Auditors test journal entries because the people who run a business can bypass its controls by posting entries straight to the ledger, and ISA (UK) 240 treats that risk of management override as present in every audit. Whatever their risk assessment, auditors must test the appropriateness of journals and other adjustments, always looking at entries made at the period end and after closing, and choose the rest by targeting the characteristics that fraudulent journals tend to share.

Why do auditors test journals at all?

Paragraph 32 of ISA (UK) 240 explains that management is in a unique position to commit fraud by manipulating the accounting records and overriding controls that otherwise appear to work. The level of risk varies, but the risk is present in all entities, and because override can happen in unpredictable ways it is treated as a significant risk. Paragraph A42 notes that fraud often involves recording inappropriate or unauthorised journal entries, either during the year or at the period end, or making adjustments to the accounts that never pass through a journal, such as consolidation adjustments and reclassifications.

Automation does not remove the risk. Paragraph A43 points out that automated controls reduce inadvertent error but do not stop someone changing the amounts that flow into the general ledger, and where IT moves data automatically there may be little visible trace of such intervention. Journal testing is one of the procedures paragraph 33 requires on every audit, alongside a review of accounting estimates for bias and an evaluation of unusual significant transactions. The wider fraud standard is covered in fraud and the auditor: ISA (UK) 240.

What exactly does the standard require?

Under paragraph 33(a) of the current standard, ISA (UK) 240 (Revised May 2021), the auditor must test the appropriateness of manual or automated journal entries in the general ledger and other adjustments made in preparing the financial statements, including consolidation adjustments for group accounts. In doing so the auditor must:

  1. ask individuals with different levels of responsibility in the financial reporting process about inappropriate or unusual activity relating to journals and adjustments;
  2. select journal entries and other adjustments made at the end of the reporting period, and post closing entries; and
  3. consider the need to test journals and adjustments made throughout the period.

This applies irrespective of the auditor’s assessment of the risk of override. A low risk client still gets journal testing; what changes is the extent.

What changes for periods beginning on or after 15 December 2026?

ISA (UK) 240 (Revised March 2026) takes effect for audits of periods beginning on or after 15 December 2026. Paragraphs 48 and 49 keep the core requirement but tighten it in three ways:

  • Completeness of the population. Paragraph 49(b) adds an explicit requirement to obtain audit evidence about the completeness of the population of journal entries and other adjustments made throughout the period. Paragraph A140 explains that the population may include manual or top side adjustments made directly to reported amounts, and that without evidence of completeness the testing may be ineffective.
  • Testing through the year. The auditor must now determine, rather than merely consider, the need to test journals made throughout the period (paragraph 49(d)).
  • Understanding the process. Paragraph 35 requires the auditor to understand how journals and adjustments are initiated, processed, recorded and corrected, and paragraph 36 requires identification of controls over journals designed to prevent or detect fraud.

For a 31 December year end company, the revised version first applies to the year ending 31 December 2027.

How does the auditor know the journal listing is complete?

A test is only as good as the population it draws from. ISA (UK) 500 paragraph A60 makes the general point: if the population from which items are selected is not complete, the results are less reliable. Paragraph A141 of the revised ISA (UK) 240 says that before selecting items the auditor may need to consider whether the integrity of the journal population has been maintained through all stages of processing, drawing on the evaluation of general IT controls. In practice auditors commonly reconcile the journal listing extracted from the accounting system to the movements on the trial balance between the opening and closing positions, and check that adjustments made outside the ledger, such as consolidation entries in a spreadsheet, are captured too.

Which journals get selected for testing?

Paragraph A44 of the current standard lists the features that help identify journals worth testing. Fraudulent entries often have identifying characteristics, including entries:

  • made to unrelated, unusual or seldom used accounts;
  • made by individuals who do not normally post journals;
  • recorded at the period end or as post closing entries with little or no explanation;
  • made before or during preparation of the accounts without account numbers; or
  • containing round numbers or consistent ending numbers.

The same paragraph highlights accounts that are more exposed: those with complex or unusual transactions, significant estimates and period end adjustments, a history of misstatement, untimely reconciliations or unreconciled differences, intercompany transactions, or a link to an identified fraud risk. Where there are several locations, journals from more than one may need to be selected. Non standard journals, used for non recurring or unusual items, may not be subject to the same controls as routine entries for sales, purchases and payments.

Selection also draws on the fraud risk assessment. Appendix 4 of the revised standard gives the example of journals susceptible to manipulation because of pressure to meet performance measures, such as auto reversing journals made at the year end. Paragraph A144 identifies manual adjusting entries and adjustments made directly to the accounts after closing, with little explanatory support, as among the most susceptible to override.

Do journals across the whole year need testing?

Period end and post closing entries must always be selected, because that is when fraudulent journals are most often made (paragraph A45 of the current standard). Testing through the year depends on judgement. Paragraph A145 of the revised standard gives two examples where it is likely to be needed: fraud schemes that can run over a long period, such as complex related party structures, and anomalies or outliers in the journal data detected by automated tools. Paragraph A147 encourages automated tools and techniques for both establishing completeness and selecting items, which is how high volume ledgers can be filtered by user, time of posting, account combination or amount pattern.

What does testing a journal involve?

Paragraph A146 of the revised standard says the auditor may need to examine supporting documentation to determine the business rationale for the entry, whether it reflects the substance of the transaction and whether it complies with the accounting framework. Typical questions are who prepared and approved it, whether the narrative makes sense, whether the support predates the entry and whether the accounts debited and credited fit the explanation.

Controls can reduce the work. Paragraph A44 says effective controls over preparing and posting journals may reduce substantive testing, provided the auditor has tested their operating effectiveness. In owner managed businesses where one person posts and approves journals, that reliance is rarely available.

Is journal selection a form of audit sampling?

Usually not. Journal testing normally selects specific items because of their characteristics. ISA (UK) 500 paragraph A66 explains that the results of testing specific items cannot be projected to the rest of the population, so this kind of selective examination is not sampling. The auditor is responding to a risk, not estimating an error rate. See audit sampling for when projection is appropriate.

How might this look in practice?

Illustration only. A distribution company with a 31 March year end posts about 6,000 journals a year, most of them automated postings from its sales and purchase systems. The auditor reconciles the full journal extract to the trial balance movements, then filters for manual entries posted in the last week of March and the first three weeks of April, entries posted by the managing director, entries to the bad debt provision and revenue accounts with blank narratives, and round sum entries over 10,000 pounds. Fifteen entries are selected. Each is traced to support and discussed with the finance manager, who did not post them, as well as the managing director. Two credit notes posted after closing turn out to relate to April sales and are corrected.

What mistakes do auditors and clients make?

  • Testing a journal listing without first checking it is complete.
  • Selecting only large journals; fraudulent entries are often modest and spread across accounts.
  • Ignoring adjustments made outside the ledger, such as late changes in the accounts preparation software or consolidation workbooks.
  • Asking only the person who posted the journals about unusual activity, rather than people at different levels.
  • For clients, poor narratives and missing approval evidence, which turn a routine test into a long query list. Good journal entry practice and a disciplined month end close make the audit quicker.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.