Record to Report workflow controls

Controlling access permissions to the system is an important task. It helps ensure that data cannot be accidentally changed by staff members who do not have responsibility for maintaining data, and it reduces the possibility of changes being made for fraudulent purposes.

It's important to check access permissions regularly to confirm they are appropriate, and also when staff move roles within the organization to check that previous access permissions have been removed and are replaced by new ones to ensure that staff do not have access rights to perform tasks that should be undertaken independently.

• Consider staff who are likely to require access to GL master data regularly and ensure they have access that's appropriate to their role and nothing more.
• 'Firefighter / Superuser' access can be granted for solving particular issues, but it should be granted for the minimum period of time possible and revoked after issues are resolved.
• Segregation of duties should be considered when granting access to ensure that staff are not given any system access permissions that would conflict with any other roles they have.
• Many organizations will restrict changes to the General Ledger during a quarter to ensure standardization and consistency of financial information. Changes to general ledger accounts in the last quarter of a financial year are likely to attract additional auditor attention as they could indicate attempts by management to override controls over the reporting of financial information.

It's important to have a separate review to ensure that any changes made are reasonable and accurate, and to reduce the potential for changes being made for fraudulent purposes.

Evidence for workflow can be difficult, ideally the system should be configured so that the approver is recorded and the date and time of their approval can be recorded on an audit trail (see Review of changes to GL master data).

• Smart rules
• Smart events

• How will you identify inappropriate changes? For example, users, timings, particular types of change.
• What will you define as key master data? Some master data changes might not have a significant impact.

• View an audit trail
• Use an Audit History report

See review control test.

The test should focus on how inappropriate changes to master data were identified and followed up.

System reporting configured to show zero values in GL codes. In the Format section of the report, Show zero balance accounts is set appropriately (All, Only with activity, Do not show).

Annotated report with evidence of follow up of unexpected items.

See review control test.

The test should focus on how redundant or obsolete accounts are identified. It might be that this is purely operational. However, if there are important risks that this control addresses, the test should cover them.

See configuration control test.

This is an interface. So, the focus should be on ensuring the critical data for the control is identified and tested for complete and accurate transfer.

Controlling access permissions to the system is an important task. It helps ensure that data cannot be accidentally changed by staff members who do not have responsibility for maintaining data, and it reduces the possibility of changes being made for fraudulent purposes.

It's important to check access permissions regularly to confirm they are appropriate, and also when staff move roles within the organization to check that previous access permissions have been removed and are replaced by new ones to ensure that staff do not have access rights to perform tasks that should be undertaken independently.

• Consider staff who are likely to require access to GL master data regularly and ensure they have access that is appropriate to their role, and nothing more.
• 'Firefighter / superuser' access can be granted for solving particular issues, but it should be granted for the minimum period of time possible, and rescinded after issues are resolved.
• Segregation of duty should be considered when granting access to ensure that staff are not given any system access permissions that would conflict with any other roles they have.

Controlling access permissions to the system is an important task. It helps ensure that data cannot be accidentally changed by staff members who do not have responsibility for maintaining data, and it reduces the possibility of changes being made for fraudulent purposes.

It's important to check access permissions regularly to confirm they are appropriate, and also when staff move roles within the organization to check that previous access permissions have been removed and are replaced by new ones to ensure that staff do not have access rights to perform tasks that should be undertaken independently.

• Consider staff who are likely to require access to project master data regularly and ensure they have access that is appropriate to their role, and nothing more.
• Segregation of duty should be considered when granting access to ensure that staff are not given any system access permissions that would conflict with any other roles they have.

Go to roles or permissions set up page (Company > Admin > Roles or Users > Subscriptions > Permissions) and review and edit existing permissions.

Consider applying user permissions to each individual project record:

Go to Projects > Setup > Configuration. In the Timesheet rules section, select the appropriate setting for User restrictions (Any user, Only users assigned to the project, Only users assigned to the project and task).

• Who will be permitted to approve journal entries?
• Will you ensure that approvers cannot also post journals?
• How will you deal with situations where approvers are absent?
• Can journal preparer select who approves entries, or will this be pre-determined?
• What limits will approvers have?

Ability to require approval set within: General Ledger > Setup > Configuration, and Enable journal entry approvals is selected in the Approval options section.

