Journal entry testing for management override

In this lesson you will

State the AU-C 240.32a requirements for testing journal entries and other adjustments
Establish completeness of the journal entry population by tying it to the trial balance
Set risk-based selection criteria tied to the entity’s fraud risks
Test selected entries to support and business purpose

Why every audit has this procedure

AU-C 240 treats management override of controls as a risk of material misstatement due to fraud, and therefore a significant risk, on every audit. AU-C 240.32 requires the auditor to address it apart from any other fraud risks, with three procedures: test journal entries and other adjustments, review estimates for bias, and evaluate the business purpose of significant unusual transactions. This lesson covers the first.

AU-C 240.32a requires the auditor to test the appropriateness of journal entries recorded in the general ledger and other adjustments made in preparing the financial statements, including entries posted directly to financial statement drafts. In designing the tests the auditor should:

obtain an understanding of the financial reporting process and controls over journal entries, and evaluate their design and implementation;
inquire of people involved in financial reporting about inappropriate or unusual activity in processing journal entries;
consider fraud risk indicators, the nature and complexity of accounts, and unusual entries;
select entries and adjustments made at the end of a reporting period; and
consider the need to test entries throughout the period.

AU-C 330.21b separately requires examining material journal entries and adjustments made in preparing the financial statements.

SAS 151 supersedes AU-C 240 for audits of periods ending on or after December 15, 2028, with early adoption permitted. Check the SAS 151 summary before your first audit under it.

Step one: a complete population

Testing a population you have not proven complete is the most common gap. Obtain the full journal entry detail for the period, then:

Roll forward each account: opening balance plus journal activity equals closing trial balance. Every account, every period.
Confirm the extract covers all sources: manual entries, recurring entries, system-generated entries from subledgers, and top-side or consolidation adjustments outside the ledger.
Note the entry fields you have: user, date posted, effective date, source, description.

A population that does not roll to the trial balance cannot support a conclusion that you tested the right entries. The guide on population completeness and selection criteria shows the tie-out.

Step two: selection criteria

Criteria come from your fraud risk assessment and your understanding of the entity, not a generic list. Characteristics the application material associates with fraudulent entries include entries:

to unrelated, unusual or seldom-used accounts,
by individuals who do not usually make entries,
at period-end or post-closing, with little or no explanation,
made before or during preparation of the financial statements without account numbers,
containing round numbers or consistent ending numbers.

Tailor them. If the fraud risk is revenue pulled forward, look for manual credits to revenue in the last weeks of the year and reversals in the first weeks of the next. If the controller can post and approve, look at everything the controller posted. The journal entry testing filter and risk criteria worksheet help.

Step three: testing what you select

For each entry selected, obtain support, evaluate whether the entry is appropriate and has a business purpose, check that it was authorized under the entity's process, and agree the accounts and amounts. "Agreed to support" is not enough when the support is a spreadsheet the same person prepared. Ask what underlying event the entry records.

Documentation

Document the population and its tie-out, the criteria and why each was chosen, the number of entries meeting each criterion, the entries tested, the results and the conclusion. A file that lists entries tested without explaining why they were selected will draw a peer review comment.

Worked example

Journal entry testing at Meadowbrook Distributors, Inc.

The general ledger export contains 48,200 lines. The team rolls forward all 212 accounts: opening balances plus activity agree to the closing trial balance used for the financial statements except one account, short by $64,000. The difference is a top-side entry posted in the consolidation spreadsheet, not the ledger. The team adds the 9 consolidation entries to the population.

Fraud risks: revenue cutoff and override by the CFO, who can post and approve.

Criteria and hits:

Manual entries crediting revenue December 15-31: 6 entries.
Entries posted by the CFO: 22 entries.
Entries posted after the December close date: 14 entries.
Entries of $25,000 or more ending in 000: 31 entries.
All 9 consolidation entries.

After removing duplicates across criteria, 58 entries are selected. All agree to support except one: a $120,000 December 28 credit to revenue posted by the CFO, described as "true-up," reversed January 4. No customer contract or shipment supports it. The team treats it as a misstatement, evaluates it under AU-C 240 as possible fraud, communicates with those charged with governance and extends cutoff testing.

Self-check

Answer each question before you open the answer.

Why must the journal entry population be tied to the trial balance before selection?
Show answer
Without proof the population is complete, entries outside it, such as top-side adjustments, could never be selected. The tie-out shows you tested from the whole set of entries that built the financial statements.
Does AU-C 240.32a allow you to test only year-end entries?
Show answer
It requires selecting entries made at the end of a reporting period and considering the need to test entries throughout the period. You document that consideration, and fraud risks may require testing during the year.
Why are generic selection criteria a weakness?
Show answer
AU-C 240.32a requires considering fraud risk indicators and the nature of accounts. Criteria tied to the entity’s specific risks and people find the entries that matter; a generic list may not.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error