BlogOctober 3, 202612 min read

How to audit revenue recognition: what auditors test and how to be ready

How auditors test revenue recognition under ASC 606, the evidence they ask for, and how to have every contract, schedule, and entry ready.

By Zuny Fester, Head of Operations and Marketing

Reviewed by Zuny Fester

Published October 3, 2026Editorial policy

Part of the revenue recognition guide.

How to audit revenue recognition: what auditors test and how to be ready

To audit revenue recognition, an auditor tests whether each ASC 606 judgment is supported and whether each revenue entry traces back to a real contract, delivered on time, at the right amount. In practice, that means walkthroughs of the revenue process, tests of controls, contract-level sampling across all five steps, cutoff testing, a deferred revenue rollforward, confirmations, and journal entry testing. Auditing standards presume a fraud risk in revenue, so revenue gets more audit attention than almost any other line.

For a controller, the useful version of that question is "how do I audit revenue recognition before the auditors do?" This guide explains what auditors test, the evidence they ask for at each ASC 606 step, and how to have every contract, schedule, and entry ready before fieldwork starts.

Key takeaways

• Auditors must presume a fraud risk in revenue recognition. PCAOB AS 2110.68 sets this for public-company audits, and AU-C 240.26 sets it for private-company audits.

• Revenue testing follows the five ASC 606 steps, so the most efficient evidence file is organized the same way: contract, performance obligations, transaction price, allocation, and recognition.

• The deferred revenue rollforward is the anchor analytic: beginning balance plus billings minus revenue recognized must equal the ending balance, with every reconciling item explained.

• Journal entry testing targets manual, late, round-number, and unusual revenue entries, so every manual revenue entry needs a preparer, an approver, and support.

• An audit trail created as the work happens beats one assembled at year-end. Reproducible schedules and logged approvals shrink both sample sizes and follow-up requests.

• Loopfour, the deterministic finance workflow automation platform, records every revenue workflow run in an execution tree (inputs, rule applied, output, and named approver), so the evidence exists before the auditor asks.

Why is revenue recognition the riskiest area of an audit?

Revenue is the riskiest area because auditing standards presume it carries a fraud risk, and because ASC 606 relies on judgment. Under PCAOB AS 2110.68, "the auditor should presume that there is a fraud risk involving improper revenue recognition." AU-C 240.26 contains the equivalent presumption for audits under AICPA standards. The presumption can be rebutted only with documented reasoning, which is rare for companies with complex contracts.

ASC 606 adds judgment at every step: whether a contract exists, which promises are distinct, how to estimate variable consideration, what the standalone selling price is, and when control transfers. If you need a refresher on the model, see what ASC 606 is and how the five steps work. Each judgment is an assertion your auditor must test, and each one is only as strong as its documentation.

Auditors worry about two kinds of error. Fraud risks include side agreements, channel stuffing, and backdated contracts. Error risks include wrong start dates, missed modifications, discounts that never reached the ERP, and schedules built from stale data. The second kind is far more common in growing SaaS companies, and it is almost always a data-flow problem.

What do auditors test in revenue recognition?

Auditors test the design and operation of revenue controls, then perform substantive tests on contracts, balances, and entries. The mix depends on whether the audit relies on controls. Accelerated and large accelerated filers receive integrated audits under PCAOB AS 2201, which include an opinion on internal control. Private-company auditors often go mostly substantive.

Procedure	What the auditor does	What you should have ready
Walkthrough	Follows one transaction from signed contract to cash	Process narrative, system map, control list with owners
Tests of controls	Samples control instances such as contract review, SSP approval, and schedule review	Dated approvals with named reviewers for every instance
Contract sampling	Re-performs the five steps for selected contracts	Signed contract, amendments, ASC 606 memo, schedule
Cutoff testing	Checks that revenue near period-end is in the right period	Delivery or activation evidence, invoices, usage logs
Deferred revenue rollforward	Reconciles opening balance, billings, recognition, and closing balance	Rollforward tied to the general ledger and billing system
Confirmations	Confirms receivables and sometimes contract terms with customers	Customer contacts, open-item detail, reconciled AR aging
Journal entry testing	Selects manual and unusual entries to revenue and deferred revenue	Support, preparer, and approver for every manual entry
Analytics	Compares revenue to expectations by product, customer, and month	Explanations for material fluctuations
Disclosure testing	Ties disaggregation, contract balances, and remaining performance obligations to support	Disclosure workpapers traced to the ledger