Individual journal entries' approval can be reviewed within: General Ledger > All > Journal entries, and select Transactions. Next, find the relevant transaction in the list. Select More actions > View at the end of the row. Then select More actions > View audit trail.

Individual journal entries' approval can be reviewed within: General Ledger > All > Journal entries, and select View transactions. Then, find the relevant transaction, select View, select More actions, select View audit trail.

See workflow control test.

Where the Sage Intacct GL Outlier Detection service is used, this can test the effectiveness of manual journal review controls. If outliers are detected, it might indicate that the manual review or approval controls have missed something that they should have picked up. This can be used to refine the review procedures or provide additional training to those performing the controls.

• Will this be defined as a 'mandatory field' style control so that a journal can be posted to any cost center, or other field used for cost coding as long as it exists, or will set groupings of allowable cost centers or other fields used for cost coding be defined for specific journal types?
• How will you identify where a posting has been made to an 'allowable' cost center or other fields used for cost coding, but is posted to the wrong area?

Require dimensions for expense accounts: General Ledger > All tab > General Ledger accounts. Then select either Create to create a new account or select Edit at the end of the row for an existing account.

Require dimensions for expense accounts: General Ledger > All tab > General Ledger accounts. Then use either Add or Edit.

To support accuracy of management, group, and regulatory reporting, it is often important to ensure that each transaction is coded to the correct combination of entity, profit center, and other financial coding.  Limiting the combinations that can be posted reduces the possibility of postings being made to the wrong of entity, profit and cost centers (either deliberately or in error).

Misallocation of costs can undermine higher level management controls such as review of performance against budget.

• What are the combinations of entity, profit center, and cost center that need to be defined?
• Are there any circumstances in which these definitions might need to be changed?

See configuration control test.

The test should focus on the elements of the validation that ensure the integrity of financial reporting.

See review control test.

The test should focus on how the risk of incorrect posting is addressed, not just that the process works. What's key is how a distinction is made between an approval without anyone actually checking anything, and the actual checking of something to ensure that the journal is accurate.

Where the Sage Intacct GL Outlier Detection service is used, this can test the effectiveness of manual journal review controls. If outliers are detected, it might indicate that the manual review or approval controls have missed something that they should have picked up. This can be used to refine the review procedures or provide additional training to those performing the controls.

General Ledger > All > Accounts. Select Create to create a new account or select Edit at the end of the row to edit an existing account. Then select Disallow direct posting.

General Ledger > All > Accounts > Add or Edit and then select Disallow direct posting

GL accounts: field descriptions

This can be checked on the Configure General Ledger page where you have the option to select accounts to disable direct posting:

General Ledger > Setup > Configuration

See configuration control test.

The test should focus on ensuring the posting to control accounts does not work.

• Who will be permitted to approve journal entries?
• Will you ensure that approvers cannot also post journals?
• How will you deal with situations where approvers are absent?
• Can journal preparer select who approves entries, or will this be pre-determined?
• What limits will approvers have?

Ability to require approval set within: General Ledger > Setup > Configuration, and Enable journal entry approvals is selected in the Approval options section.

Individual journal entries' approval can be reviewed within: General Ledger > All > Journal entries, and select Transactions. Next, find the relevant transaction in the list. Select More actions > View at the end of the row. Then select More actions > View audit trail.

Individual journal entries' approval can be reviewed within: General Ledger > All > Journal entries, and select View transactions. Then, find the relevant transaction, select View, select More actions, select View audit trail.

See workflow control test.

Where the Sage Intacct GL Outlier Detection service is used, this can test the effectiveness of manual journal review controls. If outliers are detected, it might indicate that the manual review or approval controls have missed something that they should have picked up. This can be used to refine the review procedures or provide additional training to those performing the controls.

• Will this be defined as a 'mandatory field' style control so that a journal can be posted to any cost center, or other field used for cost coding as long as it exists, or will set groupings of allowable cost centers or other fields used for cost coding be defined for specific journal types?
• How will you identify where a posting has been made to an 'allowable' cost center or other fields used for cost coding, but is posted to the wrong area?

Require dimensions for expense accounts: General Ledger > All tab > General Ledger accounts. Then select either Create to create a new account or select Edit at the end of the row for an existing account.

