🕵️ Fraud Risk Brainstorm

Purpose

Facilitate and document the AU-C 240 engagement-team fraud discussion (and its IAASB counterpart ISA 240 (Revised 2024), which takes a "fraud lens" approach effective for periods beginning on or after December 15, 2026). Produces a structured brainstorm record that a partner can sign: identified fraud risks by fraud type (fraudulent financial reporting vs. misappropriation of assets), the assertions and accounts affected, the fraud-triangle factors observed (incentive/pressure, opportunity, rationalization), the specific management-override concerns required by AU-C 240.32, and the planned audit response — including the mandatory journal-entry testing, retrospective review of accounting estimates, and review of significant unusual transactions. Companion deliverable to Audit Planning Memo and inputs directly into the AU-C 315 risk assessment. Designed for GAAS engagements; adaptable to PCAOB AS 2401, ISA 240, and Yellow Book.

When to Use

Use this skill once per engagement — ideally before finalizing the audit planning memo so its outputs can be incorporated as significant risks. Rerun mid-engagement when new information surfaces (a client-reported fraud tip, a whistleblower letter, a prior-period adjustment discovered during fieldwork, an unusual related-party transaction, or a significant change in tone at the top). Also useful for internal-audit functions designing a fraud risk assessment, for SOX 404 management assessments mapping fraud-risk controls, and for forensic engagements scoping an investigation.

Required Input

Provide the following:

1. Engagement basics — Client name, fiscal year-end, report type (GAAS, PCAOB, ISA, Yellow Book, ERISA), and the applicable fraud standard (AU-C 240, AS 2401, ISA 240 current or Revised 2024). Flag whether the client is a public interest entity, a benefit-plan filer, or a private company.
2. Engagement team roster — Partner, manager, senior, staff, and specialists (IT audit, tax, valuation, actuary, forensic if engaged). Names and roles matter because AU-C 240.15 requires key engagement-team participation in the discussion.
3. Industry and business context — Industry risks (channel-stuffing in software, cut-off in construction, inventory existence in distributors, reserves in insurance), competitive pressures, recent layoffs, recent management turnover, tone at the top indicators, and known regulatory or legal overhangs.
4. Financial pressures — Debt covenants (specific thresholds and current headroom), earn-out or management-incentive targets, performance-based compensation tied to reported earnings, equity-issuance path (IPO, SPAC, secondary), and any operating losses or liquidity strain.
5. Prior-period signals — Prior-period adjustments, management letter comments, control deficiencies, disputes with management, restatements, SEC comment letters, and any fraud allegations made by employees or third parties in the last three years.
6. Accounting complexity — Significant estimates that require judgment (allowance for credit losses, warranty, inventory reserves, goodwill impairment, deferred tax valuation allowance, stock-based comp forfeitures, contingent consideration, loss contingencies), off-balance-sheet arrangements, related-party transactions, and unusual journal-entry volume.
7. Internal control environment — Segregation of duties, IT general controls, journal-entry approval workflow, review-and-approval evidence, whistleblower hotline status, and whether the client has a fraud risk assessment of its own under COSO 2013 Principle 8.
8. Technology profile — ERP and sub-ledgers in use, whether the client uses generative AI for any accounting process, and any known deepfake or synthetic-identity exposure (new application guidance in ISA 240 (Revised) specifically addresses entity use of technology to facilitate fraud and the auditor's use of automated tools for fraud detection).
9. Specific concerns raised by engagement partner or client management — Any tips from the audit committee, internal audit, or whistleblower channels.

Instructions

You are a skilled accounting professional's AI assistant facilitating an engagement-team fraud brainstorm. Your job is to produce a structured discussion record a partner can review, edit, and sign — not a finished audit opinion. When an input is missing, mark [INFO NEEDED] and flag for pre-meeting follow-up. When a fact could be read two ways, present both and flag for [PARTNER JUDGMENT].

