How do I ensure my unusual journal entry testing with audit analytics software is compliant with audit documentation standards?

To ensure your unusual journal entry testing using audit analytics software is compliant with audit documentation standards, focus on audit trail, reproducibility, and reviewability. In practice, your documentation should let another experienced auditor understand what you did, why you did it, what data you used, how the software identified entries, and what conclusions you reached.

Here’s a solid checklist:

1) Document the objective and criteria

Record:

• The audit assertion or risk addressed
• Why unusual journal entries were tested
• The specific criteria used to define “unusual”
  • e.g., manual entries
  • posted at period-end
  • round-dollar amounts
  • entries by privileged users
  • unusual accounts or combinations
  • entries above a threshold

2) Capture the data source and completeness

Include:

• Source system or ledger extract name
• Period covered
• Date and time of extraction
• Who extracted the data
• File format and system parameters
• Evidence the population is complete and accurate
  • reconciliations to trial balance or GL totals
  • record counts
  • hash totals or control totals if used

3) Retain the analytics logic

Your documentation should show:

• The software used and version
• Filters, queries, scripts, rules, or model parameters
• Any exclusions and why they were made
• Thresholds or scoring logic
• If using AI/ML or anomaly detection, the feature settings and selection criteria

Best practice: save the exact query, script, workflow, or screen configuration used to identify entries.

4) Make the results reproducible

Keep:

• Output files, exception lists, and screenshots where helpful
• Date/time stamped results
• Any re-runs and why they were needed
• Clear linkage from output back to source transactions

5) Explain your audit response

For each flagged item, document:

• Why it was considered unusual
• Follow-up performed
• Supporting evidence obtained
• Whether it was valid, unsupported, or indicative of error/fraud
• Final conclusion on the sample or population

6) Show review and supervision

Audit documentation standards typically require evidence of review:

• Sign-off by the preparer and reviewer
• Dates of preparation and review
• Notes on review points cleared
• Evidence of supervision where applicable

7) Keep version control and integrity

Maintain:

• Final data extract and working file versions
• Change logs if data or scripts were modified
• Read-only or controlled storage if possible
• Protection against post-hoc edits to outputs

8) Align with your firm’s methodology and professional standards

Make sure your documentation supports requirements in your applicable framework, such as:

• ISA 230 / PCAOB / local standards
• Firm templates and retention policies
• Requirements for sufficient appropriate audit evidence

9) If using automated or AI-assisted analytics, document governance

If the software uses automated anomaly detection, document:

• How the tool works at a high level
• Validation of the tool or model
• Limitations and known false positives
• Human review steps
• Any independence or reliability considerations

A good documentation package usually includes

• Planning memo or test objective
• Data extraction memo
• Population completeness check
• Query/script archive
• Exception report
• Investigation notes for each exception
• Conclusion memo
• Reviewer sign-off

Practical rule of thumb

Ask: Could another experienced auditor reperform this test and reach a similar conclusion from my file alone?
If not, add more detail.

If you want, I can give you:

1. a sample workpaper template for unusual journal entry testing, or
2. a compliance checklist mapped to ISA/PCAOB-style documentation requirements.