Journal Entry Testing Under AU-C 240: Criteria, Completeness and Red Flags

Journal entry testing is one of the few audit procedures that is required on every GAAS audit regardless of the assessed risk. The reason is that management is in a unique position to commit fraud by overriding controls, and one way to do that is to record entries that make the financial statements say something they should not.

This guide walks through journal entry testing for a nonissuer audit under AU-C 240, Consideration of Fraud in a Financial Statement Audit. It paraphrases the standard. AU-C 240 will be superseded by SAS No. 151, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, approved by the AICPA Auditing Standards Board in August 2026 and effective for audits of financial statements for periods ending on or after December 15, 2028, with early implementation permitted. Until a firm adopts SAS 151, AU-C 240 governs.

Why journal entry testing is required

AU-C 240 treats the risk of management override of controls as present in every entity. Unlike the presumed fraud risk in revenue recognition, this one cannot be rebutted. Because override can happen in unpredictable ways, the standard requires specific procedures in response, whatever the auditor's assessment of other risks.

Three procedures respond to management override:

1. Testing the appropriateness of journal entries recorded in the general ledger and other adjustments made in preparing the financial statements.
2. Reviewing accounting estimates for bias, including a retrospective review of prior-year estimates.
3. Evaluating the business rationale for significant transactions outside the normal course of business or that otherwise appear unusual.

This article covers the first. The other two belong in your fraud risk and estimates workpapers.

What AU-C 240 asks the auditor to do

AU-C 240 requires the auditor to design and perform procedures to test the appropriateness of journal entries recorded in the general ledger and other adjustments made in preparing the financial statements. The procedures include:

• making inquiries of individuals involved in the financial reporting process about inappropriate or unusual activity relating to the processing of journal entries and other adjustments
• selecting journal entries and other adjustments made at the end of a reporting period
• considering the need to test journal entries and other adjustments throughout the period

In determining the selection, the auditor considers the assessed risks of material misstatement due to fraud, the effectiveness of controls over journal entries, the entity's financial reporting process and the nature and complexity of its accounts, the characteristics of fraudulent entries, and entries processed outside the normal course of business.

"Other adjustments" matters. Entries made outside the general ledger, such as top-side consolidation entries, spreadsheet adjustments between the trial balance and the financial statements, and post-closing entries, are in scope.

Step 1: Understand how entries get into the ledger

Before pulling entries, document how entries are made:

• Standard entries: recurring, system-generated entries from subledgers (sales, cash receipts, payables, payroll).
• Nonstandard entries: manual entries for accruals, reclassifications, estimates and unusual transactions.
• Who can post: which users have rights to create and approve manual entries, and whether the system enforces approval.
• Period-end process: who prepares closing entries, whether entries can be posted to a closed period, and how consolidation or reporting adjustments are recorded.

In small entities one person may both prepare and post entries with no approval. That is not unusual, but it is relevant: weak segregation over manual entries raises the risk you are responding to and should shape your selection.

Step 2: Prove the population is complete

A journal entry test on an incomplete population proves little. Before applying any criteria, show that the data you received is the whole ledger.

A common completeness check is a rollforward:

Also check that entry numbers are sequential where the system assigns them, that total debits equal total credits, and that the date range covers the full period plus any post-closing entries. Record the report name, parameters and who ran it. The data is information produced by the entity, so its completeness and accuracy need to be addressed, not assumed.

Step 3: Set selection criteria based on risk

There is no fixed list. Criteria come from your understanding of the entity, the fraud risks identified in planning and the characteristics that AU-C 240 application guidance describes as typical of fraudulent entries. Those characteristics include entries that:

• are made to unrelated, unusual or seldom-used accounts
• are made by individuals who typically do not make journal entries
• are recorded at the end of the period or as post-closing entries with little or no explanation or description
• are made either before or during the preparation of the financial statements without account numbers
• contain round numbers or consistent ending numbers

Turn those into testable filters. An illustrative example for a distribution company with a revenue fraud risk (the counts are made up):

Many entries hit more than one filter. Rank by the number of criteria hit and by amount, then select. Document why each criterion was chosen, which risk it addresses and how many entries it returned.

Testing throughout the period

AU-C 240 requires selection of period-end entries and requires the auditor to consider whether testing throughout the period is needed. Material misstatement due to fraud can occur mid-year, for example through entries that move expenses to the balance sheet each quarter to meet a bank covenant. If interim covenant reporting or bonuses tied to quarterly results exist, extend criteria to those dates.

