Management Override of Controls: The Required Procedures

Management can override controls that otherwise look effective: post a journal entry nobody reviews, push an estimate in the direction it wants, or book a transaction with no business reason. Because this can happen in any entity, the auditing standards treat the risk of management override as a significant risk on every audit, whatever your risk assessment says.

The standards are AU-C 240 (private companies), ISA 240 and CAS 240, and AS 2401 for public companies. All of them require the same three responses.

1. Test journal entries and other adjustments

Test journal entries recorded in the general ledger and other adjustments made in preparing the financial statements. This means:

• Understand the process: who can post entries, how they are approved, and how top-side and consolidation entries are made.
• Ask people involved in financial reporting about unusual entries.
• Select entries to test, focusing on the end of the period and on characteristics that suggest fraud.
• Test them against support and approvals.

Common selection criteria:

Criterion	Why it matters
Posted after year end or during the close	Adjustments are where results get changed
Posted by unexpected users, or by senior management	People who can override controls
Round numbers, or amounts ending in 000	Estimates and made-up figures tend to be round
Posted on weekends or holidays	Outside normal routines
Unusual or seldom-used accounts	Less likely to be noticed
Little or no description	Harder to question
Entries to revenue, cash or reserves with odd pairings	Sales credited against something other than receivables or cash

Start from a complete population: agree the journal entry listing to the trial balance before you select from it.

2. Review accounting estimates for bias

Look at the judgments behind significant estimates, such as allowances, inventory provisions, impairments and warranty reserves. Two parts:

• Look back at last year's estimates and how they turned out. A pattern of results always landing on one side is a sign of bias.
• Look across this year's estimates. Each one may be reasonable on its own while all of them lean the same way.

3. Understand significant unusual transactions

For significant transactions outside the normal course of business, or that otherwise look unusual, understand the business reason. If the reason does not make sense, or the transaction seems designed to produce an accounting result, treat it as a fraud risk.

Documenting it

Document the population, how you confirmed it was complete, the criteria you used and why, the entries selected, what you found, and how each conclusion was reached. Our guide to audit working papers covers what reviewers look for.

Where Warp Accounting fits

Journal entry testing is one of the procedures Warp Accounting runs. It ties the journal population to the trial balance, applies the firm's criteria to every entry, and returns the entries each criterion flagged in a working paper, ready for the firm to vouch. See journal entry testing, and our guides to substantive testing and audit sampling.