Auditing a Client on QuickBooks Online: Reports, Controls, Audit Trail and Common Problems

Many small audit clients keep their books in QuickBooks Online (QBO). It puts few barriers in front of changes, the client controls the chart of accounts and the users, and the file has often passed through several bookkeepers with different training. That affects risk assessment, the reliability of the reports you use as evidence, and how much cleanup to expect.

This guide covers what to request, how to treat the reports as evidence, which controls to look at and the problems that come up. Report names and menu paths differ between plans and releases.

Understand the system as part of risk assessment

Under AU-C 315, as revised by SAS No. 145, the auditor obtains an understanding of the entity's information system and the IT environment relevant to financial reporting. For a client on QBO, that is usually simple, but write it down:

• QBO as the general ledger, with its plan level and who administers it
• connected apps, such as payroll, point of sale, bill pay, payment processors, expense tools and bank feeds
• who can post journal entries, edit closed periods, and change users and permissions
• which accounting tasks happen outside QBO, such as spreadsheets for fixed assets, inventory or revenue schedules
• whether an outside bookkeeper or the firm itself works in the file

See SAS 145 and risk assessment and the audit risk assessment worksheet.

Reports to request

Ask for exports, not screenshots, with a clearly stated period and basis. Use the same parameters for each request, and keep the export date. Typical requests are:

Request the aging reports as of year-end and not as of the current date. QBO reports often default to today, which makes a "year-end" aging look different from what the ledger had on the balance sheet date.

Treat the reports as information produced by the entity

A report exported from QBO is information produced by the entity. Under AU-C 500, when the auditor uses it as evidence, the auditor evaluates whether it is sufficiently reliable, including its completeness and accuracy. See audit evidence under AU-C 500 and the IPE testing worksheet.

Practical tests for QBO reports:

• Total ties. The trial balance totals tie to the draft statements, and each aging ties to the A/R or A/P control account.
• Parameters. The date range, basis (accrual or cash) and filters are as requested. A trial balance run on the cash basis for an accrual client is an example of a wrong parameter.
• Completeness. Include inactive accounts and customers in the report parameters. Deleted or merged records can hide balances.
• Consistency over time. The prior-year closing balances in the current file equal the audited prior-year balances. Differences point to changes to prior periods.
• Re-export. For important reports, ask the client to run them while the auditor is present or screen-share, or obtain read access.

Controls to evaluate

Closing date and access

QBO lets an administrator set a closing date with an optional password. Without one, anyone with the right permissions can change prior-period transactions. Determine whether a closing date is set, who holds the password, what date it is set to, and whether it was moved back during the year. The closing date exception report, where available, lists transactions entered or changed after the date. Ask about each one.

Review the user list: who has access, what role, whether former employees and outside people still have active users and whether the firm's own staff are users. Combine this with a segregation of duties review. The segregation of duties conflict matrix is a way to document it.

The audit log

QBO keeps an audit log of changes, showing the date and time, user, event and the change. The log is evidence about who changed what, and it is the nearest thing QBO has to the audit trail the auditor would want from a more sophisticated system. Use it to:

• find manual journal entries, voids and deletions near year-end
• check entries posted by users who should not post them
• look at changes to bank reconciliation, deleted reconciliation entries and edited cleared transactions
• identify changes to prior periods after financial statements were drafted
• support the journal entry testing under AU-C 240

Retention and filtering of the audit log depend on the plan and the release. Export it early. If the log does not cover the full period or cannot be filtered to the needed events, document the limitation and consider other procedures.

Bank feeds and rules

Bank feeds and rules can categorize transactions without review, such as a rule that books all deposits from a payment processor to revenue. Look at the rules, who set them up and whether anyone reviews the categorized transactions. Test that deposits equal the gross sales and that processor fees are separately recorded.

Reconciliations

Test bank and credit card reconciliations. QBO stores reconciliation reports, but it is possible to reconcile with a nominal difference and a discrepancy adjustment, and to undo reconciliations. Look at the reconciliation reports and the discrepancy account entries. See the bank reconciliation guide and template.

Reviews by management

Ask who reviews the monthly financial statements and what the reviewer looks at. For an owner-managed business, this may be the most important detective control, so document what the owner actually sees and what they do with it.

Problems to look for in QBO files

• Opening Balance Equity with a balance, because opening balances were entered when the file was started and never cleared.
• Undeposited Funds with a balance that has aged, from payments recorded and never matched to bank deposits.
• Uncategorized income, expense or asset accounts holding unclassified bank feed items.
• Journal entries in accounts payable or receivable that do not attach to a customer or vendor, making the control account differ from the subledger.
• Duplicate customers and vendors, and vendors with no 1099 information.
• Negative inventory and inventory costs that do not reflect actual purchase cost.
• Payroll liabilities that do not agree to filed returns.
• Fixed assets recorded as expense, or depreciation booked once a year by journal entry.
• Sales recorded on a cash basis though the client claims accrual.
• Retained earnings adjusted manually, or prior-year entries edited after the statements were issued.
• Loans with interest and principal posted to one account.

Most of these indicate the client needs help before the audit. See QuickBooks cleanup before the audit and the month-end close checklist.

Independence and the firm's own role

If the firm has been the outside bookkeeper in QBO, the independence rules for nonattest services under the AICPA Code apply, and the audit team should not audit its own work in a way that impairs independence. Document who performed the bookkeeping, the safeguards, management's responsibility and the skills of the person who oversees the service. For audits under Government Auditing Standards, the nonaudit services requirements are stricter. See Yellow Book (GAGAS).

Planning considerations

• Allow more time for the first-year audit of a QBO client than for a client with a more structured system, and plan for adjusting entries. See adjusting journal entries.
• Agree on how adjustments will be posted. Some clients record them in QBO, and some keep them in the auditor's trial balance.
• Include the QBO reports in the PBC list with the periods, basis and format.
• Consider whether the control environment supports a control reliance strategy. In many small QBO entities, the audit will be primarily substantive. See substantive testing versus tests of controls.

Frequently asked questions

Is QuickBooks Online acceptable for an audited entity?

Yes. The question is whether the entity's controls and records are reliable enough to support the audit. The auditor assesses the risks, tests the reports used as evidence and adjusts the procedures to what the control environment supports.

Does QuickBooks Online have an audit trail?

QBO keeps an audit log that records changes by user, with the date and time. Its retention and filtering depend on the plan and the release, so export it early and note any limits.

How do I test a report exported from QuickBooks Online?

Treat it as information produced by the entity. Tie totals to the trial balance, check the date range, basis and filters, test completeness, and for important reports observe the export or compare it with independent sources.

What should I ask for at the start of the audit?

Trial balance, general ledger detail, year-end aging reports, bank reconciliations, the audit log, the closing date settings, the user list and the connected apps. Put them in the PBC list with the periods and basis.

Can the audit firm clean up a client's QuickBooks file?

It may be possible with safeguards, but it is a nonattest service that can threaten independence. Management must take responsibility, and the firm must apply the AICPA Code's nonattest services requirements before accepting.

Sources

• AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (as revised by SAS No. 145)
• AICPA, AU-C Section 500, Audit Evidence (information produced by the entity)
• AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (journal entry testing)
• AICPA Code of Professional Conduct, ET Section 1.295, Nonattest Services
• GAO, Government Auditing Standards (2024 Revision), independence and nonaudit services: https://www.gao.gov/yellowbook

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error