Step 4: Use analytics such as Benford's law

Data analytics can help focus the selection. Benford's law describes the expected frequency of leading digits in many naturally occurring data sets: a leading 1 appears far more often than a leading 9. Manual amounts that have been invented or manipulated often depart from that pattern, for example with spikes just below an approval threshold.

Benford's analysis is a pointer, not evidence. A nonconforming digit pattern tells you where to look; it does not tell you an entry is wrong. Some populations will never conform, such as amounts with a fixed price or a set minimum. Run the Benford's law analyzer on manual entry amounts, then pull the entries behind any spike into your selection with a note explaining why.

Other useful analytics include entries by user by day, unusual account pairs (debit and credit combinations that rarely occur), and entries posted long after their effective date.

Step 5: Test the entries selected

For each entry selected, the objective is to determine whether it is appropriate: supported, properly authorized, recorded in the right period and consistent with the auditor's understanding of the business.

Typical steps:

1. Obtain the entry and its support (invoice, contract, calculation, board minute).
2. Agree the amount and accounts to the support.
3. Evaluate whether the accounting is correct and the business purpose makes sense.
4. Check who prepared and approved it, and whether approval happened before posting.
5. For period-end entries, check that the entry belongs in the period.
6. Inquire of the preparer when support is thin, and corroborate the answer.

Inquiry of the CFO who made the entry is not enough on its own when the risk being addressed is management override. Look for evidence from outside the person who posted it.

Step 6: Document and conclude

AU-C 230 expects enough detail for an experienced auditor to understand what was done. For journal entry testing, the file should show:

• the understanding of the financial reporting process and controls over entries
• the inquiries made, of whom and the responses
• the source data, report parameters and completeness check
• each criterion, the rationale and the number of entries returned
• the entries selected with identifying characteristics (entry number, date, amount, preparer)
• the results for each entry and how exceptions were resolved
• a conclusion on whether any evidence of management override was found

If an entry turns out to be a misstatement, carry it to the summary of misstatements under AU-C 450. If it suggests fraud, revisit the fraud risk assessment and consider the communication requirements in AU-C 240.

Problems to avoid in journal entry testing

• No completeness check. The JE export is used as given, with no rollforward to the trial balance.
• Generic criteria. The same filters every year, with no link to this entity's fraud risks.
• Only "large" entries tested. Amount is one criterion, not the method. Fraudulent entries are often below a threshold on purpose.
• Post-closing and top-side entries missed. The test covers the general ledger but not adjustments made in the financial statement workbook.
• Support from the preparer only. The person who made the entry explains it, and the explanation is accepted.
• No conclusion. The file shows entries ticked but not whether override was found.

Frequently asked questions

Is journal entry testing required on every audit?

Yes. AU-C 240 requires procedures responding to the risk of management override of controls on every audit, and testing the appropriateness of journal entries and other adjustments is one of them, whatever the assessed level of other risks.

How many journal entries should be tested?

AU-C 240 does not set a number. The extent depends on the risks identified, the effectiveness of controls over entries and the results of your criteria. Selection is usually targeted at entries with high-risk characteristics rather than a statistical sample.

Can I rebut the risk of management override in a small entity?

No. The risk of revenue recognition fraud is a rebuttable presumption, but the risk of management override of controls is treated as present in all entities and the required responses always apply.

Does Benford's law prove that journal entries are fraudulent?

No. Benford's analysis identifies digit patterns that deviate from expectation, which helps focus selection. Each flagged entry still has to be tested against support before reaching any conclusion.

What are "other adjustments" in journal entry testing?

They are adjustments made in preparing the financial statements that may not pass through the general ledger, such as consolidating entries, top-side adjustments and reclassifications made in the reporting workbook.

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

Sources

• AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit (management override and journal entries)
• AICPA, SAS No. 151, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements (at a glance): https://www.aicpa-cima.com/resources/download/sas-no-151-at-a-glance
• Journal of Accountancy, "ASB approves standard on auditor's responsibilities relating to fraud," August 2026: https://www.journalofaccountancy.com/news/2026/aug/asb-approves-standard-on-auditors-responsibilities-relating-to-fraud/
• AICPA, AU-C Section 315, AU-C Section 450, AU-C Section 500 (information produced by the entity) and AU-C Section 230

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error