to record returns, rebates or credit notes. For Fairhaven, two features raise the risk: management's bonus depends on a profit target that the draft results exceed by only 0.6 million, and wholesale contracts give some customers rights to return unsold goods.

Controls in the revenue cycle

A well-controlled revenue cycle separates the functions of approving credit, shipping goods, invoicing, receiving cash and recording transactions. Key controls at Fairhaven include automated credit checks against customer limits, matching of invoices to shipping documents in the ERP system, sequential numbering of shipping documents and invoices with review of gaps, approval of credit notes by someone outside sales, a monthly review of the aging by the credit manager, and daily reconciliation of point-of-sale cash and card settlements to bank deposits. Lesson 6 showed that the wholesale credit approval control failed its test, so the auditor increases substantive work on receivables valuation.

For retail sales, the auditor plans to rely on controls: point-of-sale pricing controls, daily store reconciliations and IT general controls over the point-of-sale system. Combined with substantive analytics, comparing sales by store with prior year, square footage and foot traffic data, this provides evidence about 1.2 million transactions without examining them one by one.

Substantive tests of revenue

Substantive procedures for revenue usually combine analytics with tests of details. Analytics include comparing monthly sales by channel with the prior year and budget, gross margin by product line, sales returns and allowances as a percentage of sales, and revenue per store. Tests of details include vouching a sample of recorded sales to customer orders, shipping documents and subsequent cash receipts (occurrence); tracing a sample of shipping documents to recorded sales (completeness); testing prices and terms against contracts (accuracy); and reviewing significant contracts for terms that affect revenue recognition, such as return rights, consignment arrangements and volume rebates.

Data analytics are especially effective here. The audit team can match every 2026 sales invoice to a shipping record and a customer master file, identify invoices without shipments, shipments without invoices, sales to customers created late in the year, and credit notes issued in January for December invoices. Each exception is followed up individually.

Cut-off testing

Cut-off tests determine whether transactions near year end were recorded in the correct period. The auditor obtains the last shipping documents issued before year end and the first ones after, and checks that the related sales were recorded in the right year. For Fairhaven, which ships under terms that transfer control when goods leave the warehouse, a sale belongs in 2026 if the goods shipped by December 31.

# Revenue cut-off test: shipments five days either side of December 31, 2026
ship = [  # (document, ship date, invoice date, amount in thousands, terms)
    ("S-90412", "2026-12-28", "2026-12-28", 84, "FOB shipping point"),
    ("S-90418", "2026-12-30", "2026-12-30", 212, "FOB shipping point"),
    ("S-90425", "2027-01-02", "2026-12-31", 365, "FOB shipping point"),   # invoiced before shipment
    ("S-90427", "2026-12-31", "2027-01-03", 58, "FOB shipping point"),    # shipped, invoiced late
    ("S-90431", "2027-01-04", "2027-01-04", 96, "FOB shipping point"),
]
year_end = "2026-12-31"
over = under = 0
for doc, sd, inv, amt, terms in ship:
    in_2026_books = inv <= year_end
    belongs_2026 = sd <= year_end
    status = "correct"
    if in_2026_books and not belongs_2026:
        status = "recorded too early: revenue overstated"; over += amt
    elif belongs_2026 and not in_2026_books:
        status = "recorded too late: revenue understated"; under += amt
    print(f"{doc} shipped {sd} invoiced {inv} {amt:>5}: {status}")
print(f"Overstatement {over}, understatement {under}, net effect on 2026 revenue {under - over:+}")

S-90412 shipped 2026-12-28 invoiced 2026-12-28    84: correct
S-90418 shipped 2026-12-30 invoiced 2026-12-30   212: correct
S-90425 shipped 2027-01-02 invoiced 2026-12-31   365: recorded too early: revenue overstated
S-90427 shipped 2026-12-31 invoiced 2027-01-03    58: recorded too late: revenue understated
S-90431 shipped 2027-01-04 invoiced 2027-01-04    96: correct
Overstatement 365, understatement 58, net effect on 2026 revenue -307

Two cut-off errors appear. Shipment S-90425 was invoiced on December 31 but shipped on January 2, so revenue of 365 was recorded too early. Shipment S-90427 left the warehouse on December 31 but was not invoiced until January 3, so revenue of 58 was recorded too late. The net overstatement of 307 is not material on its own, but it is above the clearly trivial threshold and goes on the summary of misstatements. The early-recorded invoice is also a pattern to investigate: was it a one-off mistake, or did someone invoice January shipments to help reach the profit target? The auditor extends the cut-off test and examines January credit notes for reversals of December invoices.

Confirming receivables

External confirmation of receivables is a long-standing audit procedure, adopted after the McKesson & Robbins fraud of 1938, in which auditors failed to detect 19 million dollars of fictitious receivables and inventory. A confirmation is a direct written response to the auditor from the customer, and when properly controlled it provides reliable evidence of existence.

