SA 240 requires the auditor to test journal entries for management-override risk. CORAA runs the full JE population through a Benford's-Law leading-digit profile and an entry-level characteristics battery — round amounts, period-end and weekend postings, unbalanced entries, bank movements routed through journal vouchers, seldom-used account pairings, reversals and duplicates. Year-End and Post-Close views focus the riskiest windows, and every flag carries its reason and drills to the voucher.
Two paths to the same audit conclusion. One leaves traces; the other doesn't.
The full journal population's leading-digit distribution is profiled against Benford's expected curve. Digits that deviate materially are highlighted, with the contributing entries one click away — a population-level screen no sample can give you.
Each entry is screened for the classic override characteristics — round amounts, period-end and weekend posting, unbalanced entries, bank movements routed through journal vouchers, seldom-used account pairings, reversals and duplicates. Each flag carries its SA 240 rationale.
One-click views isolate the entries posted around year-end and after close — the windows where override risk concentrates. The auditor works the flagged list, dismisses with rationale, and the working paper records everything.
Tally and SAP both distinguish user-created journals from system-posted ones (system journals are typically depreciation, accrual reversals, etc.). CORAA reads the entry's origin and filters the journal universe accordingly.
Rules anchored to common earnings-management patterns: revenue-recognition shortcuts, expense deferrals, late-period reclassifications, entries against seldom-used accounts. Each rule has an SA 240 paragraph reference.
The leading-digit profile runs across every journal entry, not a sample. Deviating digits expand to the entries behind them, each drilling to its voucher — a screen for the auditor's judgment, never a conclusion.
The SA 240 Working Paper documents the procedure performed: which window was tested, which rules were applied, which entries were flagged, which were dismissed with auditor rationale.