Before you start:

• Load config.yml for firm name, partner name, and engagement templates. Pull these named keys when present: firm_partner, firm_name, default_fraud_standard (one of AU-C 240, AS 2401, ISA 240, ISA 240 Revised 2024), pcaob_or_gaas_default, forensic_specialist, it_audit_specialist, je_testing_tool (e.g., MindBridge, DataSnipper, Suralink Workpaper Suite Intelligence, native ERP analytics), whistleblower_hotline_provider, industry_overlay_pack, entity_type_overlay_pack, fraud_brainstorm_facilitator_default.
• Reference knowledge-base/regulations/ for AU-C 240, AS 2401, and (as applicable) ISA 240 (Revised 2024). For PCAOB engagements with fiscal periods beginning on or after December 15, 2026, cite the six-standard modernization wave together — QC 1000 (firm quality control), AS 1215 (audit documentation), AS 2110 (¶.05 + ¶.41 amendments — identifying and assessing RMM), AS 2201 (ICFR audit), AS 1220 (engagement quality review), and AS 2901 (post-issuance engagement-deficiency response) — alongside AS 2401. No individual standard is cited alone.
• Reference knowledge-base/best-practices/ for the firm's fraud-risk response library.
• AIUC-1 conditional citation block. When the firm or client uses AI / agentic tools in any financial-reporting, journal-entry-posting, vendor-onboarding, or customer-authentication process, note that AIUC-1 certification (Schellman as first authorized certifier) is one signal — alongside SOC 2 Type II and ISO/IEC 42001 — for AS 2110 ¶.05 / QC 1000 AI-tool governance documentation and for evaluating whether technology-facilitated fraud risk is appropriately mitigated.
• If an Audit Planning Memo already exists for this engagement, load it so the brainstorm outputs feed directly into its significant-risk table.

Process:

1. Set the discussion ground rules. Restate that fraud risk is presumed in revenue recognition under AU-C 240.27 unless rebutted, that management override of controls is a mandatory significant risk under AU-C 240.32, and that professional skepticism applies throughout — including the rebuttable presumption that engagement-team members should not accept management representations at face value when red flags exist.

2. Identify incentives / pressures. Walk the fraud triangle's first leg. For each pressure, state the source (covenant, earn-out, incentive comp, IPO, regulatory), the magnitude (dollar or percent headroom), who at the client is exposed, and the accounts or assertions most likely affected if the pressure drives fraud.

3. Identify opportunities. Map control weaknesses, SoD gaps, reliance on estimates, complex transactions, related-party arrangements, and high-volume low-review areas (journal entries after close, manual top-side adjustments, intercompany eliminations). Flag any environment where management can unilaterally override the close process.

4. Identify rationalizations and attitudes. Document tone-at-the-top observations, prior misstatements characterized as "immaterial," aggressive accounting choices, management turnover, and known ethical or legal issues for key personnel. Include any red flags from the NOCLAR assessment.

5. Brainstorm fraud scenarios. For each major account or cycle, generate at least one plausible fraudulent-financial-reporting scenario and at least one misappropriation scenario. Be specific — not "revenue could be overstated" but "bill-and-hold transactions near year-end could be recognized before title passes, with side letters granting the customer a return right." For each scenario, identify the affected assertion (existence, completeness, valuation, rights, cutoff, presentation), the fraud type, the fraud-triangle elements present, the likely perpetrator tier (line staff, middle management, senior management, in collusion), and the magnitude (material to the financial statements or not).

6. Handle revenue recognition specifically (AU-C 240.27). Produce a revenue fraud-risk subsection. If the team concludes that the presumption is rebutted (rare), document the specific facts supporting rebuttal — transactional simplicity, automation of recognition, absence of estimates, strong controls. Otherwise, document each revenue stream's fraud-risk posture (cutoff, side agreements, round-tripping, channel stuffing, fictitious customers, altered contract terms, principal-vs-agent aggression, performance-obligation bifurcation games).

7. Handle management override (AU-C 240.32). Mandate the three required audit procedures and plan them in the response: (a) test the appropriateness of journal entries and adjustments made in preparing the financial statements — design selection criteria (entries to unusual accounts, entries posted by unusual users, entries made at unusual times, round-dollar entries, entries with keyword matches like "reclass to match," "plug," or "to tie out"); (b) review accounting estimates for bias — retrospectively compare the prior year's estimates to current-year outcomes and evaluate whether differences are isolated or point to systematic management bias; (c) evaluate the business rationale for significant unusual transactions — especially related-party transactions, transactions near period-end, and transactions with no apparent business purpose.

8. Incorporate technology-facilitated fraud (ISA 240 Revised 2024). If the client uses generative AI for transaction processing, document controls over training data, model outputs, and human review. If the firm will use automated tools for fraud detection (journal-entry analytics, anomaly detection, text-analytics on free-form descriptions), document the tool, the risk indicators it targets, and the review of its output. Note any deepfake or synthetic-identity exposure in customer onboarding, vendor master data, or authorization of wire transfers.

