PCAOB Auditing Standard 2401 is the rulebook auditors follow when looking for fraud during the financial statement audit of a public company. It governs the whole arc of the fraud assessment: the team brainstorming session, the risk identification, the audit response, the communications to management and the audit committee, and, in some cases, reporting to the SEC. It applies to every audit conducted under PCAOB oversight and treats fraud detection as a core audit obligation rather than optional diligence.
The Two Fraud Categories in Scope
AS 2401 draws a line between two kinds of fraud the auditor must watch for. The first is fraudulent financial reporting, meaning intentional manipulation of the books to mislead readers of the financial statements. That can look like fabricated records, misrepresented timing or nature of transactions, or deliberate misapplication of accounting standards to inflate revenue or hide losses. The people behind this type of fraud are almost always senior managers trying to hit earnings targets, prop up the stock price, or satisfy debt covenants.
The second category is misappropriation of assets, which is straightforward theft: employees or executives take company resources in a way that throws off the financial statements. Skimming cash, stealing inventory, or approving payments for goods and services the company never received all fit here. Financial reporting fraud tends to flow from the top down; asset theft can happen at any level. Both share one defining feature: the act was intentional.
Professional Skepticism and the Brainstorming Session
The standard requires professional skepticism across the whole engagement. In practical terms, the audit team cannot assume management is honest just because nothing has gone wrong before. AS 2401 is explicit that prior clean audits do not justify relaxed vigilance. Evidence gets evaluated with a questioning mind, and the possibility of fraud is treated as real regardless of past experience with the client.
The standard also requires a formal brainstorming session where the engagement team, with the engagement partner participating, discusses how and where the company’s financial statements could be materially misstated by fraud. The discussion covers methods management might use to commit and conceal fraud and ways assets could be stolen. It also has to cover the external and internal factors that create incentives to commit fraud, provide opportunities, or reflect a culture that lets management rationalize dishonest behavior. This three-part frame, the fraud triangle, drives the rest of the risk assessment.
Incentives, Opportunities, and Rationalization
Incentives and pressures include earnings forecasts, loan covenants, and compensation tied to reported results, along with personal stakes like stock options. Opportunities come from weak internal controls or complex organizational structures that make oversight hard. Rationalization is the attitude piece: auditors can’t measure someone’s ethics directly, but they can watch for warning signs like routine management override of controls, aggressive disputes over audit findings, or a treatment of accounting rules as suggestions.
Gathering Information
Brainstorming sets the stage; hard information converts general suspicion into specific, testable fraud risks. AS 2401 requires direct inquiries of management, the audit committee, and other individuals within the company about any actual or alleged fraud. Analytical procedures add a second layer, flagging unusual relationships in the financial data, such as revenue growth that outpaces production capacity or margins that deviate sharply from industry norms. Year-end journal entries and other adjustments get extra scrutiny because they are a common vehicle for manipulation. The quality and timing of the evidence itself, including documents produced late in the audit to resolve contentious issues, are treated as clues.
Two Fraud Risks the Standard Presumes
AS 2401 sets two fraud risks that auditors must treat as present in every engagement unless specific facts justify a different conclusion.
The first is improper revenue recognition. Revenue is the most common target of financial statement fraud because small timing or classification changes can have outsized effects on reported earnings. If the audit team concludes that revenue recognition is not a fraud risk on a particular engagement, the reasoning has to be documented in the working papers.
The second is management override of internal controls. No matter how well the control environment is designed, senior leaders have the authority to circumvent it. That risk cannot be cleared by a clean control assessment; it exists by definition. AS 2401 requires three specific procedures to address it.
The Three Mandatory Management Override Procedures
First, the auditor must test journal entries and other adjustments recorded in the general ledger. That means understanding the financial reporting process and the controls around journal entries, identifying entries that warrant testing, and asking people involved in the reporting process about inappropriate or unusual activity. Testing ordinarily focuses on entries made at the end of the reporting period, when manipulation risk peaks.
Second, the auditor performs a retrospective review of accounting estimates. The prior year’s significant estimates are compared to actual results to see whether management’s judgments and assumptions show a pattern of bias. If bias appears, the auditor evaluates whether it represents a fraud risk for the current year’s estimates.
