Testing Journal Entries in Audits

Special thanks to Charles B. Hall, CPA CFE of CPA Hall Talk for providing this valuable information on testing journal entries in audits.

Why is testing journal entries in audits required? Because their use to manipulate financial statements is always present, even in accounting systems with the best internal controls. Thus, the journal entry test requirement per AICPA‘s AU-C 240, Consideration of Fraud in a Financial Statement Audit (PDF).

This post explains how auditors can understand and test journal entries to ensure management is not cooking the books.

Understanding the journal entry process

Person Examining Paper Using Magnifier Glass. Fraud Investigation — *Think your internal controls are top-notch? No matter how great they are, there’s always a risk of fraud in financial statements.*

First, auditors should understand the journal entry process and ask the following questions:

Who can post journal entries and view logical access assignments in the software?
How are journal entries posted?
Who approves journal entries?
Can one person post a journal entry without secondary approval? If no, who else is responsible?
How often are journal entries posted and for what purpose?
Have any unusual journal entries been entered during the year?
Are estimates recorded or adjusted with journal entries? If yes, who makes those entries and how often?
Is there a separate journal entry software package interfacing with the general ledger?
What journal entries are recorded when creating the financial statements, including those after the trial balance is taken from the accounting package? For example, the company downloads the trial balance to Excel.
Are all journal entries in the financial statement creation phase reviewed and approved by another person? If yes, by whom?
At any time has management asked to override journal entry controls or protocols?

Inspect sample documents and journal entries and observe who is responsible for which roles. Then document your inquiries, the records inspected and your observations as a part of your walkthrough process. Finally, remember log who you talked with and on what date… just in case.

Browse through a month’s entries

Consider downloading all journal entries for a particular month and reviewing those to see typical entries made. Most accounting systems differentiate journal entries from other transactions, so it’s generally easy to sort all journal entries for review.

Scanning a month’s journal entries is not a required procedure, but highly recommended.

As you review the journal entries, what do you look for? What types of entries might indicate fraud is present?

Fraud risk indicators

The following could imply fraud risk:

Non-standard journal entries made at year-end, especially round numbers
Entries to seldom-used accounts
Post-closing entries without an explanation or description
Entries made by persons rarely performing the task
Entries forcing accounts to balance without executing proper reconciling procedures

Plan your journal entry responses

Based on your risk assessment procedures, plan to test journal entries. If you notice particular risks, then definitely audit those areas.

Here are a few examples of risks and responses:

Test more entries if one person records journal entries without secondary approval because there is more risk.
If you note unusual logical access assignments, consider a download of all entries. Then sort them by people to confirm any unusual journal entries.
If significant revenue is entered in the previous month, test those entries.
Test the process if one person prepares the financial statements in Excel and makes adjustments without a second-person review.

Journal entries are subject to good controls and may be appropriate throughout the year. However, someone may inflate the numbers creating the financial statements, perhaps after exporting the original numbers to a spreadsheet.