Authorisation and review of journals

When internal controls have been bypassed and a fraud has been committed, the guilty party will often attempt to cover their tracks. A typical method of concealment is to use journal postings.

This is particularly relevant for not for profit entities, as the volume of journals is often higher than in corporate entities due to fund accounting. Accordingly, controls in place over journal entries are of paramount importance and the significance of regular review of journal entries should not be underestimated.

There should be a clear policy in place and all members of the finance team should be aware of their responsibilities. Only employees who need to post journals should be authorised on the accounts system to do so, and depending on the size of the team, employees should only be able to post journals to the sections of the accounts for which they are responsible.

Furthermore, there should be a journal approval process which could consist of the journal being prepared by one member of the team which, together with the supporting documentation for the journal, is passed to a reviewer to be authorised before the journal is posted by another member of the team.

Most accounting packages facilitate the set up of automated journals for standard monthly entries such as depreciation charges and the reversal of certain accruals and prepayments. This may help to cut down the possibility of human error and therefore may reduce the risk of misstatement in the accounts.

As part of the month-end process, there should be a review of journals posted in the month, in particular reviewing journals posted to unusual account codes or for unusual amounts. Particular attention should be paid to round sum amounts. Sample testing of entries is also encouraged.

The preparation of monthly management accounts is invaluable as a control tool and comparing actual to budget figures could help to uncover hidden journals. However this should be supplemented with a strong control system around journals too, including the setting up of automated journals.