Auditing Revenue Recognition Under ASC 606: A Practical Approach

6/9/2026

Revenue is a significant risk on essentially every engagement, for three reasons that compound. It is usually the largest number in the statements. The applicable standard is judgment-heavy at nearly every step. And auditing standards direct the auditor to presume that improper revenue recognition is a fraud risk, which means the presumption has to be addressed rather than assumed away.

The practical problem is that most audit programs treat revenue as one thing, and it is not.

Step Zero: Inventory the Revenue Streams

Before any procedure, the engagement needs a stream-by-stream understanding, because different streams have different performance obligations, different timing, and entirely different risks.

For each stream: what is sold, to whom, under what contract form, what the performance obligations are, when control transfers, whether consideration is fixed or variable, and what the entity's stated accounting policy is.

A manufacturer with product sales, extended warranties, installation services, and a maintenance contract has four revenue streams with four different answers. An audit program written for "revenue" tests the largest one and applies its conclusions to the rest.

Two things this exercise reliably surfaces: streams management did not mention, and streams where the stated policy and the actual practice differ.

Auditing the Five Steps

1. Identify the contract

Procedures: examine the contract's existence and approval, confirm enforceability, and — the one auditors skip — assess collectibility. A contract does not exist for revenue recognition purposes unless it is probable that the entity will collect the consideration. Revenue recognized on a customer who was never likely to pay is a recognition error, not merely a receivable problem.

Also: contract modifications, which are frequently informal and which change the accounting. A verbal agreement to extend terms, add scope, or reduce price is a modification whether or not anyone papered it.

2. Identify performance obligations

The step producing the most restatements at smaller entities.

The question is whether promised goods and services are distinct — capable of being distinct and separately identifiable within the contract. The recurring findings run both directions: a bundled arrangement treated as a single obligation when it contains several, and separate obligations aggregated because the invoice was a single line.

Procedures: read the contract for what was actually promised rather than what was billed; look for implied promises, including free items, upgrades, and post-delivery support the entity habitually provides; identify material rights such as renewal options or loyalty credits; and check whether the entity's conclusion is consistent across similar contracts.

3. Determine the transaction price

Variable consideration is the hardest area in the standard and the least well audited.

The components: rebates, volume discounts, expected returns, penalties, performance bonuses, price concessions — including implicit concessions the entity habitually grants — and any amount that is not fixed.

Two requirements to test. The estimation method — expected value or most likely amount — and whether it was applied consistently and with adequate data. And the constraint, which limits the amount included to the extent it is probable that a significant revenue reversal will not occur. The constraint is a judgment, and it is frequently applied loosely or not documented.

The single most informative procedure available on revenue: retrospective review of prior estimates. Take last year's returns, rebate, and concession estimates and compare them to what actually occurred. An entity whose estimates were consistently optimistic has an estimation process problem, and that finding is far more persuasive than any inquiry — because it is evidence rather than an assertion.

Also here: a significant financing component where payment timing is extended, noncash consideration, and consideration payable to a customer, which frequently reduces the transaction price rather than being an expense — a common misclassification with cooperative advertising and slotting arrangements.

4. Allocate the transaction price

Procedures: test the standalone selling price for each obligation, and specifically how it was determined where the item is not sold separately — an estimation method whose support is often thin. Confirm that discounts were allocated proportionally unless the criteria for allocating to specific obligations were met, which is a conclusion needing support rather than an assumption.

5. Recognize

The over time versus point in time determination, and where over time, the measure of progress.

For over-time recognition, test the criteria that permit it and then test the measure. Where the measure is cost-based, two inputs matter and both are manipulable: costs incurred and the estimate to complete. Understating the estimate to complete accelerates revenue, and it is the classic manipulation in contract accounting — so testing the estimate against subsequent actual costs, on prior contracts, is the equivalent of the retrospective review above.

For point-in-time recognition, test the control transfer indicators rather than accepting shipping terms at face value.

The Procedures That Actually Find Things

Read the actual contracts. A sample, weighted to nonstandard arrangements, large contracts, new customers, and — most productively — contracts negotiated close to period end, which is where accommodation appears.

Search for side agreements. These are the mechanism behind a large share of revenue fraud, and they are not in the contract file. The procedures that work: inquiry of sales personnel rather than only of management — salespeople frequently describe arrangements management does not; reading correspondence and email around significant sales; asking customers directly in confirmations about terms rather than only balances; reviewing legal invoices; and looking for unusual terms in shipping documents or credit approvals.

Cut-off testing against delivery evidence, not invoices. The invoice is the document being manipulated; the carrier's documentation is not.

Post-period credit memos and returns, traced back. This is the audit trail of last period's overstatement, and it is a fast procedure.

Disaggregated analytics. Revenue by stream, by customer, by month, and by geography; margin by contract; days sales outstanding by stream. Consolidated revenue analytics conceal everything — the anomaly appears only when the data is cut.

Journal entry testing on revenue accounts, targeting manual entries, entries after cutoff dated within the period, and entries by users who do not normally post — the discipline in our post on audit red flags.

Confirmation, with an understanding of its limits. Confirming a balance does not confirm the timing or the terms, which are the assertions usually at issue. A confirmation designed to test revenue should ask about terms, rights of return, side arrangements, and acceptance — not only about the amount owed.

Contract asset and liability roll-forwards, which frequently reveal recognition inconsistent with the stated policy.

