Management Override of Controls: The Required Audit Response, Step by Step

Every other fraud risk can be assessed up or down. Management override of controls cannot. It is treated as a risk on every audit because management can manipulate accounting records and prepare fraudulent statements by overriding controls that otherwise appear to operate effectively. The response is a fixed set of procedures performed regardless of other risk assessments.

This post walks through those procedures, using the PCAOB's AS 2401 as the text for the paragraph-level detail, and the AICPA material for the nonissuer position.

The standards in one paragraph

The PCAOB standard says management is in a unique position to perpetrate fraud, that override can occur in unpredictable ways, and that the procedures in paragraphs .58 through .67 of AS 2401 are performed to address it. For nonissuer audits, the Journal of Accountancy's summary of AU-C 240 lists override as a required topic of the engagement team discussion and notes the requirement to build an element of unpredictability into audit procedures. SAS No. 151, published by the AICPA in October 2026, supersedes AU-C 240 for periods ending on or after December 15, 2028, with earlier adoption permitted. The procedures below are the established core under both the PCAOB and AICPA standards.

Procedure 1: journal entries and other adjustments

AS 2401.58 explains that fraud often involves recording inappropriate or unauthorized journal entries during the year or at period end, or making adjustments that are not in formal journal entries, such as consolidating adjustments, report combinations and reclassifications. The auditor should:

1. Obtain an understanding of the entity's financial reporting process and the controls over journal entries and adjustments.
2. Identify and select entries and other adjustments for testing.
3. Determine the timing of the testing.
4. Inquire of individuals involved in the financial reporting process about inappropriate or unusual activity in processing entries.

Understand the controls first

AS 2401.60 requires the auditor to understand the design of controls over journal entries and determine whether they are suitably designed and in operation. Preformatted entries with approval criteria and exception reports for entries outside parameters are examples.

Selecting entries

AS 2401.61 tells the auditor to consider the assessed fraud risk, the effectiveness of controls over entries, the nature of the financial reporting process and the evidence that can be examined. It adds that even where controls are effective, substantive procedures should include identifying and testing specific items.

Criteria that many firms build into the selection include the following. Entries to seldom-used accounts, entries by individuals who do not typically post, entries at or after period end with little explanation, and round or consistently ending amounts come from the characteristics listed in AS 2401.61. The rest reflect firm practice:

• manual entries posted to revenue, reserves and equity;
• entries posted by users who do not normally post, or by the owner or controller;
• entries posted after period end that affect the period under audit;
• round-dollar entries and entries with no description;
• entries to accounts that are rarely used;
• entries that move amounts across the threshold of a covenant or a bonus target.

Timing

AS 2401.62 says fraudulent entries are often made at the end of a reporting period, so testing ordinarily focuses on entries and adjustments made then. It adds that because fraud can occur throughout the period, the auditor considers whether entries should also be tested throughout the year.

Other adjustments

The standard reaches adjustments outside the ledger: entries posted directly to draft financial statements, and top-side consolidation adjustments. For a small client on off-the-shelf accounting software, an adjustment prepared in a spreadsheet and uploaded as one entry needs its supporting workbook. See journal entry testing and audit trail testing.

Worked example

All figures are illustrative. A client's ledger has 4,200 entries for the year. The team filters the population:

The team tests all 63, plus a sample of 25 from the remaining 117 manual entries in those accounts, and extends testing to the period after year end. Of the 63, three have no support. Management explains that two were reclassifications for a loan covenant. The third, $85,000 to reduce an accrued bonus, has no approval. The team treats the third as a possible indicator of override, extends to all entries by that user, and returns to the fraud risk assessment.

Procedure 2: retrospective review of estimates

AS 2401.64 requires a retrospective review of accounting estimates in significant accounts and disclosures: compare prior-year estimates to actual results to see whether the judgments and assumptions indicate possible bias. The estimates selected should be those with an assessed fraud risk. AS 2401.65 says that if the auditor identifies possible bias, the auditor evaluates whether the circumstances represent a risk of material misstatement due to fraud. Examples include adjustments to current-year estimates recorded at management's instruction to reach a target. See evaluating management bias in estimates.

Procedure 3: significant unusual transactions

AS 2401.66 requires the auditor to evaluate whether the business purpose of significant unusual transactions indicates they may have been entered into to engage in fraud. These are transactions outside the normal course of business or unusual in timing, size or nature. The standard directs the auditor to draw on risk assessment procedures, minutes, journal entry testing and information about related parties not previously disclosed. See related party transactions.

Evaluating the results: bias in the aggregate

AS 2810.24 through .27 give the evaluation. The auditor should consider qualitative aspects of the accounting practices, including potential bias. The standard lists forms of management bias:

• selective correction of misstatements brought to management's attention, correcting those that increase earnings but not those that decrease them;
• identification by management of additional adjusting entries that offset misstatements the auditor accumulated;
• bias in the selection and application of accounting principles; and
• bias in accounting estimates.

When management identifies offsetting entries, the standard requires procedures to understand why the underlying misstatements were not found earlier and to evaluate the implications for the integrity of management and for fraud risk assessments. If bias is found, the auditor evaluates whether the effect of bias, together with uncorrected misstatements, is material, and whether the risk assessments and responses remain appropriate.

Documentation

AS 2401.83 requires documentation of the results of procedures that further address override. The file should show, for each procedure: the population, the criteria, the entries or estimates selected, the support examined, the exceptions, and the conclusion. For entries, include the completeness test of the population, that is, a reconciliation of the entry listing to the trial balance.

What not to do

• Do not reduce override procedures because controls tested well.
• Do not limit testing to the last week of December without considering earlier periods.
• Do not accept an explanation for an unusual entry from the person who posted it without documentary support.
• Do not stop at the entry that has support. Ask why it was made.

FAQ

Can the auditor rebut the risk of management override?

No. The standard treats it as a risk to be addressed on every audit through the specified procedures.

Do these procedures apply to small clients with one bookkeeper?

Yes. Scale the population and sample, but not the procedures.

What if journal entry data is incomplete?

Resolve completeness before testing. Reconcile the listing to the trial balance and investigate the difference.

Sources

• PCAOB, AS 2401, Consideration of Fraud in a Financial Statement Audit (paragraphs .57-.67 and .83), and AS 2810, Evaluating Audit Results (paragraphs .24-.27), in the PCAOB auditing standards for audits after December 15, 2024
• AICPA, SAS 151: Clarifying and enhancing auditor responsibilities relating to fraud
• AICPA, New auditing standard clarifies and enhances CPAs' responsibilities relating to fraud in a financial statement audit (August 2026)
• Journal of Accountancy, How auditors can apply a forensic-like approach to fraud (June 2024)

CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error