Management override of controls is the fraud risk that is present in every audit and cannot be designed out, because the people who would override the controls are the people who run them. SA 240 responds by requiring the auditor to test journal entries and other adjustments — and testing every entry, rather than a judgemental sample, is the direction of travel.
Why the full population
A manipulative entry is designed not to look like the others. A sample selected on size or on a single characteristic can miss it. Running the risk criteria against every entry for the year removes that gap and produces a specific, explainable list of items for the auditor to examine, each linked to its voucher and approval trail.
Preparing the extract
Most of the effort is in the data. The extract the company should be ready to provide contains, for every journal for the year:
- Entry date and posting date (so back-dating is visible)
- The user who created it and the user who approved it
- The source module — manual, sub-ledger, interface, consolidation
- Amount, the accounts debited and credited, and the narration
The extract then has to reconcile to the movement in the trial balance. An extract that does not tie out is not usable, and finding that out during fieldwork costs days.
The risk criteria that matter
The screens that consistently earn their place:
- Manual and top-side entries concentrated in the last days of the period or after the close
- Round-number entries, and entries just below an approval threshold
- Rare account combinations — pairings that occur only a handful of times in the year
- Entries posted by senior finance staff who do not normally post, or by generic or shared accounts
- Entries to revenue, cash, reserves, or provisions with weak or missing narration
- Entries reversed early in the next period
- Digit-distribution (Benford) analysis on the large populations, as a screen rather than a conclusion
The company that self-runs these screens before fieldwork and has an explanation ready for each flagged item shortens the audit and removes a common source of last-minute friction.
Where AI helps
AI takes the extract, checks that it reconciles to the trial balance, runs every criterion across every entry, and returns a scored list with each item linked to its source. The auditor reviews the flags, applies judgement, and reaches the conclusion. The tool does the coverage; it does not form the opinion.
Get the Statutory Audit Readiness Guide
The prepared-by-client list across 13 areas, the reconciliations to finish before fieldwork, where auditors probe, full-population journal-entry testing, CARO 2020 notes, and a printable checklist.
Get the guide →