Third, the auditor evaluates the business rationale for significant unusual transactions, meaning transactions outside the normal course of operations or notable for their timing, size, or nature. The team reads underlying documentation, checks authorization, assesses whether counterparties had the financial capacity to complete the deal, and considers whether the structure suggests the transaction was designed to manipulate results or hide stolen assets.
Responding to Identified Fraud Risks
Once fraud risks are identified and assessed, the standard requires a response at two levels. The overall response changes how the audit is run: assigning more experienced staff to high-risk areas, increasing supervision, and choosing procedures management would not anticipate. AS 2401 specifically calls for unpredictability, such as observing inventory at unexpected dates or locations, or counting cash on a surprise basis.
The specific response adjusts the nature, timing, and extent of testing based on where risks are concentrated. Timing matters. The standard encourages shifting substantive testing closer to year-end rather than relying on interim work, because fraudulent entries often land in the final days of a reporting period. Inventory counts may be moved to period-end or conducted at all locations on the same date to prevent manipulation between the count and the close.
Communications About Fraud
When the auditor finds evidence that fraud may exist, AS 2401 requires prompt communication to the right people inside the company. Any evidence of possible fraud, even something as small as petty theft by a low-level employee, must be reported to an appropriate level of management. Fraud involving senior management, or any fraud that causes a material misstatement, must go directly to the audit committee before the auditor issues the report.
The communication obligations extend past confirmed fraud. If identified fraud risks have continuing implications for internal controls, they may amount to significant deficiencies or material weaknesses, which must also be communicated to senior management and the audit committee. The auditor should also consider sharing other identified fraud risks with the committee as part of the broader conversation about business and financial statement risks.
Disclosure to a Successor Auditor
When a company changes auditors, the predecessor may need to share fraud-related information with the incoming firm. AS 2401 recognizes that the auditor may have a duty to disclose possible fraud to a successor auditor when the successor makes inquiries under PCAOB AS 2610, which governs predecessor–successor communications. Making that disclosure requires specific permission from the client.
Reporting to the SEC Under Section 10A
Reporting can escalate beyond the company when management and the board refuse to act. Under Section 10A of the Securities Exchange Act, if the auditor determines that a likely illegal act has occurred, the auditor must report it to the board of directors. The board then has one business day to notify the SEC and provide the auditor with a copy of that notice. If the auditor does not receive a copy of the board’s notice within that one-business-day window, the auditor must either resign from the engagement or furnish the SEC directly with a copy of the auditor’s report within one business day.
If the auditor resigns, the firm still has to send its report to the SEC within one business day of the issuer’s failure to notify the Commission. These reports go to the SEC’s Office of the Chief Accountant and must clearly identify both the company and the accounting firm.
What the Working Papers Must Show
AS 2401 requires detailed documentation covering every stage of the fraud assessment. The working papers must include:
- When the brainstorming session occurred, who participated, and what was covered.
- The information-gathering procedures used to identify and assess fraud risks.
- The specific fraud risks identified at the financial statement and assertion levels, and the link between each risk and the planned response.
- If the team concluded that improper revenue recognition was not a fraud risk, the reasoning supporting that conclusion.
- The results of procedures designed to address assessed fraud risks, including the three management override procedures.
- The nature of communications about fraud made to management, the audit committee, or others.
The documentation does two jobs. It demonstrates compliance with AS 2401, and it creates a reasoning trail PCAOB inspectors can evaluate during review of the engagement. Documentation gaps are among the most common inspection findings and can trigger enforcement action even when the underlying audit work was adequate.
Enforcement Consequences
The PCAOB can investigate and discipline registered firms and their associated persons for violations of auditing standards, including AS 2401. Sanctions include censure, temporary or permanent suspension or revocation of a firm’s registration, temporary or permanent bars on individuals, and civil money penalties. Maximum penalty amounts are adjusted periodically for inflation under the Federal Civil Penalties Inflation Adjustment Act. Enforcement orders against firms that failed to adequately assess fraud risk have produced penalties ranging from tens of thousands to several million dollars, depending on the severity and scope of the violations.
The cases tend to focus on failures that are easy to spot in hindsight: brainstorming sessions that never happened or were treated as a formality, identified fraud risks never linked to specific procedures, retrospective reviews of estimates skipped entirely, and journal entry testing that covered only routine entries while ignoring the high-risk adjustments the standard targets. The pattern is usually not that auditors missed sophisticated fraud but that they skipped or abbreviated the procedures AS 2401 specifically requires.