Auditing Related Party Transactions: Risks and Disclosure Requirements

7/6/2026

Everything difficult about this area follows from one structural fact:

The primary source of the related party list is management. So an audit that relies on management's completeness assertion is circular — it tests whether management disclosed what management said existed.

Which means the work is an independent search, and a file whose only evidence of completeness is a management representation has not performed it.

Why It Matters More Than Its Dollar Amount

Three reasons, and the third applies even where every transaction is legitimate.

It is the mechanism for financial statement fraud. Revenue recognized on a transaction with a related party lacking economic substance, expenses absorbed by an affiliate to flatter results, and round-tripping arrangements all require a related party — and their concealment requires a related party the auditor never identified.

It is the vehicle for misappropriation dressed as a transaction. A payment to an entity the owner controls looks like a vendor payment.

And even when entirely proper, it changes what a reader needs to know. In an owner-managed entity, related party transactions are pervasive — the building lease, the management fee, the loan, the family member on the payroll — and a reader cannot evaluate the financial statements without knowing which results depend on arrangements that could change at the owner's discretion.

Who Counts

The definition is functional rather than a list, which is why searching for a list misses parties.

It reaches affiliates, entities under common control, principal owners, management and their immediate families, entities in which an owner or member of management holds a significant interest, and trusts for the benefit of employees.

And it reaches the broad category people overlook: parties with a relationship such that one may influence the other to an extent that one might be prevented from pursuing its own separate interests. That captures arrangements no ownership chart shows — a dominant customer, a lender with unusual influence, an entity sharing management, or a supplier owned by a family member of a manager.

The Independent Search

The core of the engagement. In rough order of productivity:

Compare the vendor and customer master files against the employee file — on addresses, phone numbers, bank account details, and tax identification numbers. Matches are not proof and are always worth a question.

Read the legal invoices. The single most productive underused procedure in this area. Counsel bills for entity formations, leases, shareholder agreements, buy-sell arrangements, and disputes — which means the legal invoices name the entities and the relationships before any disclosure does.

Search public records and entity registrations on the entity's own name, its owners, and its officers. Common addresses, common registered agents, and officers appearing across entities are what you are looking for.

Examine vendors with suspicious characteristics — a post office box, a residential address, no web presence, a name echoing a family name, a recent formation date, or an unusually rapid growth in spend.

Read the board and shareholder minutes, which frequently authorize the very transactions the disclosure omits.

Collect and read conflict of interest disclosures from officers and directors — and where the entity does not collect them, that absence is itself a finding.

Read the entity's own tax return, including its related-party disclosures and any pass-through statements the entity receives, which reveal interests nobody mentioned.

Read loan agreements and guarantees, which name affiliates and frequently require related-party disclosure to the lender that the financial statements omit.

Reconcile interest income and expense to the instruments you know about. Unexplained interest indicates an instrument you have not seen, frequently with a related party.

Compare to prior-year workpapers and confirmations.

And ask people other than management. Accounts payable staff know which vendors are unusual, which invoices lack support, and which payments the owner authorizes personally. This is inquiry that produces information a management representation will not.

Procedures for Identified Transactions

Once a transaction is identified, five things need testing — and the first is the one that matters most.

Business purpose. What is the transaction for? A transaction with no discernible business purpose is the recurring feature of related party abuse, and "the owner wanted to" is not a business purpose. Document the purpose and your evaluation of it, not management's assertion of it.

Whether it would have occurred at all with an unrelated party, and on what terms. Test the terms against market where a market exists — comparable rents, comparable rates, comparable fees — recognizing that for some arrangements no market comparison exists, which is itself worth stating.

Documentation. Related party transactions are frequently undocumented — a loan with no note, a lease with no agreement, a management fee with no contract. That absence is evidence about the arrangement's nature, not merely a records deficiency, because an undocumented "loan" between an owner and their entity is difficult to distinguish from a distribution.

Authorization, and by whom. An owner approving their own lease is not authorization. Look for approval by someone without an interest — a board without the interested party, an independent director, or a shareholder vote.

Substance versus form. Does the transaction's substance match its label? A "loan" never repaid and never demanded is a distribution. "Rent" set above market is compensation. A "management fee" with no services performed is a transfer. The accounting should follow the substance.

And two further steps:

Collectibility of related-party receivables, which are carried at full value indefinitely in a striking number of entities. A receivable from an owner with no repayment history and no note is not an asset in the ordinary sense.

The effect on measures that matter — covenant calculations, incentive computations, and any contractual metric, since a related-party transaction can move a figure someone relies on.

On confirmation: confirming a balance with the related party has real limitations, because the counterparty is not independent. A confirmation from an entity the owner controls is evidence of what the owner says.

The Transactions to Scrutinize Specifically

In an owner-managed entity, this is where the substance almost always is:

Owner compensation — both excessive, which understates income, and inadequate, which overstates it and raises the reasonable compensation question our post on year-end planning addresses.

The owner-owned building lease. The most common related party transaction in existence, and the terms are frequently set for tax reasons rather than economic ones — which also affects the lease accounting, per our post on year-end statement preparation.

Loans in either direction, with attention to documentation, interest, and repayment.

