Most finance teams approve journal entries one at a time, during a busy close. What rarely happens is a review of the whole month’s population afterwards: was every manual entry approved by someone other than the preparer, before it posted, and which entries look like the ones auditors are trained to pick out? This free journal entry review and approval checklist gives controllers, finance managers and internal control teams a monthly process for exactly that. It extracts and proves the complete journal listing, checks the separation between preparer and approver, reviews support, scans for fraud risk indicators and ends in a controller sign-off. Conditional phases cover top-side and post-close entries when there are any, and who can post journals at each quarter-end.
Journal entries are where management override of controls happens. An invoice has to get past purchasing, but a manual journal can move an amount between accounts with nothing more than a description. That is why auditors test journal entries on every audit, whatever they think of your controls, and why the journal approval is one of the first controls they ask to see.
The control rests on separating two roles. The preparer builds the entry and is accountable for getting it right. The approver is accountable for challenging it. When the same person does both, or the approver clicks “approve” on a batch without opening the support, the entry has been recorded but not controlled. This checklist does not replace approval inside your accounting system. It checks, once a month, that the approval actually worked for every manual entry in the period.
Accountable for: the right accounts, amount and period, a description that explains why, and support attached before the entry is submitted.
Must not: approve or post their own entry, or split an entry to stay under an approval limit.
Accountable for: reading the support, questioning the judgement behind estimates, and approving only within their own authority limit.
Must not: approve entries they prepared, approve after the entry has already posted, or approve a batch without opening it.
Five phases run every month, from extracting the journal listing to scanning it for risk indicators, and the controller signs off in the last one. Phases 5 and 6 appear only in the periods that need them.
A review of a filtered report proves nothing about the entries the filter left out. Start from the complete listing.
Auditors apply the same kind of filters, so run them first.
Shown only when Phase 1 records top-side or post-close entries. These bypass the subledgers, so they get individual review.
Shown at quarter-end and year-end. Segregation of duties in the approval flow depends on who can do what in the system.
Not every journal needs the same scrutiny. System-generated entries from a well-controlled subledger carry little risk; a top-side adjustment made the night before the board pack goes out carries a lot. Tagging each entry by type in Phase 1 lets the reviewer spend time where the risk is.
| Journal type | Examples | Main risk | Review approach |
|---|---|---|---|
| System-generated | Sales and purchase postings, payroll interface, depreciation run | Interface or configuration errors; someone editing the amounts passed to the ledger | Reconcile the subledger to the ledger; confirm nobody edited the interface |
| Recurring (standard) | Rent, prepayment release, loan interest, management charges | A template left running after the contract changed or ended | Review the template once a year and investigate any change in amount |
| Non-recurring manual | Accruals, provisions, reclassifications, corrections | Judgement and estimates; entries made to reach a target | Individual approval with support; recalculate above the threshold |
| Reversing | Month-end accruals reversed on day one of the next period | Reversal forgotten, or made twice | Match every reversing entry to its reversal |
| Top-side (consolidation) | Eliminations and adjustments made at group level only | Bypasses entity ledgers and their controls | Controller approval of each one; push down or track |
| Post-close | Entries after the period was locked or the draft accounts produced | Changes numbers that were already reviewed or circulated | Authorised reopening only; individual review of every entry |
What the auditing standards look for. PCAOB AS 2401 (paragraphs .58 to .62), which applies to audits of US public companies, and ISA 240, used in most other countries, both require auditors to test journal entries and other adjustments for evidence of fraud. They describe the characteristics of inappropriate entries in almost the same words: entries to unrelated, unusual or seldom-used accounts; entries by people who don’t usually make journal entries; entries at the end of the period or after it with little or no explanation; entries without account numbers; and entries with round numbers or a consistent ending number. Both standards also single out non-standard entries made outside the normal course of business, and ISA 240 warns that some adjustments, such as consolidating adjustments and reclassifications, never pass through a journal at all. Phase 4 turns those characteristics into filters you can run yourself. ISA 240 has been revised, and the new version applies to audits of periods beginning on or after 15 December 2026, so expect your auditors’ approach to journal testing to be updated for those years.
When the team is too small to separate duties. The COSO internal control framework expects segregation of duties to be built into control activities, and where it is not practical, management selects alternative controls instead. In a two-person finance team that usually means someone outside the team, such as the owner or the external accountant, reviews the full journal listing every month. Assign the Reviewer role to that person.
The controller is chosen at the start of each run, and the sign-off task needs an Approved or Not approved answer before the checklist can finish. The approval step records who approved and when, so the evidence of review is part of the process rather than an initial on a printout.
Two questions in Phase 1 decide the shape of the month. Top-side and post-close entries get their own phase only when there are some, and the journal access review appears whenever Phase 1 records a quarter-end or year-end close.
The journal listing, the filter results and the support for every selected entry are attached to the tasks they relate to, with comments showing how each exception was resolved. When the auditors ask how journals are controlled, you hand them twelve completed checklists.
Journal review is one control inside the monthly close. The Month-End Close Checklist covers posting the accruals, prepayments and other adjusting entries that this checklist reviews, and our month-end close guide lists the standard entries each close needs and which ones should auto-reverse.
Approvals work the same way across finance. See how CheckFlow’s approval software handles authority limits and sign-offs, and how the Invoice Approval Workflow Checklist applies the same separation to supplier invoices.
It is a check that the journal entries posted to a period are complete, properly supported, correctly recorded and approved by someone other than the person who prepared them. Individual entries are approved as they are posted; the periodic review looks at the whole population afterwards to confirm the approvals worked and to pick out entries that carry a higher risk of error or fraud.
Someone other than the preparer, with authority for the amount and the accounts involved. Most businesses set an authority matrix: a senior accountant approves routine entries up to a limit, the controller approves larger or unusual ones, and the CFO approves top-side and post-close entries above a higher threshold. Approval should happen before the entry posts, not after.
A top-side entry is an adjustment made at the consolidation or reporting level rather than in an entity’s own ledger, often late in the close. Because it bypasses the subledgers and the controls around them, it is one of the entry types auditors look at most closely. Each one should have a documented reason, controller approval and, where possible, be pushed down to the entity ledger.
Under PCAOB AS 2401 and ISA 240, auditors select entries with characteristics linked to fraud: postings to unusual or seldom-used accounts, entries by people who don’t normally post, entries at or after the period end with little explanation, entries without account numbers, and round or repeated amounts. They focus on period-end entries and consider whether to test throughout the period.
The Month-End Close Checklist is the process of preparing and posting the period’s entries and reconciliations. This checklist is the control over the journals the close produced: it runs after posting has finished, is assigned to a reviewer who did not prepare them, and ends with the controller’s sign-off. Most teams run both every month.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