Require dimensions for expense accounts: General Ledger > All tab > General Ledger accounts. Then use either Add or Edit.

To support accuracy of management, group, and regulatory reporting, it is often important to ensure that each transaction is coded to the correct combination of entity, profit center, and other financial coding.  Limiting the combinations that can be posted reduces the possibility of postings being made to the wrong of entity, profit and cost centers (either deliberately or in error).

Misallocation of costs can undermine higher level management controls such as review of performance against budget.

• What are the combinations of entity, profit center, and cost center that need to be defined?
• Are there any circumstances in which these definitions might need to be changed?

See configuration control test.

The test should focus on the elements of the validation that ensure the integrity of financial reporting.

See review control test.

The test should focus on how the risk of incorrect posting is addressed, not just that the process works. What's key is how a distinction is made between an approval without anyone actually checking anything, and the actual checking of something to ensure that the journal is accurate.

Where the Sage Intacct GL Outlier Detection service is used, this can test the effectiveness of manual journal review controls. If outliers are detected, it might indicate that the manual review or approval controls have missed something that they should have picked up. This can be used to refine the review procedures or provide additional training to those performing the controls.

• Will you allow staff to post into a period after that period's end to take account of activities necessary to finalize it properly?
• How long should that period be?
• Will access be granted to post in prior periods for exceptional corrections? If so, how will this be managed?

For future posting across the entire system: General Ledger > Setup > Configuration > Transactions > If posting transactions to a future period.

For future posting within each subledger application: Setup > Configuration > Thresholds > If posting transactions to a future period.

To control posting to prior periods, use the Close Books functionality (a permissionable feature).

For prior period posting across the entire system: General Ledger > All > Books > Close

For prior period posting within each subledger application: All tab > Subledger > Close

• Configure General Ledger: transactions
• Close books

For future posting, system configuration settings are within each application. Go to Setup > Configuration > Thresholds > If posting transactions to a future period.

For prior period posting, view the Closed through summary.

See configuration control test.

The focus of the test should be to check that the postings are correctly blocked.

Custom list views filtered by State not equal to Posted.

General Ledger > All > Journal entries > Transactions > Manage views > Create new view > Step 3: Select filters > State not equal to Posted

General Ledger > All > Journal entries > View transactions > Manage views > Create new view > Step 3: Select filters > State not equal to Posted

See review control test.

The test should focus on how the risk of incorrect posting is addressed, not just that the process works.

• What categories will be available to select for fixed asset types?
• Will categories have fixed useful economic lives (UELs) associated with them?
• Will you have the option to select non-standard UELs?
• Which GL codes will you direct depreciation transactions to?
• How frequently will depreciation be charged, for example annually?
• Will you have a standalone fixed asset register, and if so, how will this be connected to Intacct ?

Fixed Assets

Sage Intacct Developer portal (REST API)

See configuration control test.

The test should focus on ensuring the calculation is performed accurately. Care should be taken to ensure that the test covers all the different asset types as necessary.

• Will you allow staff to post into a period after that period's end to take account of activities necessary to finalize it properly?
• How long should that period be?
• Will access be granted to post in prior periods for exceptional corrections? If so, how will this be managed?

For future posting across the entire system: General Ledger > Setup > Configuration > Transactions > If posting transactions to a future period.

For future posting within each subledger application: Setup > Configuration > Thresholds > If posting transactions to a future period.

To control posting to prior periods, use the Close Books functionality (a permissionable feature).

For prior period posting across the entire system: General Ledger > All > Books > Close

For prior period posting within each subledger application: All tab > Subledger > Close

• Configure General Ledger: transactions
• Close books

For future posting, system configuration settings are within each application. Go to Setup > Configuration > Thresholds > If posting transactions to a future period.

For prior period posting, view the Closed through summary.

See configuration control test.

The focus of the test should be to check that the postings are correctly blocked.

Custom list views filtered by State not equal to Posted.

General Ledger > All > Journal entries > Transactions > Manage views > Create new view > Step 3: Select filters > State not equal to Posted

General Ledger > All > Journal entries > View transactions > Manage views > Create new view > Step 3: Select filters > State not equal to Posted

See review control test.

The test should focus on how the risk of incorrect posting is addressed, not just that the process works.

