Record to report is the process that turns transactions from every other cycle into financial statements. It is where manual entries, estimates and top-side adjustments live, and where management override is most likely. The SEC's interpretive guidance for management uses the period-end financial reporting process as its example of an entity-level control that can address a risk, such as misstatement of interest expense, so that management may not need to identify additional controls for that risk. That makes R2R controls efficient to test and costly to get wrong. This post gives an RCM and a worked analytic.
The RCM
| ID | Risk | Control | Type | Assertion | Test step |
|---|---|---|---|---|---|
| R2R-01 | Unauthorized changes to the chart of accounts | Changes requested and approved outside the preparer; quarterly review of the change log | Preventive, detective | Classification | Obtain full change log; sample to approval |
| R2R-02 | Unauthorized or erroneous manual journal entries | Entries require documented support and approval by someone other than the preparer; the system enforces it | Preventive | Occurrence, accuracy | Full-population analytics; test approvals and support for sample |
| R2R-03 | Entries posted by users who should not post | Posting rights restricted and reviewed quarterly | Preventive | Occurrence | Compare users with posting rights to approved list |
| R2R-04 | Unusual entries at period end go undetected | Monthly review of manual entries by criteria (period end, round amounts, unusual accounts, posters) by the CFO | Detective | Occurrence | Reperform the review criteria; test evidence |
| R2R-05 | Balance sheet accounts not reconciled | Account reconciliation for each balance sheet account by a set day; reviewed by someone other than the preparer; unreconciled items aged | Detective | Existence, accuracy | Sample reconciliations; reperform; check sign-off dates |
| R2R-06 | Estimates misstated (reserves, accruals, impairment) | Estimate memos with inputs, method and a reviewer; look-back to prior estimates | Detective | Valuation | Reperform; compare prior estimates to actual |
| R2R-07 | Consolidation errors | Intercompany balances matched and eliminated; consolidation workbook reviewed | Detective | Accuracy, presentation | Reperform eliminations |
| R2R-08 | Financial statements and disclosures misstated | Statements reviewed against a disclosure checklist; tie-out of statements and notes to the trial balance | Detective | Presentation | See /us/blog/tick-and-tie-financial-statement-tie-out |
| R2R-09 | Subsequent adjustments after close | Post-close entries restricted and approved; period locks enforced | Preventive | Cutoff | Test lock configuration; entries posted after close |
| R2R-10 | Spreadsheets used in the close contain errors | Key spreadsheets locked, versioned, reviewed; inputs agreed to source | Preventive, detective | Accuracy | Test key spreadsheets |
Worked analytics: manual entries
Data analytics can test whole populations. For R2R-02 and R2R-04, extract every manual journal entry for the year and test:
- Entries posted in the last three days of a period or the first days after.
- Round-number entries above a threshold.
- Entries to unusual account pairs such as revenue and reserves.
- Entries by users outside finance or by senior executives.
- Entries with no description or support reference.
- Entries posted on weekends or holidays.
- Entries where preparer equals approver.
- Entries reversed in the next period that move income.
Example: for a company with 11,200 manual entries in the year, filter to entries above $100,000: 94. Of those, 12 were posted in the last two days of a quarter, and 3 were prepared and approved by the controller. The controller's entries are tested in full: two were supported, one lacked a reconciliation to the supporting schedule and moved $340,000 from accrued liabilities to revenue. Investigate. See /us/blog/journal-entry-testing-au-c-240 and /us/blog/management-override-of-controls-audit-response.
Reconciliations
For each balance sheet account the control should specify the reconciliation, the preparer, the reviewer, the due date and what counts as complete. A reconciliation that lists a variance without explanation is incomplete. Test with: agree the balance to the trial balance on the date of the control; reperform the reconciling items; inspect the aging of unreconciled amounts and the follow-up. A sign-off date is evidence only after it is agreed to the system timestamp; Standard 4.3 Professional Skepticism requires internal auditors to critically assess the reliability of information. A common finding: a clearing account with an aged balance that has never been cleared. The SEC guidance lists suspense accounts as an item that involves greater risk when evaluating deficiencies.
Estimates and look-backs
The guidance treats critical accounting estimates as generally higher misstatement risk and says controls that involve significant judgment carry higher risk of failure. R2R-06 should include a look-back: compare prior period estimates to actual outcomes and record the differences. A consistent bias in the same direction is a signal of management bias. See /us/blog/auditing-estimates-point-estimate-range-and-management-bias.
The close calendar
A close checklist ties R2R together. See /us/blog/month-end-close-process-checklist. Key control evidence: the date each item was completed, who completed it, who reviewed it and any exceptions. A good bar for close evidence is documentation that lets an informed person repeat the work.
Where R2R is an entity-level control
Because the close touches every account, the SEC guidance recognizes that an entity-level control within the period-end process may address a risk for several accounts at once. That works only if the control operates at precision that would detect a material misstatement, and it requires the documentation to show it. See /us/blog/entity-level-controls-under-sec-guidance-when-they-address-a-risk-directly.
Mistakes to avoid
- Accepting a sign-off date without checking it against the system timestamp.
- Excluding post-close adjustments from analytics.
- No reviewer for the CFO's own entries.
- Treating consolidation spreadsheets as outside the control program.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- SEC, Release No. 33-8810, Sections II.A.1, II.A.2.a and II.B.1 (period-end financial reporting process as an entity-level control; critical accounting estimates; suspense accounts as a risk factor): https://www.sec.gov/rules/interp/2007/33-8810.pdf
- The IIA, Global Internal Audit Standards (2024), Standard 4.3 Professional Skepticism: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error