CGCG Federal ServicesGovernment contract finance
← All notes

Reading deferred revenue like an auditor

Jun 2026  ·  Forensics  ·  7 min read

Deferred revenue is where close problems go to hide. It is a liability account that legitimately holds unusual balances, it moves constantly, and almost nobody reconciles it at the contract level. That combination means an error can sit in it for years without anyone being wrong enough to notice.

Start with the roll-forward, not the balance

The balance tells you nothing. The roll-forward tells you everything. Opening balance, plus what you billed, less what you recognized, equals what should be sitting there. If the account does not close to that number, the difference is not an explanation — it is the thing you are looking for.

Exhibit A — Account roll-forward, one period
 Amount
Opening balance1,200,000
Billings3,400,000
Revenue recognized(3,100,000)
Expected closing1,500,000
Actual closing per GL1,740,000
Unexplained240,000

Two hundred forty thousand dollars entered this account without being a billing or a recognition. That is the entire scope of the investigation, and it took one schedule to define it.

Four patterns worth recognizing

Once you are looking at the detail, most findings fall into a small number of shapes.

  • Reversal cycles. The same entry posted, reversed, and re-posted across periods. Occasionally a genuine correction. More often someone forcing a balance to a number they were told to hit.
  • Orphan credits. Amounts with no contract reference, no offsetting entry that makes sense, and no source document. They usually arrive as plugs during a difficult close.
  • Aged balances that never move. A residual carried year after year because the contract closed and nobody knew what to do with the remainder. Immaterial each year, substantial in aggregate.
  • Recognition ahead of performance. Revenue released on schedule dates rather than on delivery. Under ASC 606 the trigger is the transfer of control, and a calendar is not evidence of it.

Trace to the document, not to the entry

The common mistake is tracing an entry to another entry, agreeing them, and moving on. That only proves the books are internally consistent, which they usually are — that is why nobody caught it.

Trace to something outside the accounting system. The contract or modification. The invoice. The delivery record or acceptance document. If a balance cannot be tied to a document produced by someone other than the accountant who booked it, you have not verified it.

What it usually turns out to be

Worth saying plainly, because it shapes how you should run the conversation: most of these are not fraud. They are the residue of understaffed closes, turnover in the accounting function, a system conversion where balances came across without their detail, or a well-meaning controller who booked an estimate intending to fix it later and then left.

Opening with an accusation gets you a defensive finance team and a slower investigation. Opening with help me tie this out usually gets you the answer in a week, because someone in the building already suspects where it came from.

Write it for the next reader

Whatever you find, the memo is the deliverable. It should state what the balance is, what it should have been, what the difference consists of, which standard governs the treatment, and what correcting it does to the prior period. If a restatement is in play, ASC 250 sets the disclosure path, and that determination belongs in the memo rather than in a conversation.

Write it so an auditor who has never met you can follow it without asking a question. That is the standard, and it is also the fastest way to end the matter.

Account that won't tie out? Get in touch →

Forensic and finance review

When deferred revenue or other balances stop reconciling, the fastest path is usually a disciplined trace from contract terms through the ledger and supporting entries.

Explore the related service →