The Fraud Triangle and the Auditor's Responsibility for Fraud
By SimplyCPA · 11 October 2026
On this page (5)
- Fraud triangle: Incentive or pressure, opportunity, and attitude or rationalisation — fraud risk is highest when all three are present.
- Two types that matter to auditors: Fraudulent financial reporting (cooking the books) and misappropriation of assets (theft).
- Auditor's responsibility: Reasonable — not absolute — assurance that the financial statements are free of material misstatement, whether from error or fraud.
- Presumed risks: Improper revenue recognition is presumed a fraud risk (rebuttable); management override of controls is present in every audit (not rebuttable).
- Always required: Testing journal entries, reviewing estimates for bias, and evaluating significant unusual transactions.
The fraud triangle
- Incentive or pressure — bonus targets, debt covenants, analyst expectations, personal financial trouble.
- Opportunity — weak controls, complex transactions, ineffective oversight by the board, management able to override controls.
- Attitude or rationalisation — "I'll pay it back", "everyone does it", a culture that tolerates aggressive accounting.
Auditors rarely observe rationalisation directly, so they focus on the incentives and opportunities they can see.
Two types of fraud
| Fraudulent financial reporting | Misappropriation of assets | |
|---|---|---|
| Who | Usually management | Usually employees, in smaller amounts |
| How | Fictitious revenue, improper cutoff, biased estimates, hidden liabilities, misleading disclosures | Theft of cash or inventory, fake vendors, payroll fraud, personal expenses |
| Concealment | Often via top-side journal entries and management override | Forged documents, collusion |
What every audit must include
- A team discussion (often called brainstorming) about how and where the financial statements could be susceptible to fraud.
- Inquiries of management, internal audit and those charged with governance about fraud risks and known or suspected fraud.
- Treating revenue recognition as a presumed fraud risk unless the auditor documents why it doesn't apply.
- Responding to management override in every audit by:
- testing the appropriateness of journal entries and other adjustments;
- reviewing accounting estimates for bias, including a retrospective review of prior-year estimates;
- evaluating the business rationale for significant unusual transactions.
- Incorporating an element of unpredictability into procedures.
When fraud is found
Any evidence of fraud is communicated to an appropriate level of management. Fraud involving senior management, or causing a material misstatement, goes to those charged with governance. Reporting to outside parties is generally restricted by confidentiality, with exceptions — for example, legal requirements or a successor auditor's inquiries.
Exam trap: Fraud is harder to detect than error because it is intentionally concealed — that's why an audit properly planned and performed may still miss it. "The auditor guarantees fraud will be detected" is always wrong.
Continue with AUD fraud risk and auditing accounting estimates.