Manual journal entries are essential to a reliable close. They capture accruals, reclassifications, estimates, corrections and transactions that do not flow automatically from subledgers. But every manual posting is also a point where an error, an unsupported assumption or an unauthorized adjustment can enter the general ledger.
The risk is not limited to large, unusual entries at year-end. Routine journals can be misclassified, posted to the wrong entity or period, duplicated, or reversed incorrectly. A strong control framework therefore governs the full journal lifecycle: who can prepare an entry, what evidence is required, who approves it, who can post it, and how the resulting ledger activity is monitored.
For US and Canadian controllers, the objective is practical: maintain a complete audit trail without making the close so cumbersome that teams resort to workarounds.
Why journal entries deserve focused attention
The PCAOB’s AS 2401, Consideration of Fraud in a Financial Statement Audit, addresses the risk of management override and explains why auditors examine journal entries and other adjustments. It highlights characteristics that can warrant attention, including entries posted by people who do not normally prepare journals, entries to unusual accounts, period-end or post-closing entries with limited explanations, round-number amounts, and adjustments outside normal processing.
AS 2401 is an auditing standard for auditors of issuers, not a universal company policy template. Still, its risk indicators are useful for controllers designing and monitoring internal controls. The same discipline is relevant to private companies and Canadian reporting entities, with the control design scaled to the organization’s size, systems and risk profile.
10 controls for a defensible journal-entry process
1. Define journal types and permitted purposes
Separate recurring journals, accruals, allocations, reclassifications, corrections, tax-related entries, intercompany journals and top-side consolidation adjustments. Give each journal type a clear purpose, owner, required fields and approval path. Avoid generic journal names such as “Miscellaneous” when a more specific classification is possible.
In SAP or another ERP, use document types, journal categories or journal names consistently. Restrict sensitive types to authorized roles and establish rules for which company codes, ledger accounts or dimensions may be used. This makes reporting and exception analysis more meaningful.
2. Separate preparation, approval and posting
The person who prepares a manual journal should not approve their own entry. Where practical, the approver should also be independent of the person who posts it. If staffing is limited, document a compensating review by a controller or finance leader who examines the complete journal population or a risk-based selection promptly after posting.
Review role assignments periodically, especially after reorganizations, transfers and departures. Do not rely on job titles alone: validate actual system permissions and workflow routing.
3. Set approval thresholds based on risk—not only dollars
Use approval limits, but supplement amount thresholds with qualitative triggers. A relatively small journal to revenue, reserves, executive compensation, related parties or a rarely used account may deserve additional scrutiny. Require escalation for entries that affect covenant calculations, management compensation, key performance indicators, or significant estimates.
Thresholds should consider gross journal value and the nature of the accounts affected. Splitting one adjustment into several smaller journals to avoid approval limits should be prohibited and monitored.
4. Require a complete journal support package
Every nonroutine journal should explain the business purpose, accounting rationale, calculation, source data, relevant period, affected entity and accounts, and expected reversal or settlement. Attach contracts, schedules, reconciliations, system reports or other evidence that allows an independent reviewer to reproduce the conclusion.
A description such as “month-end adjustment” is not adequate support. A better description states what changed, why it belongs in the period, how the amount was calculated, and who owns follow-up.
5. Validate accounting dimensions and period
Build preventive checks for company code, ledger, account, department, cost center, profit center, currency, tax code where relevant, and posting period. Use permitted-value lists and default values carefully; defaults reduce keying errors but can also propagate incorrect coding if they are not reviewed.
For multi-entity groups, confirm that the journal is recorded in the correct legal entity and that intercompany counterparties and currencies are consistent. Block postings to closed periods except through a controlled reopening process.
6. Control recurring and automated journals
Recurring journals save time, but their templates and assumptions can become stale. Assign an owner, document the calculation basis, set an expiry or review date, and periodically confirm that the amount, accounts, dimensions and reversal logic remain appropriate. Changes to templates should be approved and logged.
For interfaces, spreadsheets, bots and other automated uploads, control both the source file and the posting process. Reconcile record counts and totals from the approved input to the posted ledger, investigate rejected records, and prevent duplicate uploads.
7. Use workflow approval before posting where possible
Where the ERP supports it, route journals for approval before they affect the ledger. SAP’s documentation on General Journal Entry Verification describes configurable workflow conditions such as company code, account group, amount and journal-entry type. It also describes a four-eyes process in which the requester is excluded from verifying their own journal.