Disclosure Is Commonly Deficient

The standard's disclosure requirements are extensive and smaller entities satisfy them poorly:

Disaggregation of revenue into categories that depict how it is affected by economic factors — frequently presented at a level too aggregated to be meaningful.

Contract balances, including opening and closing contract assets and liabilities and revenue recognized from prior-period contract liabilities.

Performance obligations, including timing and the remaining obligations where required.

Significant judgments — the timing determination, the transaction price and variable consideration estimates, the constraint, and allocation methods. This is the disclosure most often reduced to boilerplate, and it is the one a reader needs most.

The Fraud Angle

Because the presumption requires addressing it.

Management override at period end is the mechanism. The controls that operate all year are the ones bypassed in the final days.

The incentives are knowable in advance — a covenant threshold, a bonus target, an earnout period ending, a pending financing or sale, an analyst expectation, or a forecast given to a lender. An auditor who knows the incentive knows where to look and when.

The schemes, and what detects each:

Bill and hold — invoicing goods not yet shipped. Detected by cut-off testing against delivery evidence and by examining period-end shipments.

Channel stuffing — pushing product to distributors beyond demand, usually with return rights. Detected by post-period returns, distributor inventory levels, and terms enquiry.

Side letters granting return rights, acceptance conditions, or contingent payment. Detected as above.

Premature recognition on incomplete obligations, including recognizing on delivery where installation or acceptance was required.

Round-tripping and reciprocal arrangements with no economic substance, detected by scrutinizing transactions with counterparties who are also vendors.

Understating the estimate to complete on long-term contracts.

Fictitious customers or transactions, detected by confirmation, delivery evidence, and subsequent cash collection.

Structured coverage is available through the audit training courses catalog, internal auditing training, the Certificate in Financial Reporting and Analysis, Analyzing Financial Statements, the Certificate in Forensic Accounting, and the Certified AICPA SOC Report Analyst program where revenue processing is outsourced.

Documentation

What a file needs to withstand review:

The understanding of each revenue stream, and the entity's policy for each.

A risk assessment by assertion and by stream — occurrence, completeness, accuracy, and cutoff are not equally risky for every stream, and a single revenue risk assessment is insufficient where the streams differ.

The linkage from identified risk to specific procedure, which is the element most often missing. A program listing procedures without connecting them to the risks they address cannot demonstrate that the risks were addressed.

The fraud risk presumption addressed explicitly — either responded to with specific procedures, or, where the auditor concludes it does not apply, with the reasoning documented.

Judgment areas documented with the auditor's own evaluation, not a restatement of management's conclusion. Recording that management determined a single performance obligation exists is not audit evidence that one does.

Where Revenue Audits Fall Short

• Auditing revenue as one stream when the entity has several
• Never reading the contracts, relying on management's summary
• No search for side agreements, and no inquiry of sales personnel
• Cut-off tested against invoices rather than delivery evidence
• Variable consideration accepted without testing the method or the constraint
• No retrospective review of prior estimates against actual outcomes
• Standalone selling price accepted with no support where the item is not sold separately
• Cost-based progress measures tested on costs incurred but not on the estimate to complete
• Consolidated analytics only, concealing what disaggregation reveals
• Post-period credit memos never examined
• Confirmations testing balances and calling it evidence about timing and terms
• The fraud presumption unaddressed in the documentation
• Judgments documented as management's conclusion rather than the auditor's evaluation
• Disclosure of significant judgments left as boilerplate

The summary for an engagement: inventory the streams and audit each on its own terms, read the contracts including the ones signed in the last week of the year, test variable consideration by checking whether last year's estimates held, and test cut-off against the carrier's records rather than the entity's invoices. Those four moves address most of what actually goes wrong in revenue.

Frequently Asked Questions

Why can revenue not be audited as a single item?

Because different revenue streams have different performance obligations, different timing of control transfer, and different risks. A manufacturer with product sales, extended warranties, installation, and maintenance has four streams with four answers, and a program written for "revenue" tests the largest and applies its conclusions to the rest. The stream inventory also surfaces streams management did not mention and cases where stated policy and actual practice differ.

What is the most informative procedure on revenue estimates?

Retrospective review — comparing last year's returns, rebate, and concession estimates to what actually occurred. An entity whose estimates were consistently optimistic has a process problem, and that is evidence rather than an assertion. The same technique applies to cost-based progress measures by comparing prior estimates to complete against actual outcomes.

How are side agreements found?

Not in the contract file. Inquiry of sales personnel rather than only management, since salespeople describe arrangements management does not; reading correspondence around significant sales; designing confirmations to ask about terms, return rights, and acceptance rather than only balances; reviewing legal invoices; and looking for unusual terms in shipping or credit documentation.

Why test cut-off against delivery evidence rather than invoices?

Because the invoice is the document being manipulated. Carrier documentation and delivery records are independent of the entity's billing decisions, which makes them the appropriate evidence for whether control transferred before period end.

What does confirming a receivable balance actually prove about revenue?

Less than auditors assume. A balance confirmation does not confirm the timing of recognition or the terms of the arrangement, which are the assertions usually at issue. A confirmation designed to provide evidence about revenue has to ask about terms, rights of return, side arrangements, and acceptance.

How should the fraud risk presumption be handled?

Explicitly in the documentation — either responded to with specific procedures targeting the identified risks, or, where the auditor concludes it does not apply, with the reasoning recorded. Since incentives such as covenant thresholds, bonus targets, ending earnout periods, and pending transactions are knowable in advance, they should inform where and when the auditor looks.