• Will you allow any tolerance thresholds in respect of gaps between document and posting dates?
• How will you deal with the period around the year end?

See review control test.

The test should focus on how the risk of incorrect posting is addressed, not just that the process works.

• Who has the right experience and ability to perform the review?
• How often does the review need to happen practically speaking?

Recurring journal entries

See review control test.

The test should ensure that the control objectives of completeness are being met and not just ensure that the process works.

• What are the relevant aging buckets to classify your open purchase orders into?
• How will you make sure you are focusing your time on open purchase orders that should have been closed?
• How will you ensure that this review is done consistently each time it is performed?
• You might want to split this out by entity or amount. How will you ensure that everyone does this consistently? Will there be central organization or monitoring of the reviews?

Regular review of actuals to budget for income and expenditure accounts is a regular discipline that should be undertaken to understand how your business is performing. Getting reliable, complete, and accurate data in the format you need is critical for this.

The underlying control is not just the comparison of actual to budget, but investigation and understanding of the differences. For example, are the differences due to market conditions, under- or over-performance, or a combination of factors. Many organizations will develop more reports to support this investigation.

• What are the thresholds above which you will review differences?
• What's the level of detail that you need to review variations? For example, individual GL codes or groupings.
• Will you require analysis by different entities, divisions, or geographical locations?
• Will analysis potentially be cross-cutting? For example, consolidating parts of different legal entities.
• Do you want to understand which totals are made up of regular transactions (for example, purchase or sales ledger postings) as opposed to manual adjustments?
• What processes you will put in place if there are significant differences to budget?

Annotated actual to budget income and expenditure reporting with observations and explanations noted against the items that are outside of tolerances, evidencing follow up as needed.

This might include other reports and analytics to support the investigation.  Using standard Sage Intacct reports to perform analysis will make it easier for auditors to rely on the results of investigation into differences.

See review control test.

The test should be carefully designed to ensure that the control objective is met and risks are addressed and not a general check that some kind of review happened.

• Who should be granted access to adjust cost center (department) master data, and what other roles or access permissions in the system will they be permitted?
• Which system roles need to be segregated?

• Who should be able to approve changes to cost center (department) master data?
• What other roles or access permissions in the system will approvers be permitted and what roles need to be segregated?
• Will any self-approval of changes be permitted?

• Smart rules
• Smart events

• How will you identify inappropriate changes? For example, users, timings, and particular types of change.
• What will you define as key master data? Some master data changes might not have a significant impact.

See review control test.

The test should focus on how inappropriate changes to master data were identified and followed up.

See configuration control test.

This is an interface. So, the focus should be on ensuring that the critical data for the control is identified and tested for complete and accurate transfer.

• Who should be granted access to adjust cost center (department) master data, and what other roles or access permissions in the system will they be permitted?
• Which system roles need to be segregated?

• Who should be granted access to adjust profit center (department) master data, and what other roles or access permissions in the system will they be permitted?
• Which system roles need to be segregated?

• Who should be granted access to specific profit center (department) , and what other roles or access permissions in the system will they be permitted?

• Will anyone need access to multiple company profit centers (departments) ?

• Who should be able to approve changes to profit center (department) master data?
• What other roles or access permissions in the system will approvers be permitted and what roles need to be segregated?
• Will any self-approval of changes be permitted?

• Smart rules
• Smart events

• How will you identify inappropriate changes? For example, users, timings, and particular types of change.
• What will you define as key master data? Some master data changes might not have a significant impact.

See review control test.

The test should focus on how inappropriate changes to master data were identified and followed up.

Sharing profit center (department) master data from the general ledger to feeder applications (for example expenses, payroll, or time recording systems) helps ensure that entries to any system are performed within a consistent framework, and reduces time and effort in re-coding them when transactions flow between systems

See configuration control test.

This is an interface. So, the focus should be on ensuring that the critical data for the control is identified and tested for complete and accurate transfer.

• Who should be granted access to adjust profit center (department) master data, and what other roles or access permissions in the system will they be permitted?
• Which system roles need to be segregated?

• Who has the right experience and ability to perform the review?
• How often does the review need to happen practically speaking?

Recurring journal entries

See review control test.

The test should ensure that the control objectives of completeness are being met and not just ensure that the process works.

