AI Journal Entry Testing

Journal entry testing exists because management can override controls by recording entries directly in the ledger. PCAOB AS 2401 and ISA 240 treat management override as a fraud risk in every audit and require auditors to test whether journal entries and other adjustments are appropriate. The standards also describe traits that make entries worth examining: Entries to unrelated, unusual or seldom-used accounts; Entries by people who do not usually make them; Entries recorded at period end or after closing with little or no explanation; Entries without account numbers; and Round amounts, or amounts that end in the same digits. The WorldCom fraud, uncovered in 2002, showed why this matters. Billions of dollars of operating line costs were moved into capital asset accounts through journal entries, and the company's internal auditors found it by tracing those entries.

AI-based testing applies these traits to every entry rather than to a filtered subset. A typical approach first runs rule-based flags, such as weekend posting, posting after the close date, the same person preparing and approving, or revenue recorded against an unusual account. It then combines the flags into a risk score. Some tools add unsupervised machine learning, which learns what normal entries look like for this client and scores unusual combinations of user, account, amount and timing.

The auditor then selects high-scoring entries and gets support for them: the underlying documents, the business reason and who authorized each one. Context matters. A payroll accrual that is always round and always posted by the controller on the last day is normal for that client.

One misconception is that a high score means fraud. It only means an entry is unusual. Another is that system-generated entries are safe. Changes to interfaces and configurations can also be used to manipulate the books, which is why the population must include them.