Confirmation requirements tightened for public-company audits. The PCAOB's updated AS 2310 took effect for audits of fiscal years ending on or after June 15, 2025, and it carries forward the requirement to confirm accounts receivable, with limited alternatives when confirmation is not feasible.

Journal entry testing

Auditors select journal entries using fraud-risk characteristics, and revenue entries are the first place they look. PCAOB AS 2401 directs auditors to consider entries made to unrelated or unusual accounts, entries made by people who do not usually make them, entries at period-end or post-closing, entries with round numbers, and entries with little or no description.

Every manual revenue entry is a potential selection. A recognition entry posted by hand on day three of close, with a round amount and the memo "true-up," will be pulled every time. If the same entry is generated by a documented rule, with the schedule and approval attached, it tests quickly.

The revenue audit evidence checklist, mapped to ASC 606

Organize your evidence by ASC 606 step, because that is how the auditor will re-perform each sampled contract. For each sampled contract, the auditor should be able to open one folder and follow the logic from signature to journal entry.

Step 1: identify the contract

• Signed contract and every amendment, with signature dates, from DocuSign, PandaDoc, or your contract repository.

• Evidence of approval by both parties and of the authority of the signers.

• Collectibility assessment for new customers, including credit review or payment history.

• Contract combination analysis for contracts signed close together with the same customer.

• Modification log showing each change to scope or price and how it was accounted for.

Step 2: identify the performance obligations

• ASC 606 memo documenting which promises are distinct and why.

• Product-to-obligation mapping from your price book or SKU list to performance obligations and recognition rules.

• Evidence for material rights, such as renewal options priced below standalone selling price.

Step 3: determine the transaction price

• Fixed consideration tied to the contract and the invoice.

• Variable consideration estimates, method, inputs, and constraint assessment, dated and approved. See how the constraint works in our guide to variable consideration.

• Financing component analysis where payment terms exceed one year.

• Consideration payable to the customer, such as credits or referral payments.

Step 4: allocate the transaction price

• Standalone selling price study, with the data, method, and approval date.

• Allocation calculation for each sampled multi-obligation contract.

• Discount allocation support when a discount is allocated to fewer than all obligations.

Step 5: recognize revenue

• Revenue schedule for each obligation, reproducible from contract inputs.

• Evidence of transfer of control: provisioning or activation dates, delivery confirmations, usage logs, or project progress measures.

• Cutoff support for transactions within a few days of period-end.

• Deferred revenue waterfall and rollforward tied to the general ledger. Our template for a deferred revenue waterfall schedule is a good starting point.

Controls and system evidence

• Control matrix for the revenue cycle, with owners and frequencies.

• IT general controls over billing, CRM, and ERP systems, including access and change management.

• Completeness and accuracy evidence for reports used in the audit, such as the contract listing or usage report, often called information produced by the entity (IPE).

How to run the deferred revenue rollforward

The deferred revenue rollforward proves that every movement in the contract liability is explained. Beginning balance plus billings, minus revenue recognized, plus or minus adjustments, equals the ending balance. Auditors use it to test completeness and to select samples.

Rollforward line	Amount	Source
Deferred revenue, beginning of year	$1,200,000	Prior-year audited balance
Plus: billings in advance of performance	$2,900,000	Billing system, tied to AR
Less: revenue recognized from deferred revenue	($2,750,000)	Revenue schedules, tied to the general ledger
Less: credit memos and cancellations	($50,000)	Credit memo register, with approvals
Deferred revenue, end of year	$1,300,000	General ledger balance

The check is simple: $1,200,000 + $2,900,000 − $2,750,000 − $50,000 = $1,300,000. If the calculated balance and the general ledger disagree, the difference is an unexplained reconciling item, and the auditor will expand testing until it is explained.