• What are the relevant aging buckets to classify your open purchase orders into?
• How will you make sure you are focusing your time on open purchase orders that should have been closed?
• How will you ensure that this review is done consistently each time it is performed?
• You might want to split this out by entity or amount. How will you ensure that everyone does this consistently? Will there be central organization or monitoring of the reviews?

Regular review of actuals to budget for income and expenditure accounts is a regular discipline that should be undertaken to understand how your business is performing. Getting reliable, complete, and accurate data in the format you need is critical for this.

The underlying control is not just the comparison of actual to budget, but investigation and understanding of the differences. For example, are the differences due to market conditions, under- or over-performance, or a combination of factors. Many organizations will develop more reports to support this investigation.

• What are the thresholds above which you will review differences?
• What's the level of detail that you need to review variations? For example, individual GL codes or groupings.
• Will you require analysis by different entities, divisions, or geographical locations?
• Will analysis potentially be cross-cutting? For example, consolidating parts of different legal entities.
• Do you want to understand which totals are made up of regular transactions (for example, purchase or sales ledger postings) as opposed to manual adjustments?
• What processes you will put in place if there are significant differences to budget?

Annotated actual to budget income and expenditure reporting with observations and explanations noted against the items that are outside of tolerances, evidencing follow up as needed.

This might include other reports and analytics to support the investigation.  Using standard Sage Intacct reports to perform analysis will make it easier for auditors to rely on the results of investigation into differences.

See review control test.

The test should be carefully designed to ensure that the control objective is met and risks are addressed and not a general check that some kind of review happened.

Regular review of actuals to budget for income and expenditure accounts is a regular discipline that should be undertaken to understand how your business is performing. Getting reliable, complete, and accurate data in the format you need is critical for this.

The underlying control is not just the comparison of actual to budget, but investigation and understanding of the differences. For example, are the differences due to market conditions, under- or over-performance, or a combination of factors. Many organizations will develop more reports to support this investigation.

• What are the thresholds above which you will review differences?
• What's the level of detail that you need to review variations? For example, individual GL codes or groupings.
• Will you require analysis by different entities, divisions, or geographical locations?
• Will analysis potentially be cross-cutting? For example, consolidating parts of different legal entities.
• Do you want to understand which totals are made up of regular transactions (for example, purchase or sales ledger postings) as opposed to manual adjustments?
• What processes you will put in place if there are significant differences to budget?

Annotated actual to budget income and expenditure reporting with observations and explanations noted against the items that are outside of tolerances, evidencing follow up as needed.

This might include other reports and analytics to support the investigation.  Using standard Sage Intacct reports to perform analysis will make it easier for auditors to rely on the results of investigation into differences.

See review control test.

The test should be carefully designed to ensure that the control objective is met and risks are addressed and not a general check that some kind of review happened.

• Who needs to have access to change recurring journals? What are the risks of having too many people with this access?
• Are there any duties that need to be segregated from this ability?

Regular review of actuals to budget for income and expenditure accounts is a regular discipline that should be undertaken to understand how your business is performing. Getting reliable, complete, and accurate data in the format you need is critical for this.

The underlying control is not just the comparison of actual to budget, but investigation and understanding of the differences. For example, are the differences due to market conditions, under- or over-performance, or a combination of factors. Many organizations will develop more reports to support this investigation.

• What are the thresholds above which you will review differences?
• What's the level of detail that you need to review variations? For example, individual GL codes or groupings.
• Will you require analysis by different entities, divisions, or geographical locations?
• Will analysis potentially be cross-cutting? For example, consolidating parts of different legal entities.
• Do you want to understand which totals are made up of regular transactions (for example, purchase or sales ledger postings) as opposed to manual adjustments?
• What processes you will put in place if there are significant differences to budget?

Annotated actual to budget income and expenditure reporting with observations and explanations noted against the items that are outside of tolerances, evidencing follow up as needed.

This might include other reports and analytics to support the investigation.  Using standard Sage Intacct reports to perform analysis will make it easier for auditors to rely on the results of investigation into differences.

See review control test.

The test should be carefully designed to ensure that the control objective is met and risks are addressed and not a general check that some kind of review happened.

• Who needs to have access to change recurring journals? What are the risks of having too many people with this access?
• Are there any duties that need to be segregated from this ability?

