Eight manual journal entries and a threshold that was designed to be avoided
Reviewing manual journal entries at a beneficiary of EU funds, you extract the December entries below. Under the beneficiary's financial procedures, a manual entry above €25,000 requires two approvers; at or below €25,000, one approver suffices. All entries are two-line, in euros, and were posted by the named user and approved as shown.
JE-101: €24,900, user m.klein, 18:41, approver A. Braun. JE-102: €24,800, user m.klein, 18:44, approver A. Braun. JE-103: €24,950, user m.klein, 18:47, approver A. Braun. JE-104: €9,700, user s.dubois, 11:02, approver C. Meier. JE-105: €24,880, user j.nowak, 21:15, approver J. Nowak. JE-106: €24,900, user j.nowak, 21:18, approver J. Nowak. JE-107: €12,300, user s.dubois, 09:12, approver C. Meier. JE-108: €4,600, user a.rossi, 15:33, approver C. Meier.
No supporting documents accompanied the extract; the beneficiary says the entries relate to 'year-end reclassifications'.
1. Infer the control rule that the entries reveal, identify which entries are anomalous and why, and quantify the exposure.
Read the worked answer
The rule is a €25,000 per-entry approval threshold. The anomalies are the entries that sit immediately below it - three at €24,800 to €24,950, within €200 of the threshold - and the two at €24,880 and €24,900. That is not a random distribution: a genuine €150,000 transaction would not naturally come out in three pieces of €24,900.
The pattern is grouping by user and by time. JE-101 to JE-103 total €74,650, posted by one user within six minutes, each approved once by A. Braun. Had they been booked as one entry, two approvers would have been required and A. Braun alone could not have released it. JE-105 and JE-106 total €49,780, posted by j.nowak within three minutes and approved by J. Nowak - the same person, which breaches segregation of duties irrespective of the amount, and would have required a second approver had the entries been combined.
JE-104, JE-107 and JE-108 are unremarkable: they are comfortably below the threshold, posted at ordinary times by a different user, with an independent approver. They serve as the control group showing what normal entries look like. Total exposure in the two suspect clusters: €124,430.
2. Design the follow-up work. What evidence would you obtain, and what conclusions can and cannot be drawn at this stage?
Read the worked answer
Start with data analytics over the full journal, not the extract: recompute, for every user and posting day, the sum of entries each below €25,000, and flag any day where at least two such entries combine above €25,000. Add parameters for posting outside normal hours, approver equal to user, and round-number amounts just under the limit. Then reconcile the flagged entries to the general ledger and to supplier invoices.
Specific evidence: the underlying invoices or contracts for JE-101 to JE-103 - were three genuine invoices received, or was one invoice split? A written statement from A. Braun on whether she understood she was approving €74,650. For JE-105 and JE-106, the identity and role of J. Nowak in the accounting system and whether the self-approval was technically possible by design or by a rights misconfiguration.
What can be concluded now: the entries circumvent or defeat the two-approver control, and segregation of duties was breached. What cannot be concluded: that funds were misappropriated or that fraud occurred. Keep those separate in the report, preserve the extracts and the audit trail, and refer the matter to the head of unit for a decision on an OLAF referral if the supporting documents turn out to be absent or altered.
3. The beneficiary replaces the €25,000 threshold with a €10,000 threshold and asks whether the problem is now solved. What is your assessment?
Read the worked answer
Lowering the threshold does not solve the problem; it moves it. The entries at €24,900 would simply become entries at €9,900. The vulnerability is not the number but the absence of aggregation logic: a control that tests each line in isolation can always be defeated by splitting. The fix is to make the control test the transaction, not the accounting line.
Practical requirements: aggregate entries by supplier, by user and by day before applying the approval rule; block the posting user from approving their own entry at system level rather than by instruction; require a second approver at the end of any day on which a user's combined manual entries exceed the threshold; and log and review entries posted outside working hours. Add a periodic analytical review of the manual journal by someone independent of the posting process.
Finally, a rule change is a change to the description of the management and control system, so it must be documented and communicated, and the beneficiary should confirm it has applied the new rule to the December entries already flagged. A threshold reduced without aggregation tests and system-enforced segregation gives the appearance of correction while leaving the exposure intact.