How to Audit Revenue Recognition Under IFRS 15

You’re reviewing the revenue file on a €60M manufacturing client. The prior year team tested a sample of invoices, agreed them to delivery notes, and signed off. No exceptions. But nobody asked whether the performance obligations in the framework agreements matched the invoices. Two obligations were bundled into a single line item, and €3.2M of revenue was recognised in the wrong period. The file passed review. The revenue was wrong.

To audit revenue recognition under IFRS 15, identify each performance obligation in the client’s contracts (IFRS 15.22), determine whether revenue should be recognised at a point in time or over time (IFRS 15.35), test the transaction price allocation across obligations (IFRS 15.73–86), and verify that the client’s timing of recognition matches the transfer of control under IFRS 15.31–34.

Why revenue recognition is a presumed fraud risk

ISA 240.26 presumes that revenue recognition carries a risk of material misstatement due to fraud. You can rebut the presumption, but ISA 240.A30 sets a high bar: the engagement team has to document why the presumption doesn’t apply to the specific revenue streams of this client. In practice, most teams accept the presumption and design their procedures around it. The question isn’t whether revenue is a significant risk. It’s which assertions within revenue carry the highest fraud risk for this particular client.

That distinction matters because it drives your response under ISA 330.18. A significant risk requires a substantive response specifically designed for it. Pulling a random sample of sales invoices and agreeing them to goods dispatched notes doesn’t qualify as a specifically designed response. ISA 330.A52 makes this explicit: the auditor needs procedures that address the particular way in which the significant risk could result in material misstatement. A blanket vouching test designed before the team even discussed fraud risks is the opposite of what ISA 330.18 requires. If your engagement uses a standardised revenue programme copied from the prior year without modification for the current year’s fraud risk assessment, you don’t have a specifically designed response.

For most non-Big 4 engagements, the highest-risk assertions sit in two places. Cut-off (revenue recorded in the correct period) and occurrence (the transaction actually happened as recorded). Where contracts contain multiple deliverables, accuracy and allocation also become high-risk because IFRS 15.73–86 requires the client to allocate the transaction price to each performance obligation based on relative standalone selling prices. A client that bundles installation with product delivery and recognises the full amount on shipment has an accuracy problem even if every invoice is genuine. And if the client has variable consideration (volume discounts, rebates, performance penalties), the estimate of the transaction price under IFRS 15.56 creates a measurement risk that standard invoice testing completely misses.

The five-step model and what it means for your audit procedures

IFRS 15 replaced IAS 18 with a single framework that applies to every contract with a customer. The five steps aren’t just an accounting exercise for the client. They’re your audit roadmap. Each step creates a distinct assertion that needs a distinct procedure.

Step 1: Identify the contract (IFRS 15.9–16)

Your procedure here is confirming that a contract exists, that it has commercial substance, and that collectability of the consideration is probable. For most standard sales, this is straightforward. It gets complicated with framework agreements, call-off orders, and contracts with variable terms. If the client has a master agreement with annual pricing reviews and separate purchase orders, you need to determine whether each purchase order is a contract or whether the master agreement is the contract. The answer changes when and how much revenue gets recognised.

Step 2: Identify performance obligations (IFRS 15.22–30)

Most audit deficiencies originate at this step. IFRS 15.22 requires the client to identify every distinct good or service promised in the contract. A good or service is distinct under IFRS 15.27 if the customer can benefit from it on its own (or with readily available resources) and the promise is separately identifiable from other promises in the contract. Installation services bundled with equipment delivery might be distinct or might not, depending on whether the installation is so intertwined with the equipment that the customer couldn’t use the equipment without it.

Step 3: Determine the transaction price (IFRS 15.47–72)

Variable consideration (volume discounts, rebates, penalties, performance bonuses) is the main audit risk here. IFRS 15.56 constrains the amount of variable consideration you can include in the transaction price: only to the extent that it’s highly probable that a significant reversal won’t occur. Test the client’s constraint assessment by examining historical reversal rates, current contract terms, and management’s assumptions about the likelihood of reversal.

Step 4: Allocate the transaction price (IFRS 15.73–86)

If the contract has more than one performance obligation, the client allocates the transaction price based on relative standalone selling prices. Where the client doesn’t sell an item separately, IFRS 15.79 requires an estimation approach (adjusted market assessment, expected cost plus margin, or residual). Your procedure tests whether the client’s allocation method is appropriate and whether the inputs are reasonable.