Where exchange differences are posted to specific general ledger accounts, these can be reviewed to identify potential errors. For example, an exchange rate that's been entered incorrectly can lead to large exchange differences.

• How material are foreign exchange postings to my business?
• How likely is it that margins will be impacted by volatile exchange rates?

• Which source will you use for foreign exchange rates?
• How frequently will your rates be updated?
• Will rates be updated automatically or manually?

Run the relevant revaluation report in the relevant application (General Ledger, Cash Management, Accounts Payable, or Accounts Receivable > Reports > Revaluation report ).

Set up for automated journal entry posting, if desired.

• Foreign currency revaluation overview
• Video: Auto-create gain/loss journal entries from revaluation reports

Report produced indicating updated valuation of balances. Revaluation report available in the relevant application (General Ledger, Cash Management, Accounts Payable, or Accounts Receivable > Reports > Revaluation report.

Subsequent manual journal posting any differences, approved in automated workflow.

See configuration control test.

The focus should be on ensuring that the retranslation is done correctly. This might be through reperformance of the calculation.

• What period of time after a period or month end will you allow for project activities to be completed?
• Precisely what information do you want to be reported?

Custom list views that are filtered by End date less or equal to today and appropriate Status.

Projects > All tab > Projects > View Transactions> Manage Views > Create new view > Step 3: Select filters > End date less or equal to today and appropriate Status

See review control test.

The test should focus on how errors in transactions or omitted accruals are identified and followed up.

• Which interfaces do you need to report on?
• What period of time after a period- or month-end will you allow for month-end interfaces to be completed?
• Exactly what information do you want to be reported?

See review control test.

The test should focus on how exceptions are defined, identified, and followed up.

Checking that your subledgers and general ledger balances agree with each other is a core financial accounting activity. It also helps to ensure that your reporting is complete and accurate, and that you understand the reasons for any differences between the ledger balances and can follow them up on a timely basis.

Where data is interfaced from non-Sage Intacct systems, reconciliations with the supporting system are a key control that auditors usually look for to ensure that the information has been completely and accurately captured.

These reconciliations are one of the first controls that an auditor is likely to review in a process, as if they are ineffective, they are likely to undermine all controls in that process. Conversely, a good reconciliation control at this point can often compensate for control weaknesses earlier in the process as it can detect some errors and provide the organization with an opportunity to correct them, especially if the reconciliations (and any required adjustments) are made before period end close.

• Which balance sheet accounts and subledgers do you want to perform reconciliations for?
• Who will prepare and who will review reconciliations?
• How soon after the period end will you perform them? Will they be performed every period or annually?

Run standard reports:

• Accounts Receivable > All > Reports > AR Ledger
• Accounts Payable > All > Reports > AP Ledger
• General Ledger > All > Reports > Trial Balance

• AR Ledger report

• AR subledger and GL discrepancies

• AP Ledger report

• Understanding discrepancies between your AP subledger and General Ledger

• Trial balance reports

Subledger and general ledger balance sheet reports reconciled with explanation of reconciling items and evidence of independent review; performed on a timely basis respective to the period end.

See reconciliation control test.

The test should be scoped carefully to ensure that the risk of inaccurate reconciliations is addressed.

• Which holding accounts will be reviewed?
• Who will prepare the reports and review them?
• How soon after the period end will you run reports to check for uncleared items? Will this be every period, or annually?
• Are there de minimis holding account or open item balances that you are prepared to tolerate?

See review control test.

The test should focus on how inappropriate items are identified and reviewed, not just that the process works.

• Who will prepare the reports and review them?
• How soon after the period end will you run inter-company or inter-entity reports to check for agreement? Will this be every period or annually?
• Are there de minimis differences that you are prepared to tolerate?
• Do you want to confirm balances and transactions, or just balances?
• How will you resolve differences?

• What are the key month-end control activities that need to be performed?
• Should a checklist be built within Sage Intacct or outside?

See review control test.

• What are the key month end control activities that need to be performed?
• Should a checklist be built within Sage Intacct or outside?

Checking that your subledgers and general ledger balances agree with each other is a core financial accounting activity. It also helps to ensure that your reporting is complete and accurate, and that you understand the reasons for any differences between the ledger balances and can follow them up on a timely basis.

