How the presumption works
ISA 240.26 creates a rebuttable presumption that revenue recognition involves a risk of material misstatement due to fraud. The word "rebuttable" matters. Unlike management override of controls, which the auditor can never set aside, the revenue presumption can be rebutted if the engagement team concludes that no fraud risk exists in revenue recognition for this specific engagement.
The bar for rebuttal is high. ISA 240.47 requires the auditor to document the reasons for any conclusion that the presumption does not apply. A one-line statement ("revenue is simple") won't survive inspection. The rebuttal must explain which specific characteristics of the revenue stream eliminate the conditions that typically give rise to fraud risk. This is the area that generates the most review notes on fraud files we've seen.
When the presumption is not rebutted, the team must design specific audit procedures that respond to the identified fraud risk in revenue recognition. ISA 240.28 requires these to go beyond routine substantive testing. The file should tell a story: from the presumption, through the risk assessment, to the fraud-responsive procedures and their results.
ISA 240 paragraphs 26–27 govern this presumption.
Key Takeaways
- Every audit presumes revenue recognition is a fraud risk until the engagement team documents a valid rebuttal.
- Rebutting the presumption requires specific conditions, not a general statement that revenue is straightforward.
- The presumption applies to the timing, existence, completeness, and amount of revenue.
- An undocumented rebuttal is the same as no rebuttal from an inspection perspective.
Worked example: Navarro Logística S.L.
Spanish logistics company, FY2024, revenue €120M, IFRS 15 reporter. Revenue split between freight forwarding (75%), warehousing (20%), customs brokerage commissions (remainder).
The team rebuts the presumption for warehousing only (fixed monthly billing, no judgment). Does not rebut for freight (stage-of-completion estimates) or customs (high volume small transactions).
For freight, the team verifies stage-of-completion to external carrier documentation for 25 year-end contracts (€8.4M). For customs, the team matches 100% of December commission entries to AEAT declarations.
What reviewers get wrong
- AFM inspection findings cite files where the presumption was rebutted without sufficient documentation. The most common version is a single sentence ("revenue is not complex") with no analysis. Treating the presumption as a tick box exercise rather than a genuine assessment is the fastest way to draw an inspection comment.
- Teams confuse revenue recognition fraud risk with revenue-related inherent risk. ISA 240.26 concerns fraud specifically, not the difficulty of applying the revenue standard.
Revenue recognition fraud risk vs management override
| Dimension | Revenue recognition fraud risk | Management override |
|---|---|---|
| ISA reference | ISA 240.26 –27 | ISA 240.31 –33 |
| Rebuttable | Yes, with documented reasons per ISA 240.47 | No, never |
| What it targets | Fraud through revenue line | Fraud through any account via circumvention of controls |
| Response | Fraud-specific substantive procedures on revenue per ISA 240.28 | Three mandatory procedures plus consideration of additional procedures |
Related terms
Related tools
Related reading
Frequently asked questions
Can you rebut the revenue recognition fraud risk presumption?
Yes, but ISA 240.47 requires documented reasons explaining why no fraud risk exists in revenue recognition for this specific engagement. A generic statement is insufficient.
Does the presumption apply to every revenue stream separately?
Yes. You can rebut for one stream and retain it for another, as long as each decision is documented with specific reasoning.