Document ID: chunk:federal_register_of_legislation:F2023C01124:reg:17:p19
Version: federal_register_of_legislation:F2023C01124
Segment Type: reg
Provision Reference: reg 17 (pt 19/41)
Character Range: 64199–67272

they affect inherent risk, inherent risk factors.[19] Fraud risk factors may also relate to conditions within the entity's system of internal control that provide opportunity to commit fraud or that may affect management's attitude or ability to rationalise fraudulent actions.  Fraud risk factors reflective of an attitude that permits rationalisation of the fraudulent action may not be susceptible to observation by the auditor.  Nevertheless, the auditor may become aware of the existence of such information through, for example, the required understanding of the entity's control environment.[20]  Although the fraud risk factors described in Appendix 1 cover a broad range of situations that may be faced by auditors, they are only examples and other risk factors may exist.

A27.         The size, complexity, and ownership characteristics of the entity have a significant influence on the consideration of relevant fraud risk factors.  For example, in the case of a large entity, there may be factors that generally constrain improper conduct by management, such as:

           * Effective oversight by those charged with governance.

           * An effective internal audit function.

           * The existence and enforcement of a written code of conduct.

    Furthermore, fraud risk factors considered at a business segment operating level may provide different insights when compared with those obtained when considered at an entity‑wide level.

Considerations Specific to Smaller Entities

A28.         In the case of a small entity, some or all of these considerations may be inapplicable or less relevant.  For example, a smaller entity may not have a written code of conduct but, instead, may have developed a culture that emphasises the importance of integrity and ethical behaviour through oral communication and by management example.  Domination of management by a single individual in a small entity does not generally, in and of itself, indicate a failure by management to display and communicate an appropriate attitude regarding internal control and the financial reporting process.  In some entities, the need for management authorisation can compensate for otherwise deficient controls and reduce the risk of employee fraud.  However, domination of management by a single individual can be a potential deficiency in internal control since there is an opportunity for management override of controls.

Identification and Assessment of the Risks of Material Misstatement Due to Fraud

Risks of Fraud in Revenue Recognition (Ref: Para. 27)

A29.         Material misstatement due to fraudulent financial reporting relating to revenue recognition often results from an overstatement of revenues through, for example, premature revenue recognition or recording fictitious revenues.  It may result also from an understatement of revenues through, for example, improperly shifting revenues to a later period.

A30.         The risks of fraud in revenue recognition may be greater in some entities than others.  For example, there may be pressures or