Where data is interfaced from non-Sage Intacct systems, reconciliations with the supporting system are a key control that auditors usually look for to ensure that the information has been completely and accurately captured.

These reconciliations are one of the first controls that an auditor is likely to review in a process, as if they are ineffective, they are likely to undermine all controls in that process. Conversely, a good reconciliation control at this point can often compensate for control weaknesses earlier in the process as it can detect some errors and provide the organization with an opportunity to correct them, especially if the reconciliations (and any required adjustments) are made before period end close.

• Which balance sheet accounts and subledgers do you want to perform reconciliations for?
• Who will prepare and who will review reconciliations?
• How soon after the period end will you perform them? Will they be performed every period or annually?

Run standard reports:

• Accounts Receivable > All > Reports > AR Ledger
• Accounts Payable > All > Reports > AP Ledger
• General Ledger > All > Reports > Trial Balance

• AR Ledger report

• AR subledger and GL discrepancies

• AP Ledger report

• Understanding discrepancies between your AP subledger and General Ledger

• Trial balance reports

Subledger and general ledger balance sheet reports reconciled with explanation of reconciling items and evidence of independent review; performed on a timely basis respective to the period end.

See reconciliation control test.

The test should be scoped carefully to ensure that the risk of inaccurate reconciliations is addressed.

• Who will prepare the reports and review them?
• How soon after the period end will you run inter-company or inter-entity reports to check for agreement? Will this be every period or annually?
• Are there de minimis differences that you are prepared to tolerate?
• Do you want to confirm balances and transactions, or just balances?
• How will you resolve differences?

• What are the key month-end control activities that need to be performed?
• Should a checklist be built within Sage Intacct or outside?

See review control test.

• What are the key month end control activities that need to be performed?
• Should a checklist be built within Sage Intacct or outside?

• Who will prepare the reports and review them?
• How soon after the period end will you run reports to check for aged receivables? Will this be every period or annually?
• Are there de minimis balances that you are prepared to tolerate?
• What will be considered too old and require action to follow up?
• At what level will you consider providing for aged receivables?

Annotated report with evidence of follow up of aged debts or the creation of a provision for debt.

See review control test. The test should focus on how errors or missing transactions are identified and followed up.

Checking that your subledgers and general ledger balances agree with each other is a core financial accounting activity. It also helps to ensure that your reporting is complete and accurate, and that you understand the reasons for any differences between the ledger balances and can follow them up on a timely basis.

Where data is interfaced from non-Sage Intacct systems, reconciliations with the supporting system are a key control that auditors usually look for to ensure that the information has been completely and accurately captured.

These reconciliations are one of the first controls that an auditor is likely to review in a process, as if they are ineffective, they are likely to undermine all controls in that process. Conversely, a good reconciliation control at this point can often compensate for control weaknesses earlier in the process as it can detect some errors and provide the organization with an opportunity to correct them, especially if the reconciliations (and any required adjustments) are made before period end close.

• Which balance sheet accounts and subledgers do you want to perform reconciliations for?
• Who will prepare and who will review reconciliations?
• How soon after the period end will you perform them? Will they be performed every period or annually?

Run standard reports:

• Accounts Receivable > All > Reports > AR Ledger
• Accounts Payable > All > Reports > AP Ledger
• General Ledger > All > Reports > Trial Balance

• AR Ledger report

• AR subledger and GL discrepancies

• AP Ledger report

• Understanding discrepancies between your AP subledger and General Ledger

• Trial balance reports

Subledger and general ledger balance sheet reports reconciled with explanation of reconciling items and evidence of independent review; performed on a timely basis respective to the period end.

See reconciliation control test.

The test should be scoped carefully to ensure that the risk of inaccurate reconciliations is addressed.

• Which holding accounts will be reviewed?
• Who will prepare the reports and review them?
• How soon after the period end will you run reports to check for uncleared items? Will this be every period, or annually?
• Are there de minimis holding account or open item balances that you are prepared to tolerate?

See review control test.

The test should focus on how inappropriate items are identified and reviewed, not just that the process works.

• Who will prepare the reports and review them?
• How soon after the period end will you run inter-company or inter-entity reports to check for agreement? Will this be every period or annually?
• Are there de minimis differences that you are prepared to tolerate?
• Do you want to confirm balances and transactions, or just balances?
• How will you resolve differences?

