Journal entry testing (JET) is the audit procedure of examining entries in the general ledger and period-end adjustments for signs that management has overridden controls to misstate the accounts. The standard requires it on every audit. The steps are: get a complete population, prove it is complete, filter by risk characteristics, test the selected entries, and conclude. AI can speed up filtering and ranking, but the auditor still chooses the criteria and judges the result.
Last reviewed: 17 October 2026. Facts checked. We searched for how SA 240 treats management override and journal entries; results quoted paragraphs 31 and 32 of SA 240 via ICAI chapter newsletters, which we did not open. We opened ICAEW's guidance on management override (it covers ISA (UK) 240, which is close to but not the same as ICAI's SA 240), for the red flags and selection factors below. We did not open the text of SA 240 itself, so check paragraph wording against the current standard.
Why the standard asks for it
Management is in a position to override controls that would otherwise stop fraud, for example by posting entries directly. Because that can happen in any entity and is hard to predict, SA 240 treats the risk of management override as present in all entities and as a significant risk, per the paragraphs quoted in the sources we found. The auditor must test the appropriateness of journal entries and other adjustments, whatever the assessed risk. A related requirement covers review of accounting estimates for bias.
Our post on journal entry testing automation covers tooling. This post focuses on the procedure and the red flags.
The procedure, step by step
Step 1: Understand the process
Learn how entries are initiated, approved and posted. Ask who can post, who can post without approval, and which entries come from outside the ledger, such as consolidation or manual top-side entries. ICAEW notes the auditor should ask people in the reporting process about unusual journal activity.
Step 2: Get the full population
Ask for every entry for the period, not a summary. Fields you need: entry number, posting date, entry date, user, account, debit and credit, narration, and source or type (manual or system).
Step 3: Prove completeness
Reconcile the total of debits and credits to the trial balance, and the opening and closing balances to the ledger. If the extract does not tie, stop. Testing an incomplete population gives false comfort.
Step 4: Set criteria
Choose filters based on fraud risk factors, the effectiveness of journal controls, the nature of accounts and any non-standard journals, as ICAEW describes. Always include period-end entries, and consider entries throughout the year.
Step 5: Select and test
Test selected entries to supporting evidence: approval, source document, business reason, correct period and account. Record why each entry was selected.
Step 6: Follow up and conclude
Chase exceptions to resolution. Consider whether patterns point to wider issues. Document what you did, what you found, and your conclusion.
Red flags
ICAEW lists these warning signs, and we add typical filters.
| Red flag | Example filter |
|---|---|
| Unusual, rarely used or unrelated accounts | Accounts with few postings in the year |
| Entries with no account number | Blank or placeholder account |
| Posted by someone who does not normally post | User not in the usual poster list |
| Late or post-closing entries with little explanation | Posted after period end, blank narration |
| Round or consistently ending amounts | Amounts ending in 000 |
Other filters auditors commonly use, which are our suggestions rather than quotes from the standard:
- Weekend or holiday postings
- Entries just below an approval limit
- Duplicate amounts on the same date
- Entries reversing soon after posting
- Debits to revenue or credits to expense
- Manual entries to automated accounts
Where AI helps
| Step | Where AI or analytics helps | What stays human |
|---|---|---|
| Completeness | Automated reconciliation of extracts | Deciding what to do if it fails |
| Criteria | Suggesting filters from past patterns | Choosing the criteria and why |
| Ranking | Scoring entries on several flags at once | Setting weights, reviewing the top list |
| Narrations | Reading free text for odd wording | Judging whether the explanation is credible |
| Pattern spotting | Clustering and outlier detection | Interpreting the cause |
| Documentation | Drafting the working paper | Review and sign-off |
Our journal entry risk scorer and Benford's law checker are free ways to try scoring and digit tests, and the journal entry testing working paper gives a documentation layout. Digit tests suit large populations and can mislead on small or capped data; see Benford subset divergence.
Limits
- A flag is a prompt for questions, not proof of fraud.
- A model that scores differently each run is hard to defend. Fixed, documented rules are easier to reperform. CORAA follows that approach, explained in why CORAA uses deterministic AI.
- If the data extract is wrong, the best tool gives the wrong answer.
- Entries made outside the ledger, such as consolidation adjustments, may need separate procedures.
Documentation checklist
- Source of the population and how it was obtained
- Completeness reconciliation
- Criteria and the reason for each
- Entries selected and tested
- Exceptions and resolution
- Conclusion
Frequently Asked Questions
What is journal entry testing?
An audit procedure that examines ledger entries and adjustments for signs of management override or misstatement. It is required on audits under SA 240.
Is journal entry testing mandatory?
According to the SA 240 paragraphs quoted in the sources we read, the auditor must design procedures to test journal entries whatever the assessed risk. Confirm against the current standard.
Can we test every entry instead of a sample?
With tools, yes, for filtering. You still need to examine the ones that matter and document why.
What are the main red flags?
Unusual accounts, missing account numbers, unusual posters, late entries with little explanation, and round amounts.
Can AI do journal entry testing alone?
No. It can filter and rank. The auditor sets criteria, investigates and concludes.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error