Step 5: Recognise revenue when (or as) the entity satisfies a performance obligation (IFRS 15.31–45)

The distinction between over-time and point-in-time recognition is the final critical assertion. IFRS 15.35 sets out the conditions for over-time recognition. If none of the conditions is met, revenue is recognised at a point in time when control transfers. Your procedure verifies that the client applied the correct method and that the indicators of control transfer (IFRS 15.38) align with the timing of recognition in the general ledger.

How to identify performance obligations the client missed

Reading the contract is obvious. Reading it with IFRS 15.22 open next to you is what separates an adequate file from a good one. Start by listing every promise the client makes in the contract, including implied promises under IFRS 15.24 (customary business practices that create a valid expectation). Then test each promise against the two-part test in IFRS 15.27.

The most common gap isn’t exotic. It’s installation or warranty services that the client bundles with the delivered product because they’ve always bundled them. Under IAS 18, that often didn’t matter because the revenue recognition criteria were less prescriptive. Under IFRS 15, each distinct obligation needs its own allocation and its own recognition point.

If you find a performance obligation that the client hasn’t separated, you need to quantify the misstatement. The ciferi IFRS 15 revenue recognition flowchart walks you through the allocation calculation and produces a working paper you can file directly.

Designing substantive tests that go beyond vouching invoices

Vouching a sample of invoices to delivery notes tests occurrence and, to some extent, cut-off. It doesn’t test allocation, accuracy of variable consideration estimates, or whether over-time recognition calculations are correct. For a presumed fraud risk, you need procedures that target the specific way revenue could be materially misstated.

Here’s what a substantive programme for revenue should cover at minimum on an IFRS 15 engagement.

Cut-off testing

Select a sample of transactions around the period end (the last two weeks before and first two weeks after year-end). For each, trace the revenue entry to the point at which control transferred under IFRS 15.38. Compare that date to the period in which the client recorded the revenue.

The most effective cut-off procedure for product sales is matching the invoice date to the shipping or delivery documentation. But IFRS 15 changed the benchmark. The question isn’t “when was it shipped?” It’s “when did control transfer?” IFRS 15.38 lists five indicators of control transfer: the entity has a present right to payment, the customer has legal title, the entity has transferred physical possession, the customer has the significant risks and rewards of ownership, and the customer has accepted the asset. For most standard product sales, physical delivery is the transfer point. But for bill-and-hold arrangements, consignment sales, delivered goods subject to customer acceptance, or goods shipped with right-of-return clauses, the transfer point may differ from the delivery date by weeks or even months. Test the control transfer point, not the logistics date.

Occurrence testing

Confirm a sample of large or unusual transactions directly with the counterparty under ISA 505. Select transactions that fall outside normal trading patterns (large one-off sales, sales to new customers, sales recorded in the last week of the period). Positive confirmation works better than negative for fraud-risk populations because the absence of a response from a negative confirmation tells you nothing. If the counterparty doesn’t respond to a positive confirmation, ISA 505.12 requires you to perform alternative procedures. For revenue, that means examining subsequent cash receipts, proof of delivery signed by the customer, and contract documentation that corroborates the sale independently of the client’s own records.

Accuracy and allocation testing

For any contract with multiple performance obligations, recalculate the client’s allocation. Obtain standalone selling prices (or the estimation approach the client used) and verify the mathematical allocation. This isn’t a sampling exercise. You need to test every contract where the allocation is material.

Variable consideration testing

Examine the client’s constraint assessment under IFRS 15.56–58. Pull historical data on actual versus estimated variable consideration for prior periods. If the client consistently overestimates or underestimates, you have a bias indicator that needs to go into the ISA 240 fraud risk discussion.

What to do when the client has over-time recognition

Over-time revenue under IFRS 15.35 introduces a measurement risk that point-in-time sales don’t have. The client recognises revenue progressively based on a measure of progress (input method or output method, per IFRS 15.41–45), and the audit risk shifts from existence and cut-off to accuracy. Your procedure tests whether the measure of progress is appropriate, whether the inputs to the calculation are reliable, and whether the estimate at year-end is reasonable.

For input-method contracts (typically costs incurred to date as a proportion of total estimated costs), the two critical inputs are costs incurred and total estimated costs. Costs incurred can be tested against invoices and timesheets. Total estimated costs are an estimate, and that estimate sits squarely within ISA 540. Test the estimate by comparing prior-period estimated costs to actual costs at completion. If the client consistently underestimates total costs (resulting in early revenue acceleration), you’ve identified a pattern that requires disclosure in the ISA 540 retrospective review and may indicate management bias.

