How to audit revenue in Statutory Audit?

Ask any experienced auditor which line item keeps them up at night, and most will say the same thing: revenue.

It's not that revenue is hard to record. It's that revenue is the easiest number to push around, and the first place management looks when profits fall short of the target. If you're doing statutory audit work in India, auditing revenue properly isn't just another checklist item. It's the one area where a small shortcut today can turn into a big professional headache tomorrow. 

This blog walks through how to audit revenue in a statutory audit, step by step, in plain language, the way you'd explain it to an articled assistant on their first revenue audit.

Why Revenue Recognition Is a Red-Flag Area for Every Auditor

Revenue sits right at the top of the profit and loss account. It affects profit, tax outflow, bank covenants, and how investors and lenders see the company. Under SA 240, revenue recognition is presumed to carry a risk of fraud unless you have good reason to think otherwise.

Add to that the fact that revenue recognition rules themselves (AS 9, or Ind AS 115 for companies under Ind AS) involve judgement; timing of transfer of control, multiple deliverables in one contract, discounts, and returns. Judgement plus pressure to show good numbers is exactly where things go wrong.

Step 1: Planning — Get the Business Model Right First

Before you touch a single invoice, understand how the company actually earns money. A manufacturing unit recognises revenue on dispatch or delivery. A software company selling annual subscriptions has to spread revenue over the contract period. A real estate firm may recognise revenue over time as construction progresses. 

During planning, do a proper walkthrough of the sales cycle — order, dispatch, invoicing, collection — and identify where the real risk sits. Ask yourself:

• Does the company have unusual contract terms, like bill-and-hold sales or sale-or-return arrangements?
• Are there related party sales that could be used to inflate turnover near year-end?
• Is there pressure on management to hit a revenue number this year (loan covenant, IPO, promoter guarantee)?

A textile trader and a SaaS company both sell something, but the risk in their revenue numbers is completely different. Planning is where you decide where to spend your time.

Step 2: Testing of Controls Over Revenue

Once you know the sales cycle, check whether the controls around it actually work. Look at:

• Segregation of duties between the person booking sales and the person approving credit or discounts
• System-generated, sequentially numbered invoices (so nobody can quietly delete or backdate one)
• Approval matrix for credit limits and special pricing

Pick a sample of transactions and trace them end to end: sales order, dispatch document, e-way bill, invoice, and entry in the ledger. If controls are strong and you plan to rely on them, this reduces the substantive work later. If they're weak, or the company runs mostly on manual overrides, you'll need to lean much harder on substantive testing.

Step 3: Substantive Testing — Where the Real Digging Happens

This is the heart of a revenue audit. Some things every CA should be doing here:

• Vouching: Pick a sample of invoices and match them against the purchase order, delivery challan, e-way bill, and lorry receipt. Does the paperwork actually support a real sale?
• Cut-off testing: This is where most misstatements hide. Check the last few dispatches before year-end and the first few after. Was a sale dispatched on 2nd April but booked on 31st March to inflate the current year's number? This single test catches more issues than any other.
• Debtors' confirmation: Send balance confirmations to major customers, especially where the amount outstanding looks unusually high for the credit period allowed.
• Sales returns and credit notes: A spike in credit notes issued in April and May, against sales booked in March, is a classic sign of revenue being pulled forward.
• Journal entry testing: Look for large or unusual revenue entries passed directly through journal vouchers, especially near month-end or year-end, bypassing the normal sales cycle.
  

  From Checking Numbers to Thinking Like an Auditor

  A good statutory auditor doesn't just tick working papers — they know what to question, where to look, and how to connect the evidence to the conclusion. If you're ready to build that practical audit mindset, take your learning a step further with the Master Blaster of Statutory Audit course and learn statutory audit the way it works in the real world.
  Step 4: Analytical Procedures — Let the Numbers Talk

  Before or alongside detailed testing, run some simple analytics:

• Plot monthly revenue for the year — does March look abnormally large compared to the other eleven months?
• Compare gross margin percentage with the previous year and with similar companies in the same industry
• Reconcile revenue as per books with GSTR-1/GSTR-3B filings and Form 26AS or AIS

If the books show ₹50 crore in sales but GST returns reflect ₹42 crore, that gap needs an explanation not an assumption.

Step 5: Communicating with Management

Revenue audit isn't something you do in a silo. Discuss what you're finding as you go; unusual contracts, cut-off issues, gaps between GST and books. Ask management to explain, and document their response.

Get it in writing too. Management representation on completeness of revenue and disclosure of all contracts is not a formality; it's your record that you asked the right questions. If you find something significant — a control weakness, a pattern of late bookings this needs to be communicated to those charged with governance under SA 265, not just noted quietly in your working papers.

Step 6: Finalising the Audit

Once testing is done, step back and conclude on each assertion: occurrence, completeness, accuracy, cut-off, and classification. Document your conclusion clearly enough that another auditor reading the file a year later understands why you were comfortable (or not comfortable) with the revenue number. Link your work to CARO and Schedule III disclosure requirements, and decide whether anything needs to be reported or whether the opinion needs modification.

A Real Story Every Indian Auditor Remembers

If you want to understand why revenue audit deserves this much attention, look no further than the Satyam Computer Services case — still India's most talked-about accounting fraud. The company's own founder later admitted that sales figures had been inflated for years using fictitious invoices and fabricated debtor balances, backed by forged bank statements showing money that was never actually received. Thousands of fake invoices were used to build up receivables that simply didn't exist, and the overstatement of revenue ran into thousands of crores over several years.