Revenue recognition: side agreements, reseller channel and a whistleblower
Vantrell Software plc, a listed SaaS provider with a 31 December year end, reported Q4 revenue of $46m, 42% of the $110m annual total (prior year Q4: 28%). Twelve contracts totalling $9.8m were signed between 18 and 31 December, several on a non-standard template containing cancellation for convenience or acceptance clauses. Two contracts ($3.1m) are with a reseller that has no identified end customer and 180-day payment terms. Bundled implementation services are recognised on delivery without allocation of standalone selling prices. The CFO's bonus is 60% revenue-based, and the CFO has told the team revenue will be fine and that all contracts are standard. A whistleblower email alleges that licences were shipped that nobody ordered. One manual journal entry of $1.4m posted on 30 December reverses on 2 January. The engagement team planned to rely on the revenue approval control, which tested without exception in 24 of 25 samples. Materiality is $3.5m; the questionable revenue totals $5.2m.
1. Revise the fraud risk assessment for revenue and design the audit response, including the use of analytics.
Read the worked answer
The indicators point strongly to a fraud risk in revenue, not merely an error risk. The presumption of fraud risk in revenue recognition is reinforced by the Q4 concentration (42% versus 28%), contracts signed in the last two weeks, non-standard cancellation and acceptance clauses, a reseller with no identified end customer and 180-day terms, a revenue-linked CFO bonus, a manual entry that reverses on 2 January, and a whistleblower allegation about unordered shipments.
The team should revise the risk assessment, treat revenue as a significant risk with a fraud component, and design procedures that are not limited to the normal control-based approach. Specific procedures: read all 12 contracts and any amendments, side letters or emails; inquire of legal counsel and the sales team; send confirmations to customers and the reseller covering terms, acceptance, return rights and whether an end customer exists; examine post-year-end credit notes, returns, write-offs and cash receipts; test the reseller's sell-through to end users; perform cut-off testing around 31 December and inspect shipping and delivery evidence; run journal-entry analytics for unusual users, round amounts, post-year-end reversals and entries made outside normal hours; investigate the whistleblower allegation and any internal investigation file.
Consider bringing in a forensic specialist and extending procedures into the prior period. The objective is to determine whether $5.2m of revenue met the recognition criteria and whether the pattern indicates management override rather than isolated error.
2. Evaluate whether the planned controls-reliance strategy remains appropriate, and how management representations and the whistleblower allegation should affect the evidence obtained.
Read the worked answer
The fact that the approval control operated as designed in 24 of 25 samples does not support a controls-reliance strategy here. The control tests whether a contract was approved, not whether the recorded terms are complete or whether side letters exist. Side agreements and manual entries sit outside the control, and the CFO's compensation incentive and the whistleblower allegation undermine the control environment. Where management override is a risk, controls cannot provide the assurance needed, and the team should shift to a substantive approach with no reduction in sample sizes.
On representations, obtain written representations covering revenue recognition, the existence of side agreements, the whistleblower allegation and the completeness of information given. But those representations are weak evidence when management is the subject of the concern, and they cannot substitute for external evidence such as customer confirmations and post-year-end cash.
If management refuses to permit customer contact, record the refusal, ask those charged with governance to intervene, and consider recommending an independent investigation. A refusal is itself a scope limitation and may indicate that management is concealing information. Consider whether the team can continue to rely on management's other representations, and document the reassessment of control risk.
3. Determine the implications for the audit opinion if management refuses to adjust the $5.2m of revenue and refuses to permit customer contact.
Read the worked answer
Quantify first. The questionable revenue is $5.2m against materiality of $3.5m, so it is material by amount. Consider qualitative materiality too: if the revenue reverses, growth may turn negative, covenants or bonus targets may fail, and reported profit may change sign.
If management refuses to adjust and refuses customer contact, two problems combine: a likely material misstatement and a scope limitation. The auditor cannot obtain sufficient evidence and cannot accept the balances.
Opinion: if the misstatement and limitation relate to revenue and receivables but the rest of the financial statements is auditable, a qualified opinion is likely. If revenue is the key driver of the group's results and the misstatement calls the financial statements as a whole into question, an adverse opinion is appropriate. A disclaimer may be considered if the limitation prevents an opinion on the statements as a whole, but a disclaimer should not be used to avoid a disagreement.
Also consider communicating with those charged with governance, reporting to the regulator if fraud is suspected, withdrawing if management is involved and the auditor cannot continue, the effect on comparative figures, and the effect on any other reports such as covenant certificates or interim reviews. Document the disagreement and the basis for the opinion.