Management override of controls is one of the few fraud risks that every audit must address, whatever the size or sector of the entity. The most direct way to address it is journal entry testing: pulling the general ledger, checking it is complete, and using risk-based criteria to find the entries that deserve a closer look. This article shows how to perform a solid first pass in Excel today.
Why journal entry testing matters
Under ISA 240, the auditor treats the risk of management override of controls as a significant risk of material misstatement due to fraud. Regardless of how that risk is assessed, paragraph 32(a) of the current standard requires the auditor to design and perform procedures to test the appropriateness of journal entries recorded in the general ledger and other adjustments made in preparing the financial statements. That includes making inquiries of people involved in financial reporting about inappropriate or unusual activity, selecting entries made at the end of the reporting period, and considering whether entries throughout the period also need testing.
The IAASB has since issued ISA 240 (Revised), effective for audits of financial statements for periods beginning on or after 15 December 2026. The revised standard keeps the focus on journal entries and places greater emphasis on professional scepticism, so now is a good time for audit teams to strengthen their approach.
Internal auditors benefit too. Unusual manual journals are a classic route for concealing misappropriation, smoothing results or moving budget lines in public sector entities.
What the test looks for
Journal entry testing is not about checking every line. It is about filtering a full population down to entries with characteristics commonly associated with error or manipulation. Typical risk criteria include:
- Timing: entries posted on weekends, public holidays, late at night, or in the final days of the period and immediately after it.
- User: entries posted by senior management, IT staff, or users who rarely post journals or should not post them at all.
- Amount: round-sum amounts (for example 50,000.00) and amounts just below approval thresholds.
- Accounts: entries to seldom-used, suspense or clearing accounts, and unusual combinations such as debiting revenue or crediting cash directly against an expense accrual.
- Description: blank, vague or one-word narrations such as “adj”, “correction” or “per CFO”.
- Source: manual journals rather than system-generated postings from sub-ledgers.
An entry that hits several criteria at once is usually a stronger candidate for follow-up than one that hits only a single flag.
Step 1: Confirm the population is complete
Before filtering anything, prove that the journal data you received is the whole ledger.
- Request a full general ledger extract for the period, including JE number, posting date, entry date and time, user ID, account code, debit, credit and description.
- Check that total debits equal total credits: =SUM(F:F)-SUM(G:G) should return zero.
- Check that each journal balances with a pivot table: put JE No in Rows, and Debit and Credit in Values. Add a calculated field =Debit-Credit and filter for anything not equal to zero.
- Roll forward: opening trial balance plus net journal activity per account should equal the closing trial balance. Use =SUMIFS(F:F,D:D,A2)-SUMIFS(G:G,D:D,A2) per account and compare to the trial balance movement.
- Run a gap test on JE numbers to identify missing or out-of-sequence journals.
Worked example: sample journal data
Below is a simplified extract from the ledger of a fictional Harare-based NGO. Amounts are in US dollars and the financial year ends on 31 December 2025.
| JE No | Posting date | Time | User | Account | Debit | Credit | Description |
|---|---|---|---|---|---|---|---|
| JE1041 | 12/11/2025 | 10:14 | tmoyo | Stationery | 412.60 | Office supplies Nov | |
| JE1042 | 12/11/2025 | 10:14 | tmoyo | Bank | 412.60 | Office supplies Nov | |
| JE1187 | 27/12/2025 | 22:48 | fdirector | Grant income | 50,000.00 | adj | |
| JE1188 | 27/12/2025 | 22:48 | fdirector | Suspense | 50,000.00 | adj | |
| JE1203 | 31/12/2025 | 16:05 | rchikwanha | Fuel | 1,287.35 | Vehicle fuel Dec | |
| JE1204 | 31/12/2025 | 16:05 | rchikwanha | Accruals | 1,287.35 | Vehicle fuel Dec | |
| JE1215 | 03/01/2026 | 07:02 | itadmin | Donor receivable | 9,900.00 | ||
| JE1216 | 03/01/2026 | 07:02 | itadmin | Programme expenses | 9,900.00 |
JE1187/1188 is posted on a Saturday, late at night, by the finance director, for a round sum, to a suspense account, with a one-word description. JE1215/1216 is posted on a Saturday after year-end by an IT administrator with no description, reducing expenses just below a USD 10,000 threshold. Both deserve inquiry and inspection of supporting documents. The other entries look routine.
