When was the last time you stopped and asked yourself:
“Are we testing journal entries the way we should be — or just the way we’ve always done it?”
If that question makes you shift in your chair a little, good. It should.
Let’s be honest — journal entry testing has long been one of the more stale, checkbox-driven parts of the audit. Fraud risks and business practices have evolved. And SAS 99 is here to stay. Yet, so many auditors are still applying testing criteria that have never been challenged or even address the modern-day risks of management override.
Let’s break this down.
Too often, audit teams fall back on familiar, SALY (same as last year) selections:
These are fine as starting points. But if your selections haven’t evolved since dial-up internet was a thing, your audit risk assessment is stale — and potentially missing the mark.
Here’s the brutal truth:
🧨 Fraud and management override doesn’t always look like it did in 1990.
💻 Transactions are faster & posted continuously. Systems & work environments are more complex.
📉 Risk is dynamic. And requires professional judgement. Your approach should be too.
SAS 99 still requires us to address the risk of material misstatement due to fraud. That hasn’t changed. What has changed is the world around it.
Today’s auditors need to rethink journal entry testing through the lens of:
It’s no longer enough to pull “weekend” entries or those that have the word "fraud" in the descirption and hope for the best.
You should be asking:
A 2025-ready approach to journal entry testing includes:
Use rules that evolve with the client’s operations. Examples can include:
Consider the actual business risks, account designations, and transaction frequency. A seemingly “normal” entry is suspicious if it’s not in line with your understanding of the business
Use automation and intelligent audit platforms to scan every entry, not just a sample. Risk-based filtering on a verifiable, complete population beats random picks any day. And saves you from peer-review findings.
We’re not saying throw out the standards. On the contrary. GAAS and SAS 99 still form the foundation of good audit practice. But they were never meant to freeze you in time.
Auditor judgment matters. So does relevance. If your firm’s JE testing methodology hasn’t changed in 10 years — it’s time.
Remember:
The goal isn’t to check a box. The goal is to address what matters. And retain evidence of having done it. If it's not documented, it's not done!
SAS 99 requires auditors' professional judgement to be applied. Not a prescriptive set of rigid entry testing criteria.
Audit firms that embrace smarter, tech-forward journal entry testing procedures are:
Those that don’t?
Well — they're still selecting the entries booked on Saturdays like it’s a playlist from the ‘90s. People work remotely on laptops now and across all times of the day - you'd expect to see entries booked on weekends.
Don't be SALY. Do better. Click HERE to get started. And audit like it’s 2025.