CAS 505 requires the auditor to maintain control over confirmation requests, and CAS 330 requires the auditor to consider whether external confirmations are to be performed as substantive procedures. Canadian standards do not mandate confirmation of receivables in every audit, but where receivables are material and confirmation is feasible, auditors normally confirm, and the auditor must document why if it does not.

Confirmations come in two forms. A positive confirmation asks the customer to respond whether or not it agrees with the balance. It provides evidence only when a reply is received. A negative confirmation asks the customer to respond only if it disagrees. Non-response is weak evidence, so negative confirmations are appropriate only when risk is low, the population consists of many small, homogeneous balances, a low exception rate is expected, and recipients are likely to read and act on the request. For Fairhaven's wholesale accounts, Bramble Shaw sends positive confirmations to the accounts selected by the MUS sample in lesson 8.

The auditor controls the process from start to finish: selecting the accounts, verifying the addresses or electronic recipients, sending the requests itself, and receiving the responses directly. Responses received through the client, or by email from an address that cannot be verified, are much less reliable. Exceptions are investigated: many are timing differences, such as a payment in transit or goods received after year end, but some reveal misstatements. For non-responses to positive requests, the auditor performs alternative procedures, typically examining subsequent cash receipts (which provide strong evidence of both existence and valuation) or, failing that, shipping documents and customer orders.

Valuation of receivables

Confirmations tell the auditor that customers acknowledge their balances, not that they will pay them. Valuation of receivables depends on the allowance for doubtful accounts, or under IFRS 9 and ASC 326 the expected credit loss allowance, an estimate based on aging, history and forward-looking information. The auditor tests the accuracy of the aging report (information produced by the entity), evaluates management's assumptions, and uses subsequent receipts after year end.

# Testing Fairhaven's allowance for doubtful accounts (thousands of dollars)
aging = {                       # bucket: (balance, historical loss rate, share collected by Feb 15, 2027)
    "Current":      (13_900, 0.005, 0.71),
    "31-60 days":   (4_100, 0.02, 0.58),
    "61-90 days":   (1_900, 0.08, 0.37),
    "91-180 days":  (1_000, 0.25, 0.16),
    "Over 180 days": (500, 0.70, 0.02),
}
recorded_allowance = 650
total = sum(b for b, _, _ in aging.values())
expected = 0
print(f"{'Bucket':<15}{'Balance':>9}{'Loss rate':>11}{'Allowance':>11}{'Collected':>11}")
for k, (bal, rate, coll) in aging.items():
    a = bal * rate
    expected += a
    print(f"{k:<15}{bal:>9,}{rate:>11.1%}{a:>11.0f}{bal * coll:>11,.0f}")
print(f"{'Total':<15}{total:>9,}{'':>11}{expected:>11.0f}")
print(f"Recorded allowance: {recorded_allowance}")
print(f"Auditor's expectation: {expected:.0f}")
print(f"Possible understatement of allowance: {expected - recorded_allowance:.0f} (clearly trivial threshold 30)")

Bucket           Balance  Loss rate  Allowance  Collected
Current           13,900       0.5%         70      9,869
31-60 days         4,100       2.0%         82      2,378
61-90 days         1,900       8.0%        152        703
91-180 days        1,000      25.0%        250        160
Over 180 days        500      70.0%        350         10
Total             21,400                   904
Recorded allowance: 650
Auditor's expectation: 904
Possible understatement of allowance: 254 (clearly trivial threshold 30)

The auditor's expectation of the allowance, based on historical loss rates adjusted for current conditions, is about 0.25 million higher than the recorded 0.65 million. Subsequent receipts support the concern: balances over 90 days have barely been collected. The difference is an estimate, so it is classified as a judgmental misstatement, and the auditor discusses it with management, considers whether it indicates bias (the allowance fell as a percentage of receivables while aging worsened), and records it on the summary of misstatements.

Auditing cash

Cash is usually a smaller balance than receivables, but it is highly susceptible to theft and misstatement, and its audit is quick and conclusive when done properly. The main procedures are confirmation of all bank balances and other arrangements directly with each bank, testing the year-end bank reconciliations, and testing cut-off of receipts and disbursements. The auditor obtains bank statements for the first weeks of the new year directly from the bank (or a cut-off statement), and traces reconciling items: deposits in transit should appear on the bank statement within a few days, and outstanding cheques should clear in January.

Two frauds involving cash illustrate the risks. In lapping, an employee steals a customer's payment and covers the shortage by applying a later customer's payment to the first customer's account, and so on. Comparing the details of individual deposits with the posting to customer accounts can reveal it. In kiting, money is moved between bank accounts near year end so that the same funds appear in both accounts; a schedule of interbank transfers, comparing the dates each transfer was recorded by the books and by each bank, detects it.

The collapse of Wirecard in 2020, in which 1.9 billion euros of cash supposedly held in trust accounts in Asia did not exist, shows why the auditor must confirm cash directly with the bank, verify that the bank and the confirmation channel are genuine, and never accept screenshots or documents supplied by management in place of confirmations.

In Canada, auditors typically use the standard bank confirmation developed with the Canadian Bankers Association, increasingly through electronic confirmation platforms.