How the presumption works
ISA 240.26 creates a rebuttable presumption that revenue recognition involves a risk of material misstatement due to fraud. The word "rebuttable" matters. Unlike management override of controls, which the auditor can never set aside, the revenue presumption can be rebutted if the engagement team concludes that no fraud risk exists in revenue recognition for this specific engagement.
The bar for rebuttal is high. ISA 240.47 requires the auditor to document the reasons for any conclusion that the presumption does not apply. A one-line statement ("revenue is simple") won't survive inspection. The rebuttal must explain which specific characteristics of the revenue stream eliminate the conditions that typically give rise to fraud risk.
When the presumption is not rebutted, the team must design specific audit procedures that respond to the identified fraud risk in revenue recognition. ISA 240.28 requires these to go beyond routine substantive testing.
Governed by: ISA 240 paragraphs 26–27
Key Takeaways
- Every audit presumes revenue recognition is a fraud risk until the engagement team documents a valid rebuttal.
- Rebutting the presumption requires specific conditions, not a general statement that revenue is straightforward.
- The presumption applies to the timing, existence, completeness, and amount of revenue.
- An undocumented rebuttal is the same as no rebuttal from an inspection perspective.
Worked example: Navarro Logística S.L.
Spanish logistics company, FY2024, revenue €120M, IFRS 15 reporter. Revenue split between freight forwarding (75%), warehousing (20%), customs brokerage commissions (remainder).
The team rebuts the presumption for warehousing only (fixed monthly billing, no judgment). Does not rebut for freight (stage-of-completion estimates) or customs (high volume small transactions).
Fraud-responsive procedures designed: Freight — verifies stage-of-completion to external carrier documentation for 25 year-end contracts (€8.4M). Customs — matches 100% December commission entries to AEAT declarations.
What reviewers get wrong
- AFM inspection findings cite files where the presumption was rebutted without sufficient documentation. Most common: a single sentence "revenue is not complex" with no analysis.
- Teams confuse revenue recognition fraud risk with revenue-related inherent risk. ISA 240.26 concerns fraud specifically.
Revenue recognition fraud risk vs management override
| Dimension | Revenue recognition fraud risk | Management override |
|---|---|---|
| ISA reference | ISA 240.26–27 | ISA 240.31–33 |
| Rebuttable | Yes, with documented reasons per ISA 240.47 | No, never |
| What it targets | Fraud through revenue line | Fraud through any account via circumvention of controls |
| Response | Fraud-specific substantive procedures on revenue per ISA 240.28 | Three mandatory procedures plus consideration of additional procedures |
Related terms
Related reading
Frequently asked questions
Can you rebut the revenue recognition fraud risk presumption?
Yes, but ISA 240.47 requires documented reasons explaining why no fraud risk exists in revenue recognition for this specific engagement. A generic statement is insufficient.
Does the presumption apply to every revenue stream separately?
Yes. You can rebut for one stream and retain it for another, as long as each decision is documented with specific reasoning.