Configure workflow conditions to reflect real risk. Test rejection, resubmission, delegation, absence coverage and failed-posting scenarios. A workflow that routes every entry to the same approver regardless of risk may create a queue without providing meaningful review.
8. Restrict direct and privileged posting access
Limit direct posting rights to roles that genuinely need them. Separate journal preparation from sensitive configuration, user administration and changes to approval rules. Emergency or privileged access should be time-bound, approved, logged and independently reviewed after use.
Pay particular attention to interfaces and technical users. A service account that can post journals should have a defined owner, restricted scope, protected credentials and monitored activity. Review access conflicts with your ERP security or segregation-of-duties process.
9. Monitor exceptions across the full period
Run periodic analytics over the complete journal population, not just a sample chosen by the preparer. Useful filters include weekend or holiday postings, entries near period close, post-close entries, unusual users, rarely used accounts, round amounts, missing descriptions, duplicate references, manual entries to sensitive accounts, and entries posted after approval or outside workflow.
Investigate exceptions rather than treating a report as evidence of control performance. Record the reason, supporting evidence, reviewer, resolution and whether the issue indicates a broader access or process weakness. PCAOB AS 2401 also emphasizes that journal-entry risk may arise throughout the year, not only at period-end.
10. Reconcile approvals to what actually posted
Approval of a draft is not proof that the approved version reached the ledger unchanged. Match the approved journal to the posted document using a unique ID or workflow reference. Compare amount, accounts, dimensions, entity, currency and posting date. Any edit after approval should trigger reapproval.
For rejected, failed, reversed or deleted entries, retain an audit trail showing the status and final disposition. Review manual journals posted after the close calendar deadline and all entries posted to reopened periods.
Practical controller monitoring dashboard
A monthly dashboard can make the control environment visible without requiring reviewers to inspect every journal manually.
| Metric | What it reveals | Suggested follow-up |
|---|---|---|
| Manual journals by preparer and approver | Concentration, unusual activity and potential conflicts | Compare with role assignments and staffing patterns |
| Post-close and late-period journals | Late adjustments and potential cutoff or override risk | Review support, approval timing and financial statement impact |
| Journals to sensitive or rarely used accounts | Unexpected classification or unusual adjustments | Validate rationale, account mapping and business purpose |
| Entries rejected, edited or resubmitted | Workflow quality and recurring preparation errors | Identify root causes and training needs |
| Approved-to-posted mismatches | Changes between review and ledger posting | Investigate immediately and require reapproval where needed |
Set thresholds based on the organization’s size and risk. Track trends over time and assign an owner and due date to every material exception.
Implementation priorities for SAP S/4HANA and other ERPs
Start with a journal inventory: identify manual entry channels, document types, posting roles, interfaces, spreadsheets, consolidation tools and local workarounds. Map each channel to its preparer, approver, posting authority, evidence location and monitoring report.
In SAP S/4HANA, assess whether General Journal Entry Verification and Flexible Workflow can support the required approval conditions and segregation. SAP configuration and available apps vary by product edition and release, so validate the design in your own environment rather than assuming every feature is available in the same way. For other platforms, use equivalent journal workflow, audit history and access-control capabilities.
Then pilot the revised process with a small group of journal types. Test normal, rejected, changed, emergency and failed-posting scenarios before rollout. Keep a controlled exception path for urgent entries, but require retrospective independent review and evidence.
Controller’s month-end checklist
- Confirm journal roles and approval limits remain appropriate.
- Review all late, post-close and privileged-user postings.
- Investigate unusual accounts, round amounts and entries by atypical users.
- Verify that approved journal details match posted ledger documents.
- Review recurring journal templates, reversals and expired items.
- Reconcile upload totals and rejected interface records to the ledger.
- Document exceptions, remediation owners and completion evidence.
Conclusion
Effective journal-entry governance is not simply a requirement to obtain a second signature. It is a connected set of preventive, detective and corrective controls covering access, evidence, approval, posting integrity and ongoing monitoring. Controllers who design the process around risk—and use ERP workflow and analytics intelligently—can reduce management-override exposure while keeping the close efficient and auditable.
Disclaimer: This article is for general informational purposes only and is not accounting, audit, legal or systems-implementation advice. Apply the accounting framework, regulatory requirements and control design appropriate to your organization and obtain professional advice where needed.
