Journal entry testing responds to the risk that management overrides controls by posting entries that look normal and are not. The test has two weak points that reviewers look for first. One is a population that is incomplete, because the test cannot find what was never in the list. The other is selection criteria that do not reflect the risks of the client. This post covers both. The standard guidance is in journal entry testing under AU-C 240, and the wider fraud context is in management override of controls and AU-C 240.
What the test is for
The auditor designs and performs procedures to test the appropriateness of journal entries and other adjustments, to review accounting estimates for bias, and to evaluate the business rationale of significant unusual transactions. These are required responses to the risk of management override, which the auditor treats as present in every audit. Journal entry testing sits at the center. See fraud risk assessment.
Before selecting anything, inquire of people involved in the financial reporting process about inappropriate or unusual activity relating to journal entries and other adjustments.
Step 1: Obtain the population
Request the full general ledger journal detail for the period, from the system and directly, not as a summary the client prepared. Include:
- Entry number, date posted and effective date.
- Preparer user ID, approver if any.
- Account, debit, credit, amount.
- Description and source (manual, subledger, system generated, recurring).
- Posting time.
Include entries posted in a closed period, after year end and during the audit period of adjustments (13th period entries).
Step 2: Prove completeness
A population is complete only when it ties to the trial balance. Tests:
- Total debits equal total credits for the period.
- Opening balance plus activity equals closing balance for every account on the trial balance. A table of accounts with the roll gives the proof.
- Account-level tie. For a sample of accounts, total journal activity agrees to the movement per the trial balance.
- Subledger-to-ledger. For subledger-driven accounts (receivables, payables, inventory, payroll), confirm the subledger totals agree to the ledger postings.
- Sequence check. Entry numbers are sequential, with gaps explained.
- Source system test. Confirm the extract included all sources and modules, including entries from the consolidation and top-side adjustments, and entries made outside the main system (spreadsheet journals).
- Compare to prior-year entry counts and to the entries per month. A month with unusually few entries needs an explanation.
Document who pulled the data, when, with what filters, and the completeness tests. If the client's IT department extracts the data, observe or obtain the query. Entries removed by the extract are the greatest risk.
Step 3: Define the selection criteria
Choose criteria from the risks of this client. A standard list, tailored:
| Criterion | Why it matters |
|---|---|
| Entries posted by senior management or by people who do not normally post | Override |
| Manual entries to revenue, receivables, inventory, reserves | Estimates and cutoff |
| Entries with round amounts, or amounts just below approval limits | Concealment |
| Entries posted on weekends, holidays or at unusual hours | Unusual activity |
| Entries posted after period end, especially in the last days before the report | Late adjustments |
| Entries to seldom-used accounts or to suspense and clearing accounts | Concealment |
| Entries with no description or with vague descriptions | Poor documentation |
| Entries that debit revenue-related accounts and credit cash, or the reverse | Revenue manipulation |
| Entries that affect covenant, bonus or other metrics | Motive |
| Entries involving related parties or owner accounts | Related party risk |
| Entries by users with no approver | Control failure |
| Consolidation and top-side entries | Override |
| Entries reversing next period | Window dressing |
| Entries to accounts with unusual combinations (for instance, debits to expense and credits to fixed assets) | Misclassification |
The criteria vary by client, and so does the number of hits. Tune thresholds so the result is manageable. A rule that selects 12,000 entries is a population, not a selection.
Step 4: Run the criteria and select
Apply the criteria to the full population using spreadsheet or analytics software. Count hits by criterion. Select items:
- Every entry above a high dollar threshold that meets a risk criterion.
- A sample of the remainder per criterion, in proportion to hits.
- Entries from each quarter, including the fourth quarter and the period after year end.
- Entries identified by other procedures, such as unusual entries noticed during testing.
Record the selection with the criterion that picked each item.
Step 5: Test the selected entries
For each entry, inspect the support: the source document, the calculation, the approval and the business reason. Test:
- Was the entry authorized by someone with authority?
- Does the support exist and agree to the amount?
- Is the accounting correct?
- Is the business rationale clear?
- Did the entry reverse, and was the reversal right?
Interview the preparer or approver for entries lacking support, and obtain corroboration.
Worked example
A client with 38,000 journal entries for the year. The extract passed completeness: debits equal credits, 214 accounts roll to the trial balance. Criteria hits:
| Criterion | Hits |
|---|---|
| Manual entries by the CFO | 41 |
| Manual entries to revenue accounts | 63 |
| Round-thousand entries over $50,000 | 28 |
| Posted on weekends or holidays | 104 |
| Posted after year end to the current period | 57 |
| No description | 19 |
| Related party and owner accounts | 22 |
The auditor selects all 41 CFO entries, all 19 with no description, all 22 related party entries, and a sample of 15 from revenue, 10 from round-thousand, 15 from post-year-end and 10 from weekends. Total 132 entries tested. Findings:
- 3 of the 19 entries without description were reclassifications of owner expenses to operating expenses, for $44,000, with no support. The owner's personal expenses were run through the business. Proposed entry and disclosure review.
- 2 post-year-end entries ($118,000 and $65,000) increased revenue and reduced the allowance, with approval dated after the entries. The auditor discusses with the CFO and the partner and evaluates it as a possible management override matter. Both entries are tested to the contracts and the allowance calculation. One is supported, one is reversed.
- The remaining entries were supported.
Treat the criteria as a living list
If testing shows a pattern, add a criterion and rerun. Documentation records the final criteria and the reasoning for each and for any dropped.
Documentation
Population source and completeness tests, criteria with the rationale and the hits, selection, test results with evidence, findings and their disposition, the partner's conclusion on management override.
CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.
Sources
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (journal entry testing as a response to management override of controls)
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
- U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, section 265 (responses to fraud risk, management override, journal entries): gao.gov
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error