Step 2: Build the risk flags in Excel
Assume the data starts in row 2, with Posting date in column B, Time in C, User in D, Account in E, Debit in F, Credit in G and Description in H. Convert the range to a Table (Ctrl+T) so formulas fill down automatically, then add these flag columns:
Timing flags
- Weekend: =IF(WEEKDAY(B2,2)>5,1,0) returns 1 for Saturday and Sunday.
- After hours: =IF(OR(HOUR(C2)<7,HOUR(C2)>=19),1,0)
- Period end window: =IF(AND(B2>=DATE(2025,12,24),B2<=DATE(2026,1,15)),1,0) captures the last week of the year and post-closing entries.
Amount and description flags
- Round sum: =IF(AND(MAX(F2,G2)>=1000,MOD(MAX(F2,G2),1000)=0),1,0)
- Just below threshold: =IF(AND(MAX(F2,G2)>=9000,MAX(F2,G2)<10000),1,0), adjusted to your entity’s approval limits.
- Weak description: =IF(LEN(TRIM(H2))<5,1,0)
User and account flags
- Infrequent user: =IF(COUNTIFS(D:D,D2)<10,1,0) flags users with fewer than ten lines in the year.
- Unauthorised user: keep a list of approved posters in a separate sheet named Users and use =IF(COUNTIFS(Users!A:A,D2)=0,1,0).
- Sensitive account: =IF(OR(E2=”Suspense”,E2=”Grant income”),1,0), extended to your own list of high-risk accounts.
Finally, add a Risk score column that sums the flags, for example =SUM(I2:Q2). Apply conditional formatting (Home > Conditional Formatting > Color Scales) to the score column, then build a pivot table with JE No in Rows and the maximum Risk score in Values. Sort descending and you have a prioritised list of journals for follow-up.
Step 3: Follow up and document
- Select the highest-scoring journals, plus any entries that match a specific fraud risk identified at planning.
- Obtain supporting documents and confirm business rationale, authorisation and correct period.
- Inquire of the preparer and approver, and corroborate the explanations rather than accepting them at face value.
- Record the criteria used, the population reconciliation, the items selected and the results in your working papers, so a reviewer can reperform the work.
For internal audit teams, logging each exception as a finding with evidence attached makes follow-up far easier. A tool such as Auditors Track GRC lets you record findings, attach evidence and track them by department and engagement.
Common mistakes to avoid
- Testing a filtered extract without reconciling it to the trial balance.
- Only looking at year-end entries and ignoring the rest of the period.
- Copying the same criteria every year instead of tailoring them to this year’s fraud risks.
- Ignoring system-generated entries entirely; automated postings can also be manipulated through changes to configuration or interfaces.
- Selecting entries but failing to corroborate management’s explanations.
Conclusion
Journal entry testing is a required response to management override, and it is also one of the most practical fraud tests an auditor can run. Confirm completeness first, apply a set of tailored risk flags, score the results and follow up the riskiest entries with real scepticism.
Excel works well for smaller ledgers, but a full year’s general ledger at a bank, parastatal or large group can run to millions of lines, well beyond what spreadsheets handle comfortably. ProDataTool is a desktop data analysis application built for auditors and analysts, handling datasets from thousands to millions of rows. You can organise each engagement as a project, run descriptive statistics, cross-tabulate journals by user and account, build pivot analyses and summaries, and apply custom filters for your risk criteria. Book a free ProDataTool demo and see how quickly you can test your next general ledger.