Manual Journals: is your lack of control an issue?
By Clinton Jones on Mar 21, 2014
Manual journal entries are considered high-risk transactions for SAP finance professionals for a number of reasons, including their susceptibility to fraud and overriding of controls. So, with all of the concerns here are some of the important aspects to consider to ensure you have full control over your journal entry process.
At a recent event, experts from Price Waterhouse Coopers (PWC) highlighted that there are a number of ways to implement mitigating controls to handle manual journals. The experts pointed out it’s relatively easy to use these entries to manipulate financial records. Material misstatements of financial statements due to fraud often involve manipulation of the financial reporting process, such as recording inappropriate or unauthorized journal entries or making adjustments to amounts reported in the financial statements but not reflected in formal journal entries (e.g., those resulting from valid consolidation of financial adjustments, reporting aggregation and reclassification).
A short Manual Journal Entries YouTube video by controls vendor Oversight Systems presents some examples of how manual journals can be used in a manipulative way. In the case of WorldCom fraud, for example, reallocating expense items, such as capital items, was found to materially change the view of how the business was valued and performing.
What is your control failure risk reading?
To ensure integrity and accountability, several standards are expected to be followed with regard to journal entries, including SAS99, which requires external auditors to test entry controls. The Sarbanes Oxley framework also requires management to assert that they have internal controls over key processes, including manual journals.
In the world of accounting and financial reporting compliance, there are also concepts of “control failure risk (CFR)” and “Internal Control over Financial Reporting (ICFR) risk.”
CFR is relevant in the way it is applied at the individual control level, with consistency of the process being a key consideration. For example, auditors may ask the business, “How difficult is it to execute this control properly each and every time?” Another key focus is the sign-off, defined as the act of getting the highest relevant approval for the application of the manual journal to the financial records (i.e., manual journal approval workflow).
Once the account misstatement CFR has been defined, management and auditors can make conclusions about the ICFR risk, which is a key risk concept used in evidence decisions. ICFR risk can also determine how much scrutiny your records should be under and how long it would take the auditors to examine your manual journal entry processes.
Some PWC customers at the event revealed that their volumes could be as high as tens of thousands of manual journals every month. Thus, manual journals are clearly an area where controls need to be present and maintained consistently.
Automation is the way to go
One of the ways businesses can reduce CFR is through automation, because you can control aspects of manual journal processing, and decrease the audit duration, potentially generating savings. This is because automated IT-based application controls need smaller audit sample sizes (usually one, as opposed to as many as 30 for manual controls).
In some instances where direct manual journal entry is blocked altogether, the process may not have to be tested directly at all. If certain IT change management controls are demonstrated to be effective, auditor benchmarking could allow fully automated IT application controls to be excluded from testing.
Many companies rely heavily on manual interfaces between systems, often creating spreadsheets for downloading and uploading manual journal entries. By applying automated Winshuttle-based controls to the process, organizations can reap the benefits of having a reliable audit trail for each step, documenting who initiated the process, who signed off on request and who physically made the entries. In addition, the spreadsheet used to initiate the manual journal can be attached to the document posted in your SAP ERP system, providing further audit evidence.
Many companies process thousands of manual journal entries each month. By automating these entries, both labor and compliance assessment costs may be dramatically reduced. In addition, the reliability of financial statements is likely to improve.
You can read more in the following articles:
About the author
The Winshuttle blog is written by professional thought leaders who are dedicated to providing content on a variety of topics, including industry news, best practices, software updates, continued education, tips and techniques, and much more.
Questions or comments about this article?
Tweet @Winshuttle to continue the conversation!