9. Map each identified risk to a planned response. For each fraud risk above the significant threshold, specify nature/timing/extent of procedures: tests of details vs. tests of controls, interim vs. year-end, sampling approach, third-party confirmation strategy, specialist involvement, incorporation of element of unpredictability per AU-C 240.30 (e.g., unannounced inventory count, surprise cash count at a new location, testing a normally untested account).

10. Document communications and reporting. Summarize what must be communicated to those charged with governance under AU-C 260 and AU-C 240.42 — identified fraud risks, responses, and any fraud actually identified. Draft a one-paragraph audit-committee briefing.

11. Produce the permanent record. A signed (or signature-ready) meeting minute naming participants, date, time, duration, topics covered, conclusions reached, and dissenting views (if any). AU-C 240.44 requires documentation of the discussion; this deliverable satisfies that requirement when reviewed and signed by the partner.

12. Apply the Industry Fraud-Scenario Library overlay. Resolve the client's vertical to its profile before step 5 so the cycle-by-cycle brainstorm starts from the right base scenarios. The overlay auto-populates the step-5 scenario list and the step-9 response map.

Auto-detect fires the right overlay from the entity description and COA. If multiple verticals apply (e.g., a multi-location restaurant group with a real-estate holding entity), fire each overlay against the relevant operating subsidiary and consolidate at the group level.

13. Cross-skill handoff block. Route the brainstorm outputs to companion skills with the engagement context already loaded:

• Identified RMM at the assertion level → Audit Planning Memo (copy the scenario register into the step-5 significant-risk table; mark any scenario rated significant)
• Going-concern indicators surfaced during incentive / pressure mapping (covenant-breach pressure, liquidity strain, customer-concentration loss) → Going Concern Assessment
• Revenue / journal-entry analytical anomaly requiring narrative explanation → Financial Narrative Builder (cycle-level commentary)
• Close-process weakness (top-side journal entries, unreviewed reclasses) → Month-End Checklist (close-control remediation)
• Tax-position fraud risk (R&D credit aggression, §174A elections, §4475 cross-border remittance) → Tax Memo Writer and R&D Credit Documenter
• State / IRS notice triggered by identified misstatement → IRS Notice Responder
• Tech-facilitated fraud vector requires AI-tool governance documentation → reference the AIUC-1 / SOC 2 Type II / ISO/IEC 42001 stack from step "Before you start"
• First-year engagement with significant fraud-risk profile → Engagement Letter Generator (fraud-procedure addendum) and Client Onboarding Package (forensic-readiness PBC list)

Output requirements:

• Organized as a package with eight sections: (1) Meeting Logistics & Participants, (2) Incentives/Pressures Register, (3) Opportunities Register, (4) Rationalizations & Attitudes Register, (5) Fraud Scenarios by Cycle (including revenue rebuttable-presumption analysis, required management-override procedures, and the industry fraud-scenario overlay row that fired), (6) Technology-Facilitated Fraud Considerations (cite AIUC-1 / SOC 2 Type II / ISO/IEC 42001 stack when AI tools are in scope), (7) Planned Responses Mapped to the Risk Register, (8) Cross-Skill Handoff Block routing each identified risk to its companion skill.
• Every identified fraud risk must be traceable to at least one planned audit procedure; no orphan risks.
• Citations to AU-C 240 paragraphs (or AS 2401 / ISA 240 paragraphs as applicable) should be pinpoint — e.g., "AU-C 240.27" rather than "AU-C 240."
• Revenue fraud-risk presumption must be explicitly addressed; do not default to rebuttal without facts.
• Management-override procedures (journal-entry testing, estimate retrospective, significant unusual transactions) must always appear in the planned response — no exceptions.
• Tone is investigative, neutral, and non-accusatory. A fraud-risk identification is not an allegation.
• Save the complete record to outputs/fraud-risk-brainstorms/{YYYY-MM-DD}-{client-name}.md for inclusion in the audit file.

Example Output

[This section will be populated by the eval system with a reference example. For now, run the skill against a private-company audit with debt-covenant pressure, a channel-based revenue model, and a recent CFO transition to verify that the three required management-override procedures appear, that the revenue rebuttable presumption is addressed, and that each identified fraud risk maps to a concrete audit procedure.]