How to be ready before fieldwork

Readiness means your team can answer any sample request from a single source within a day, with no reconstruction. Most audit delays come from evidence that exists but is scattered across email, shared drives, and people's memories.

→ Freeze the population. Produce the full contract and revenue listing for the period, reconciled to the general ledger, before the auditor asks.

→ Refresh the judgments. Update the SSP study, variable consideration estimates, and ASC 606 memos, each with a dated approval.

→ Tie out the balances. Reconcile deferred revenue, contract assets, and receivables to the ledger and the billing system.

→ Clean the manual entries. List every manual revenue entry, confirm each has support and an approver, and fix any that don't.

→ Lock the period. Close the period in the ERP so no backdated edit can change audited numbers.

Book a workflow review to see which of these steps your team still assembles by hand.

How to choose tooling that holds up in a revenue audit

Choose tooling whose output your auditor can re-perform: same inputs, same result, with every approval attached. That is a higher bar than "the numbers look right," and it is the bar auditors actually apply.

Spreadsheets fail on reproducibility and access control. A horizontal automation platform moves data well and is flexible, but its logs rarely show which rule produced which number or who approved the exception. An unmanaged AI agent is harder still: if it decides what to do at runtime, the auditor cannot re-perform its reasoning. Our view on audit trails for automated finance goes deeper on what inspectors look for.

An AI agent decides what to do at runtime. Loopfour does only what was approved. AI is used for one scoped task: the Contract Agent reads contract terms under a confidence threshold, and fields below it go to a named reviewer in Slack. Every step after that is programmatic (schedule, entry, reconciliation), and every run is recorded in an execution tree with inputs, outputs, and approvers. Loopfour is SOC 2 Type II certified and SOC 1 Type I certified, which matters when your auditor asks about the controls in systems that touch revenue.

Frequently asked questions

How do auditors test revenue recognition? Auditors walk through the revenue process, test key controls, and then perform substantive procedures. Those include re-performing the five ASC 606 steps for sampled contracts, cutoff testing, a deferred revenue rollforward, confirmations of receivables, analytical procedures, and testing manual and unusual journal entries.

Why is revenue a presumed fraud risk? Auditing standards require auditors to presume a fraud risk in revenue recognition because revenue is a common target for manipulation. PCAOB AS 2110.68 sets the presumption for public-company audits and AU-C 240.26 for audits under AICPA standards. The auditor must evaluate which revenue types and assertions carry that risk.

What documents do auditors request for revenue recognition? Auditors typically request signed contracts and amendments, ASC 606 memos, standalone selling price support, variable consideration estimates, revenue schedules, evidence of delivery or activation, invoices, a deferred revenue rollforward, and support for manual journal entries. They also request evidence that reports used in the audit are complete and accurate.

What is a deferred revenue rollforward? A deferred revenue rollforward reconciles the opening contract liability to the closing balance: beginning balance plus billings in advance, minus revenue recognized, plus or minus adjustments such as credit memos. Every reconciling item must be supported, and the ending balance must agree to the general ledger.

Can automated revenue recognition pass an audit? Yes, when the automation is deterministic and fully logged. Auditors need to re-perform the logic, see the inputs, and confirm who approved each exception. Automation that produces the same output from the same inputs, with an execution record for every run, is easier to audit than manual spreadsheets.

Conclusion

Learning how to audit revenue recognition is mostly learning how your auditor thinks: five steps, a presumed fraud risk, and a demand for evidence that re-performs. Organize your file by ASC 606 step, reconcile deferred revenue every close, and make every manual entry defensible or unnecessary. The best audit trail is not assembled in January. It is produced as the work runs.

Tell us the one workflow your team dreads. We will show it running: deterministic, permissioned, and auditable.

Book a demo.