AS 2401 paragraph .58 requires the auditor of an issuer to design procedures that test the appropriateness of journal entries recorded in the general ledger and other adjustments, such as entries posted directly to financial statement drafts. Paragraphs .59 to .62 say how: understand the financial reporting process and controls, identify and select entries, decide the timing, and inquire of the people who process them. This procedure is one of the three that AS 2401 paragraph .57 requires for every audit to address management override of controls.
If you work under AICPA standards, the same procedure sits in AU-C 240 paragraph .32(a). The two are close, and a few differences matter in an issuer file. For the nonissuer version step by step, see our guide to journal entry testing under AU-C 240.
What does paragraph .58 require?
Paragraph .58 opens: material misstatements due to fraud can involve manipulating the financial reporting process by (a) recording inappropriate or unauthorized journal entries throughout the year or at period end, or (b) making adjustments that are not reflected in formal journal entries, such as consolidating adjustments, report combinations and reclassifications.
The auditor should then do four things:
- Obtain an understanding of the financial reporting process and the controls over journal entries and other adjustments (.59 and .60).
- Identify and select entries and other adjustments for testing (.61).
- Determine the timing of the testing (.62).
- Inquire of individuals involved in the financial reporting process about inappropriate or unusual activity in the processing of entries and adjustments.
Item 4 is easy to skip because it leaves little paper. Ask the accounting manager, the person who posts top-side entries and the person who administers system access. Write down who answered, what they said and what you did with it. If answers conflict, AS 2110.58 requires evidence that addresses the inconsistency. Our fraud inquiry question bank lists questions by respondent.
What does the auditor need to understand first?
Paragraph .59 says the understanding may help identify the type, number and monetary value of entries made in preparing the statements. It names four things to learn: the sources of significant debits and credits to an account, who can initiate entries, what approvals are required, and how entries are recorded (online with no physical evidence, or on paper and entered in batch).
Paragraph .60 adds that the auditor should obtain an understanding of the design of controls over journal entries and other adjustments and determine whether they are suitably designed and have been placed in operation. Preformatted entries with account numbers and approval criteria, and exception reports for entries processed outside set parameters, are the examples given.
How are entries selected under paragraph .61?
Paragraph .61 tells the auditor to use professional judgment on nature, timing and extent, and to consider six things when selecting entries and choosing how to examine support:
- The assessed fraud risk. Fraud risk factors can point to classes of entries to test.
- Control effectiveness. Effective controls may affect the extent of substantive testing if the auditor tested them. The paragraph then adds that even with effective controls, substantive procedures should include identifying and substantively testing specific items.
- The reporting process and the form of the evidence. The procedures should include selecting entries from the general ledger and examining their support. Electronic-only entries can require extraction by someone with IT skills or an IT specialist.
- Characteristics of fraudulent entries. Entries (a) to unrelated, unusual or seldom-used accounts, (b) by individuals who do not normally make entries, (c) at period end or post-closing with little or no explanation, (d) without account numbers, or (e) with round numbers or a consistent ending number.
- Nature and complexity of accounts. Accounts with complex or unusual transactions, significant estimates and period-end adjustments, a history of errors, late or unreconciled balances, intercompany activity, or an identified fraud risk. Inappropriate entries can also land in other accounts. For multiple locations or business units, the auditor decides whether to select from them using AS 2101.11 to .14.
- Entries outside the normal course of business. Standard recurring entries are subject to the entity's controls. Nonstandard entries, such as a business combination or an impairment, and other adjustments such as consolidating adjustments, report combinations and reclassifications might not be, so the auditor should place additional emphasis on them.
The last point is where most files are thin. A population pulled from the general ledger never contains the consolidation workbook adjustments. Our guide to top-side and post-closing entries covers how to get them into the population.
When does the testing happen?
Paragraph .62: because fraudulent journal entries "often are made at the end of a reporting period," testing ordinarily should focus on entries and adjustments made then. Because fraud can occur throughout the period, and concealment can be extensive, the auditor should also consider whether entries throughout the period need testing. The reasoning and the decision belong in the file even when the answer is no.
How does this compare with AU-C 240?
| Point | AS 2401 (issuers) | AU-C 240 (nonissuers) |
|---|---|---|
| Core requirement | Paragraph .58, with steps a to d | Paragraph .32(a), with items (i) to (v) |
| Controls | Understand design and determine whether placed in operation (.60) | Evaluate design and determine whether implemented (.32(a)(i)) |
| Period-end entries | Testing "ordinarily should focus" on them (.62) | Auditor should select entries made at the end of a reporting period (.32(a)(iv)) |
| Throughout the period | Consider whether there also is a need (.62) | Consider the need (.32(a)(v), A50) |
| Controls and substantive testing | Substantive procedures should include specific items even if controls are effective (.61) | Effective controls may reduce the extent of substantive testing if tested (A49); tests of controls alone cannot reduce risk to an appropriately low level (A56) |
| Characteristics of fraudulent entries | Listed in .61 | Listed in A49 |
The two lists of characteristics are nearly identical. The practical difference is tone: AU-C 240 makes period-end selection a hard requirement, while AS 2401 frames period-end focus as the ordinary approach and adds the explicit statement about testing specific items regardless of control results.
What does an issuer audit file show?
- The understanding of the financial reporting process, including who can post and approve.
- Evidence the population was complete, with the source and the reconciliation to the trial balance.
- The criteria used to select entries and the link from each criterion to a fraud risk or characteristic in paragraph .61.
- The period-end and throughout-the-period decision.
- The inquiries made and the answers received.
- Results for each selected entry, with support examined and any exception followed up.
Our guide to proving population completeness and choosing criteria walks through these steps with an example. The results also feed the broader management override response.
Frequently asked questions
Does AS 2401 set a sample size for journal entries?
No. Paragraph .61 leaves nature, timing and extent to professional judgment and tells the auditor to select specific items from the general ledger and examine support.
Do the paragraphs apply to every issuer audit?
Yes. Paragraph .57 says the procedures in paragraphs .58 to .67 should be performed to specifically address the risk of management override of controls, as part of the response to fraud risks.
Where do significant unusual transactions fit?
They are a separate procedure in paragraphs .66 to .67. Journal entry testing can surface them, and paragraph .66 notes that the identification of significant unusual transactions takes into account journal entry testing.
Sources
- PCAOB, AS 2401, Consideration of Fraud in a Financial Statement Audit, paragraphs .57 to .62 and .66: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2401
- PCAOB, AS 2110, Identifying and Assessing Risks of Material Misstatement, paragraph .58 on inconsistent responses to fraud inquiries: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2110
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit, paragraph .32(a) and application material A47 to A50 and A56: https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error