Management fees and shared services between affiliates, and whether the allocation reflects anything.

Expense allocations between commonly controlled entities, which are frequently arbitrary and which shift results between entities.

Sales and purchases with affiliated entities, and whether margins on them are comparable.

Guarantees given and received, which may be unrecorded and are disclosable.

Personal expenses paid by the entity, which are a tax issue, a presentation issue, and frequently the start of a longer conversation.

Disclosure — and the Requirement Most Often Missed

The disclosure requirements are specific, and small entity statements satisfy them poorly.

Required: the nature of the relationship, a description of the transactions including amounts and any other information necessary to understand their effect, the amounts due to and from related parties with the terms and manner of settlement, and — where applicable — the effect of any change in the method of establishing terms from the prior period.

And the requirement most often missed: related party transactions should not be represented as being at arm's length unless that representation can be substantiated. A disclosure asserting that transactions were on terms equivalent to those with unrelated parties, with nothing supporting it, is itself a problem — and it is boilerplate language that appears in statements routinely.

The correct approach is either to substantiate the assertion or not to make it.

Practical additions: disclose guarantees and commitments, disclose the arrangements that could change at the related party's discretion where material to understanding, and ensure the disclosure is specific enough that a reader can identify what depends on the relationship rather than reading a generic paragraph.

Structured coverage is available through the audit training courses catalog, internal auditing training, the Certificate in Forensic Accounting, Fraud Examination, the fraud and forensic accounting training catalog, the Certificate in Financial Reporting and Analysis, and the financial statements training listing.

Representations and Their Limits

Management representations regarding related parties are required and they are not a substitute for procedures. The representation confirms what management has told you; it does not establish completeness.

Where the auditor identifies a related party or a transaction that management did not disclose, that fact matters beyond the transaction itself — it is information about management's representations generally, and it should affect the assessment of other representations and of fraud risk. Document that reasoning rather than simply adding the transaction to the disclosure.

Communication

Significant related party findings — particularly an undisclosed party, a transaction outside the normal course, or a transaction whose substance differs from its form — should be communicated to those charged with governance.

At an owner-managed entity where the owner is governance, that communication is awkward and still required in substance. The practical approach is a written communication that records what was identified and what was concluded, which serves the professional obligation and creates the record.

Where This Goes Wrong

• Relying on management's list, which is circular
• No independent search, with completeness supported only by a representation
• Legal invoices never read — the most productive procedure skipped
• Vendor and employee master files never compared
• Board minutes not read, though they authorize the transactions
• Conflict disclosures not collected, and the absence not treated as a finding
• Pass-through statements the entity receives never examined for undisclosed interests
• Interest income and expense not reconciled to known instruments
• Only management interviewed, when accounts payable staff know more
• Business purpose not tested, or management's assertion of it recorded as the auditor's conclusion
• Undocumented arrangements treated as a records issue rather than as evidence
• An owner's approval of their own transaction accepted as authorization
• Substance not compared to form, so a distribution stays labelled a loan
• Related-party receivables carried at full value with no collectibility assessment
• Confirmations from a controlled entity treated as independent evidence
• A boilerplate arm's-length assertion in the disclosure with nothing supporting it
• An undisclosed party found and treated as an isolated omission rather than as information about management's representations

The summary for an engagement: search independently rather than confirming a list, read the legal invoices and the board minutes and the entity's own tax return, ask the accounts payable clerk which vendors are odd — and for every transaction you find, test the business purpose and the substance rather than the label. Then check whether the disclosure asserts arm's-length terms that nobody substantiated, because it probably does.

Frequently Asked Questions

Why can't an auditor rely on management's related party list?

Because management is the primary source of the list, so testing it against their completeness assertion is circular — it establishes only that management disclosed what management said existed. Completeness requires an independent search, and a file whose only evidence is a representation has not performed one.

What is the most productive search procedure?

Reading the legal invoices. Counsel bills for entity formations, leases, shareholder and buy-sell agreements, and disputes, which means the legal file names entities and relationships before any disclosure does. Comparing the vendor and customer master files against the employee file on addresses, phone numbers, and bank details is a close second.

What single test matters most for an identified transaction?

Business purpose. A transaction with no discernible business purpose is the recurring feature of related party abuse, and management's assertion of a purpose is not the auditor's conclusion. Substance versus form follows closely — a loan never repaid or demanded is a distribution, and rent above market is compensation.

Is missing documentation just a records problem?

No. Related party transactions are frequently undocumented — a loan with no note, a lease with no agreement, a fee with no contract — and that absence is evidence about the arrangement's nature. An undocumented loan between an owner and their entity is difficult to distinguish from a distribution, which is the point.

Which disclosure requirement is most often missed?

The requirement not to represent transactions as being at arm's length unless that representation can be substantiated. Boilerplate language asserting terms equivalent to those with unrelated parties, with nothing supporting it, appears routinely and is itself a problem. Either substantiate the assertion or do not make it.

What follows from finding a related party management did not disclose?

More than adding it to the disclosure. An undisclosed party or transaction is information about management's representations generally, and it should affect the assessment of other representations and of fraud risk — with that reasoning documented rather than left implicit.