Journal Entry Analytics at a 42-Entity Retail Group
Your internal audit team at a 42-entity retail group has built a journal entry anomaly model over 12 million general ledger lines a year. The model combines Benford's law deviations, round-number amounts, postings outside business hours, and entries by users without standard posting rights. It flags 4,800 entries, 0.04% of the population. Historically, 3% of flags have led to a confirmed finding. One entity, Northport, accounts for 1,900 of the flags because its legacy system posts depreciation as manual month-end journals. The audit committee has asked for a 'data-driven fraud opinion'. You have 600 hours of testing capacity, against an estimated 14,000 hours to investigate every flag. Group revenue is £1.2bn and audit materiality is £6m. The largest single flagged entry is £3.4m, a reclassification between two cost lines posted at 23:40 by a user in the finance shared services centre.
1. Design a risk-based testing plan for the 4,800 flags and explain the prioritisation logic.
Read the worked answer
The population is not homogeneous, so do not sample it randomly. Rank flags by their ability to cause a material misstatement and by fraud risk indicators.
Tier 1 (investigate first, individually): entries that combine multiple red flags, are close to or above materiality, or touch sensitive accounts. The £3.4m reclassification at 23:40 between two cost lines sits here: it is 57% of materiality, it is a top-side-type entry by a shared services user, and reclassifications between cost lines can move gross margin, segment results or covenant metrics without changing profit. Pull the support, the approver, the reversal and the business rationale.
Tier 2: entries affecting revenue cut-off, inventory and provisions around period ends; entries posted by senior finance staff or users with privileged access; unexplained reversals and round-number journals in the last five days of the period; and entities with weak entity-level controls or recent turnover in the finance team.
Tier 3: entries with a single red flag in a low-risk account - test by stratified sample, not individually.
Allocate the 600 hours explicitly: roughly 250 hours on Tier 1 and 2 investigations, 150 on sampling Tier 3, 100 on rule validation and false-positive analysis, 100 on reporting. Publish the coverage achieved (which entities and account balances were fully covered) because coverage - not hit rate - is what the audit committee needs to understand the assurance obtained. Benford analysis is a screening tool, not evidence; a deviation is a question, not a finding.
2. What do you do about Northport's 1,900 flags, and how do you avoid both wasted effort and the risk of masking real anomalies?
Read the worked answer
The Northport cluster is a structural false positive: a known system behaviour (manual month-end depreciation from a legacy system) that repeats predictably. Investigating 1,900 entries of this type would consume most of the budget for no assurance value, and leaving them in the queue would make the model look worse than it is and erode stakeholder trust.
Handle it in three steps. Diagnose: confirm from the ERP configuration and a walkthrough that the flagged pattern is genuinely system-driven depreciation, not discretionary posting. Suppress with a documented rule: exclude journals generated by that posting routine, identified by source code, user ID and timing pattern, and record the rule, its rationale and the date it was applied - suppression must be reproducible and auditable, not an informal filter. Validate the suppression: sample 30–40 of the excluded entries and test them, and run the model with the rule switched off for one quarter to confirm no genuine anomalies are hidden inside the pattern.
Separately, address the root cause: a legacy system generating manual journals at month-end is itself a control finding worth reporting, because it means a large volume of depreciation is outside the automated control environment and depends on a single routine.
The wider lesson is that a model is only as good as its false-positive discipline. Track precision (confirmed findings ÷ flags) by rule and by entity each quarter, retune thresholds, and document that a low hit rate is a tuning issue, not a reason to reduce the scope of testing.
3. How would you respond to the audit committee's request for a 'data-driven fraud opinion', and how would you report the results and measure the value of the work?
Read the worked answer
The request has to be reframed honestly. Internal audit can give assurance on the design and operating effectiveness of fraud risk management controls, and can report what the analytics found. It cannot give an opinion on whether fraud occurred or on the financial statements: an audit gives reasonable, not absolute, assurance, and fraud is concealed by nature. Analytics over the general ledger detects a subset of manipulation - it will not see collusion, off-book arrangements or override that looks normal in the data. Say that plainly, in writing, and describe what the work does and does not cover.
The report should contain: the population and coverage (12 million lines, 42 entities, which were fully covered and which sampled); the model and its known limitations, including the Northport suppression rule; the number of flags investigated and the findings, with each quantified; control deficiencies identified, with owners and dates; and an explicit statement of residual risk - for example, that the 600-hour programme covered areas representing a stated percentage of revenue and that further work is required in the entities not tested.
Measure value on four dimensions, not just findings: coverage (proportion of material balances tested); precision (hit rate by rule, against the 3% baseline, showing whether tuning worked); efficiency (cost per confirmed finding versus manual testing, and whether the 600 hours displaced more expensive substantive work); and outcomes (control fixes implemented, recoveries, process changes). A programme that finds nothing but demonstrably covers the risky population and forces two control remediations has delivered value; one that reports 'no fraud found' from a biased model has not.