Journal Audit

A journal audit is a focused review of the journal entries a business has recorded, checking that each one is accurate, properly supported by documentation, and recorded in line with the company's accounting policies and the relevant accounting standards. Because journal entries are the raw building blocks that flow into the general ledger and ultimately the financial statements, an error or an improper entry at this level can distort every report built on top of it, which is why journal entries are a standard area of focus for both internal reviewers and external auditors.

A journal audit typically verifies that each entry balances, with total debits equal to total credits; that it is supported by adequate documentation, such as an invoice, contract or approval; that it was recorded in the correct accounting period; and that it was posted to the correct accounts under the company's chart of accounts. Reviewers also check that entries carry an appropriate description explaining the business reason for the transaction, since an entry with no narrative or a vague one is far harder to verify later and is itself often treated as a red flag.

Smaller companies or routine internal reviews may examine every journal entry in a period, but most journal audits work from a sample, selected either at random or targeted at entries that carry higher risk — large amounts, entries posted outside normal business hours, entries made directly to the general ledger rather than through an automated subledger, or entries made by someone outside the normal accounting team. Each sampled entry is traced back to its supporting documentation and forward to its effect on the financial statements, checking that the trail is complete and consistent at every step.

Reviewers pay particular attention to manual journal entries, since routine, system-generated entries from sales, payroll or billing subledgers carry far less risk of error or manipulation than one-off entries typed directly into the ledger by an individual. Entries made late at night, at month-end or year-end, made in round numbers, lacking supporting documentation, or reversed and re-posted shortly afterward are all patterns that have historically shown up in cases of both honest error and deliberate financial statement manipulation, which is why they draw disproportionate scrutiny relative to their number.

A journal audit is usually narrower and more frequent than a full external audit: it is often run monthly or quarterly by internal accounting or internal audit staff as part of ordinary financial controls, rather than once a year by an independent auditor producing audited financials. External auditors do still perform their own journal entry testing as part of a statutory audit, but a well-run internal journal audit process is itself one of the controls an external auditor will evaluate when deciding how much additional testing of its own is needed.

Manual journal entries have historically been one of the most common tools used in deliberate financial statement manipulation, precisely because they can bypass the automated controls built into sales, billing and payroll subledgers and post directly to the general ledger with comparatively little oversight. Cases of earnings manipulation uncovered by regulators have frequently traced back to a small number of large, improperly supported journal entries made near a reporting deadline. This history is why accounting standards on internal control, and most company audit committees, specifically require controls around who can post a manual journal entry, require a second person to approve any entry above a set size, and require a periodic journal audit as a standing control rather than something only performed when fraud is already suspected. Data analytics tools are increasingly used to run journal audits continuously across an entire ledger rather than on a small sample, scoring every entry against the same risk factors and flagging the handful that warrant a human reviewer's attention, which has made this once purely sample-based control far more comprehensive than it used to be.