For output-method contracts (milestones, units delivered, surveys of work performed), verify the milestone or output measurement independently. If the client claims 75% completion based on an internal project manager’s assessment, obtain supporting evidence: inspection reports, customer sign-offs on milestones, or independent quantity surveys. The client’s own project tracking system is not independent evidence of the output measure.

Worked example: Brouwer Machining B.V.

Brouwer Machining B.V. is a Dutch precision engineering company. Revenue for 2024: €48M. Primary revenue stream: custom industrial components with installation and a two-year maintenance contract. Brouwer sells the components, installs them on-site, and provides preventive maintenance for 24 months. The client records the full contract value as revenue on delivery of the component.

1. Identify the contract

Brouwer’s standard contract is a single agreement covering component supply and installation, plus a two-year maintenance period. The contract has fixed pricing (€580,000 for a typical order), payment terms of 30 days after installation, and a two-year maintenance window.

2. Identify performance obligations

At minimum, two distinct obligations exist in this contract. The component (which Brouwer could sell without installation, and regularly does to 15% of its customers) and the maintenance service (which Brouwer sells separately to existing customers at €42,000 per year). Installation is less clear. If Brouwer’s components require specialised calibration that only Brouwer can perform, installation may not be distinct under IFRS 15.27(b) because it’s highly intertwined with the component. Investigation reveals that two competitors also offer calibration services. Installation is distinct.

That gives us four performance obligations: component, installation, Year 1 maintenance, Year 2 maintenance.

3. Determine and allocate the transaction price

No variable consideration exists. The transaction price is €580,000. Standalone selling prices: component €460,000 (from component-only sales), installation €38,000 (from separately priced installation quotes), maintenance €42,000/year (from standalone maintenance contracts).

Total standalone selling prices: €460,000 + €38,000 + €42,000 + €42,000 = €582,000.

4. Test the recognition timing

Under Brouwer’s current treatment, €580,000 hits revenue on delivery. The correct treatment: €458,076 on delivery (when control of the component transfers), €37,835 on completion of installation, and €83,712 over 24 months as the maintenance is delivered.

For a typical contract delivered in November 2024 with installation completed in December 2024, the misstatement at year-end is approximately €41,856 (the Year 2 maintenance recognised in full when only one month of Year 1 maintenance has been delivered). Across 28 similar contracts delivered in Q3 and Q4, the total misstatement exceeds €1.1M.

Conclusion. The file now shows a quantified misstatement of €1.1M arising from failure to separate performance obligations and allocate the transaction price. The reviewer sees the contract analysis, the allocation calculation with verifiable standalone selling prices, and a misstatement schedule cross-referenced to ISA 450. This is defensible because every number traces to a source document.

Your engagement checklist

1. Confirm whether the engagement team accepted or rebutted the presumed fraud risk under ISA 240.26 and document the rationale in the risk assessment working paper.
2. For each material revenue stream, obtain the client’s largest contracts and map every performance obligation against IFRS 15.22–30. File the analysis.
3. Test the transaction price allocation for every contract with multiple performance obligations. Recalculate using standalone selling prices and file the source documentation for each price (IFRS 15.73–86).
4. Select cut-off samples from the final two weeks before and first two weeks after year-end. Trace each to the control transfer event under IFRS 15.38, not just the invoice date.
5. For variable consideration, pull historical accuracy data on management’s estimates. Compare estimated to actual for the two prior periods and document any directional bias (IFRS 15.56–58).
6. If the client has over-time recognition revenue, verify the method (input or output, IFRS 15.41–45) and recalculate the percentage complete at year-end for material contracts.

Common mistakes regulators flag

• The FRC’s 2022–23 Audit Quality Inspection Report found that audit teams frequently accepted client journal entries as sufficient evidence that revenue was recorded in the correct period, without tracing to the underlying transfer of control. Cut-off testing that stops at the invoice date misses the IFRS 15 requirement entirely.
• The AFM has flagged insufficient documentation of the fraud risk discussion for revenue in multiple inspection cycles. ISA 240.A30 requires a specific rationale if the team rebuts the presumption. A one-line note saying “management is trustworthy” doesn’t meet the standard.

Related Ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions