AU-C 540: Auditing Accounting Estimates and Disclosures

AU-C 540 is the AICPA auditing standard that governs how auditors evaluate accounting estimates and related disclosures in a financial statement audit. Under the version rewritten by SAS No. 143 and effective for periods ending on or after December 15, 2023, auditing accounting estimates under AU-C 540 requires you to assess inherent risk and control risk separately for each estimate, place inherent risk on a continuous spectrum driven by four specific factors, and then design substantive procedures that match where the estimate lands.¹ The old high-or-low bucketing is gone. So is the option to treat estimates as a general category with a general approach.

What Counts as an Accounting Estimate

An accounting estimate is any monetary amount in the financial statements where precise measurement isn’t possible. The category is broad: the allowance for doubtful accounts, useful lives assigned to fixed assets, warranty obligations, legal contingencies, pension liabilities, and fair value measurements for financial instruments all qualify. What unites them is that the final figure depends on assumptions about future events or conditions that haven’t yet resolved.

Estimation uncertainty describes how imprecise a given estimate’s measurement inherently is. An inventory obsolescence reserve based on clear historical patterns has relatively low estimation uncertainty. A Level 3 fair value measurement built from unobservable inputs has far more. The degree of uncertainty directly drives how much audit attention the estimate needs.

The standard also covers estimates that depend on complex models, such as derivative valuations and actuarial calculations, where the methodology itself introduces risk. When management picks a discount rate for a long-term liability or selects an expected loss model for a loan portfolio, those choices carry real consequences for the financial statements, and your job is to evaluate whether the choices are reasonable and adequately supported.

The Spectrum of Inherent Risk

This is the conceptual core of the revised standard. Rather than treating inherent risk as a binary judgment, AU-C 540 requires you to assess where each estimate falls along a continuous spectrum. That placement depends on the degree to which the inherent risk factors affect the likelihood or magnitude of misstatement.¹

The standard identifies four primary inherent risk factors:

Estimation uncertainty: The range of possible outcomes and the imprecision in measuring the final amount. Estimates tied to volatile commodity prices or illiquid markets sit higher on this factor.
Complexity: How intricate the model, data, and processes are. An estimate requiring specialized actuarial knowledge or multi-layered financial modeling carries more complexity risk than a straight-line depreciation calculation.
Subjectivity: The extent of management judgment involved in selecting methods, assumptions, and data. Estimates where reasonable professionals could arrive at meaningfully different numbers involve high subjectivity.
Susceptibility to management bias: Whether the nature of the estimate creates an opportunity for management to steer the result toward a preferred outcome. An estimate that consistently lands at the optimistic end of a reasonable range is a classic indicator.

Other inherent risk factors may also be relevant, including whether changes in business circumstances or in the financial reporting framework itself have created a need to revise the method, assumptions, or data used for a particular estimate. These factors don’t carry equal weight for every estimate. A simple estimate may be affected only to a minor degree, placing it at the lower end of the spectrum and requiring fewer risks to be identified and less extensive procedures. A complex estimate with high uncertainty, heavy management judgment, and room for bias lands at the upper end and likely triggers classification as a significant risk.¹

One rule matters here more than any other. Inherent risk and control risk must be assessed separately for each estimate. You cannot lean on strong controls to offset high inherent risk during the assessment phase. Each gets its own evaluation, and the combined assessment drives the audit response.¹

Understanding Management’s Estimation Process

Before you test anything, you need to understand how management actually builds its estimates. That understanding covers the full chain: what data management uses, how that data feeds into a calculation or model, what assumptions management applies, and how the final figure gets reviewed and approved.

Source data comes first. If management calculates an allowance for doubtful accounts using historical loss rates, evaluate whether those loss rates are drawn from reliable, complete, and relevant data. Weakness in the underlying data immediately raises the inherent risk of the estimate, because even a sound model produces unreliable results when fed bad inputs.

Next comes the method or model. Check whether the methodology aligns with the applicable financial reporting framework and whether the math works. For a fair value estimate, that means confirming the valuation model incorporates required risk adjustments. For a simpler estimate, it might just mean verifying the calculation logic in a spreadsheet.

Assumptions are typically the most subjective piece. They represent management’s judgment about conditions that don’t yet exist, such as future growth rates, default probabilities, or discount rates. Compare these assumptions against external benchmarks like industry data, economic forecasts, and regulatory developments. An assumption that diverges significantly from observable market conditions needs a convincing explanation.

Evaluate the internal controls around the process too: controls over input data, over the model itself, and over who authorizes the final number. A situation where one person selects assumptions, runs the model, and approves the output without independent review is a control deficiency that shapes the audit approach.

Substantive Procedures for Testing the Estimate

Once the risk assessment is complete, you select from three substantive approaches. They can be used individually or in combination, and the choice is driven by where the estimate sits on the inherent risk spectrum and how effective the relevant controls are.

Testing Management’s Methods, Data, and Assumptions

The most common approach is to test the methods, data, and assumptions management used. Work through each layer: verify that the source data is complete, accurate, and relevant; confirm the model’s mathematical integrity and its alignment with the reporting framework; and evaluate whether the assumptions are reasonable given available evidence.

Assumption testing is where most of the judgment lives. If management projects a 5% revenue growth rate in a cash flow projection, check that number against industry data, the company’s own recent trends, and broader economic conditions. Perform sensitivity analysis on key assumptions and test how much the estimate would change if those assumptions shifted within a reasonable range. A highly sensitive estimate signals greater estimation uncertainty and may demand additional procedures.

Developing an Independent Point Estimate or Range

The second approach has you develop your own point estimate or range of reasonable amounts for comparison against management’s figure. This is often the most persuasive response to a significant risk because it produces direct, independent evidence rather than relying on management’s own work product.

You may use your own data, alternative assumptions, or an entirely different model. In practice, this frequently involves engaging a specialist. When management’s estimate falls outside your independently developed range, investigate the specific drivers of the difference and determine whether management’s position is still defensible.

Reviewing Subsequent Events

The third approach uses events occurring between the balance sheet date and the date of your report as evidence about the estimate’s reasonableness. When the right facts emerge, this can be the most persuasive evidence available. A litigation settlement reached before the report date provides direct evidence about the recorded contingent liability. Inventory sold after year-end at a price below carrying value confirms whether the net realizable value estimate was appropriate.

The limitation: only events relating to conditions that existed at the balance sheet date qualify as corroborating evidence. A completely unforeseen event arising after year-end doesn’t speak to the original estimate.

When You Need a Specialist

Complex estimates frequently require expertise the audit team doesn’t possess, whether actuarial science, property appraisal, or structured finance modeling. AU-C 540 works in tandem with AU-C 620 in these situations. You must evaluate the specialist’s competence, capabilities, and objectivity before relying on their work. Prior experience with a particular firm is relevant, but familiarity with the organization doesn’t extend automatically to a specific individual you haven’t worked with before.

Even when a specialist performs the underlying work, you retain full responsibility for the conclusions about the estimate. The specialist’s report is audit evidence, not a substitute for your judgment. Evaluate the specialist’s methods, assumptions, and data with the same rigor you apply to management’s own process.

Evaluating Results, Bias, and Disclosures

After completing the substantive procedures, step back and evaluate whether the estimate, individually or combined with other misstatements, causes the financial statements to be materially misstated. If you developed a range and management’s estimate falls within it, that’s generally acceptable. If it falls outside, the difference is a misstatement and gets evaluated against materiality. Even when the estimate technically falls within range, consider whether it lands at the boundary most favorable to management’s reporting objectives.

The standard requires a deliberate assessment of management bias indicators, and the test is at the population level rather than the individual estimate level. Are assumptions consistently pushed in a direction that benefits reported earnings? Have methods or data inputs changed in ways that conveniently produce better numbers without a clear business reason? Have prior-period estimates consistently required adjustment in the same direction when actual results came in? One optimistic estimate might be defensible. A pattern of them is a different story.

Disclosure evaluation is a substantive requirement, not an afterthought. The financial statement disclosures must adequately describe the estimation uncertainty associated with each significant estimate: what the estimate is, what key assumptions drive it, and how sensitive it is to changes in those assumptions. When estimation uncertainty is high, the disclosures should make clear that the recorded amount could differ materially from what actually happens. A vague statement that “estimates involve judgment” doesn’t meet the standard. If the disclosures fail to communicate the degree of uncertainty around a significant estimate, the financial statements may be materially misleading regardless of whether the point estimate itself is reasonable.

Documentation and Scalability

The audit documentation for estimates must tell the complete story: the risk assessment, the reasons for it, the nature and extent of procedures performed, the results obtained, and your conclusions about the estimate’s reasonableness. For significant risks, the documentation bar is higher because peer reviewers and regulators will scrutinize whether the audit response matched the assessed risk level. The file also needs to capture your evaluation of management bias indicators, the basis for concluding whether disclosures are adequate, and, where a specialist was used, the evaluation of that specialist’s competence, capabilities, objectivity, and work.

Not every estimate demands the full apparatus. The standard explicitly recognizes that inherent risk factors may affect simpler estimates only to a lesser degree, allowing you to identify fewer risks and assess inherent risk at the lower end of the spectrum.¹ Straight-line depreciation on a standard asset with a well-established useful life doesn’t need sensitivity analysis, specialist involvement, or an independent point estimate. The risk assessment should reflect that reality, and the procedures should scale accordingly. The spectrum approach is designed to prevent both under-auditing complex estimates and over-auditing routine ones. Your challenge is making that calibration honestly, without defaulting to a minimum effort level for estimates that deserve more attention.

1
AICPA. Statement on Auditing Standards 143 Auditing Accounting Estimates and Related Disclosures