Full-population journal-entry analytics after a mid-year ERP migration

The principle. Analytics are only as good as the data. The auditor must obtain evidence about the completeness and accuracy of the information produced by the entity before using it as audit evidence (ISA 500; ISA 330). "The extract came from the ERP" is not evidence.

Problems specific to this file.

1. The pre-migration population exists only as PDF printouts and a CSV produced by a departing employee with no record count, no hash and no control totals – the two properties that would let you prove nothing was dropped or added.
2. PDFs are unsuitable for full-population analytics: they cannot be re-performed, filtered or tied to a line count without re-keying, which introduces its own error.
3. A mid-year system change means the 1.4 million lines are not a homogeneous population: two systems, two chart-of-accounts mappings, two posting logics.

Procedures.

• Reconcile the CSV totals and record counts, month by month January to June, to the printed general ledger and to the trial balance; reconcile the trial balance to the statutory financial statements and to the prior year's audited closing balances.
• Obtain the migration reconciliation: opening balances in the new ERP versus closing balances in the legacy system, at account level, signed off by the preparer and reviewer.
• Test for gaps in document numbering and for duplicated document numbers across the cut-over; check that no posting appears in both systems.
• Re-run the extraction with an IT person present, generate a hash of the file and record the record count in the working papers; document the query, its parameters and the extract date.
• Split the year into pre- and post-migration populations and run the analytics separately on each, with a separate test for the migration postings themselves.
• Obtain a written representation on the completeness of the data and the archives – corroborative only, not a substitute.

If completeness cannot be established, do not run the analytics and call it evidence; fall back to substantive tests of details and consider the effect on the risk assessment, including whether the untested period creates a scope limitation.

The population. 1.4 million lines, split pre- and post-migration. Set a scoping threshold: entries above CZK 500,000 individually, plus all entries to the accounts identified as significant risks (revenue, cost of sales, inventory, rebates and supplier settlement accounts), because most fraudulent entries are small and manual.

Tests and what they indicate.

1. Manual entries to unusual accounts – user ID, source "manual", description containing reclass, correction, adjust, accrual, round, or blank. Indicates top-side adjustments outside the normal process.
2. Entries posted by the superuser profile – the IT administrator should not be posting to the ledger at all. Any posting by that ID is both a control failure and a fraud risk factor.
3. Timing anomalies – postings outside business hours, at weekends, on Czech public holidays, and a spike in the last five days of December and the first five days of January. Indicates cut-off manipulation.
4. Back-dating – entry date materially different from document date or posting date (for example more than five days apart), particularly around the year-end.
5. Round numbers – multiples of CZK 1,000,000 in revenue or cost of sales; rarely arises from real trading activity.
6. Duplicates – same amount, same account, same date, different vendor or document number; cross-reference with the 4% of vendor master records that show duplicate bank accounts, which is the higher-risk direction.
7. Reversals – entries reversed within 30 days, or reversed on 1 January 20X5, indicating temporary window dressing.
8. Analytical outliers – gross margin per store per week against the same week last year and against neighbouring stores; investigate the tails, not the average.
9. The 41,000-to-9,000 drop – compute the number of intercompany postings the legacy system should have generated per month and reconcile; if the difference is not fully explained by the accounting policy change, there is a data or a posting problem.

Discipline. Every flagged item is traced to source documentation, approved and signed off. The analytics select a population; they are not themselves audit evidence (ISA 500). Report the parameters, population size, hits and clearance rate in the file, and use the results to re-scope substantive testing rather than as a conclusion.

Identification. ISA 315 (Revised) requires the auditor to identify risks arising from the use of IT and the general IT controls that support the reliable functioning of automated controls and of the data itself. The relevant deficiencies here are: a single superuser profile held by the administrator responsible for production changes and month-end close (an incompatible combination of access rights); no tested IT general controls in the prior year; and an uncontrolled data migration.

Effect on reliance. With these deficiencies the auditor cannot place reliance on automated controls or on system-generated reports for the post-migration period. The response under ISA 330 is to shift to substantive procedures: tests of details over the significant transaction streams, larger samples or full-population testing over the periods concerned, and direct evidence of the balances rather than evidence that the system processed them correctly. For a retailer with 1.4 million lines, this means the analytics in Task 2 become the primary procedure rather than a supplement, backed by store-level counts and supplier confirmations.

Reporting. The deficiencies are a significant deficiency in internal control to be communicated in writing to those charged with governance under ISA 265, describing the risk (a single individual can initiate, change and conceal a posting) and a practical recommendation (split the superuser role, logging and independent review of privileged activity, tested change management).

Fraud risk (ISA 240). Management override is a presumed risk on every audit; a privileged user who can post and delete entries without detection elevates it. Record it as a fraud risk factor, focus the journal-entry tests on that user's activity, review the system logs if they exist and check whether they were tampered with, and consider whether the combination of an uncontrolled migration and privileged access could have concealed a misstatement rather than merely permitted one.

Effect on the opinion. A control deficiency alone does not modify the opinion. It becomes an issue only if the auditor cannot obtain sufficient appropriate evidence, in which case ISA 705 applies. The temptation to describe the deficiencies and issue an unmodified report without adjusting the nature and extent of substantive work is the error to avoid.