• What are the key month-end control activities that need to be performed?
• Should a checklist be built within Sage Intacct or outside?

See review control test.

• What are the key month end control activities that need to be performed?
• Should a checklist be built within Sage Intacct or outside?

• Who will prepare the reports and review them?
• How soon after the period end will you run reports to check for aged receivables? Will this be every period or annually?
• Are there de minimis balances that you are prepared to tolerate?
• What will be considered too old and require action to follow up?
• At what level will you consider providing for aged receivables?

Annotated report with evidence of follow up of aged debts or the creation of a provision for debt.

See review control test. The test should focus on how errors or missing transactions are identified and followed up.

Checking that your subledgers and general ledger balances agree with each other is a core financial accounting activity. It also helps to ensure that your reporting is complete and accurate, and that you understand the reasons for any differences between the ledger balances and can follow them up on a timely basis.

Where data is interfaced from non-Sage Intacct systems, reconciliations with the supporting system are a key control that auditors usually look for to ensure that the information has been completely and accurately captured.

These reconciliations are one of the first controls that an auditor is likely to review in a process, as if they are ineffective, they are likely to undermine all controls in that process. Conversely, a good reconciliation control at this point can often compensate for control weaknesses earlier in the process as it can detect some errors and provide the organization with an opportunity to correct them, especially if the reconciliations (and any required adjustments) are made before period end close.

• Which balance sheet accounts and subledgers do you want to perform reconciliations for?
• Who will prepare and who will review reconciliations?
• How soon after the period end will you perform them? Will they be performed every period or annually?

Run standard reports:

• Accounts Receivable > All > Reports > AR Ledger
• Accounts Payable > All > Reports > AP Ledger
• General Ledger > All > Reports > Trial Balance

• AR Ledger report

• AR subledger and GL discrepancies

• AP Ledger report

• Understanding discrepancies between your AP subledger and General Ledger

• Trial balance reports

Subledger and general ledger balance sheet reports reconciled with explanation of reconciling items and evidence of independent review; performed on a timely basis respective to the period end.

See reconciliation control test.

The test should be scoped carefully to ensure that the risk of inaccurate reconciliations is addressed.

• Which holding accounts will be reviewed?
• Who will prepare the reports and review them?
• How soon after the period end will you run reports to check for uncleared items? Will this be every period, or annually?
• Are there de minimis holding account or open item balances that you are prepared to tolerate?

See review control test.

The test should focus on how inappropriate items are identified and reviewed, not just that the process works.

• Who will prepare the reports and review them?
• How soon after the period end will you run inter-company or inter-entity reports to check for agreement? Will this be every period or annually?
• Are there de minimis differences that you are prepared to tolerate?
• Do you want to confirm balances and transactions, or just balances?
• How will you resolve differences?

• What are the key month-end control activities that need to be performed?
• Should a checklist be built within Sage Intacct or outside?

See review control test.

• What are the key month end control activities that need to be performed?
• Should a checklist be built within Sage Intacct or outside?

In a segregation of duties control, the ideal scenario is that no one has access to do both of the activities. Even in this case, the control should ideally be operated to ensure this is true on an ongoing basis, because it is easy for someone to be given access inadvertently (or change roles and retain old access). Preventative controls within the access provisioning process should stop this occurring. However, because of the risk of fraud, check segregation of duties conflicts regularly.

In the case of conflicts, simple approval of the conflict is not normally sufficient. The 'mitigating controls' should be identified, for example, a review of activity logs to ensure the conflict is not abused.

• Assign permissions to users
• Example Permissions report for all users—CRW

The system will report automatically on conflicts of segregation of duties where a user has the ability to enter journals and perform one of the following actions:

• Maintain report parameters
• Perform asset month-end close functions, including depreciation
• Perform financial period-end close or cockpit activities
• Maintain financial settings, such as exchange rates or open and close periods

Segregation of duty is a key concept in the performance of business processes. It includes these characteristics:

• Describes those activities that should be performed by separate people, which might then be checked or reviewed by independent individuals.
• Provides for checks to help ensure that data is input accurately and completely.
• Reduces the incentive for fraudulent activity by implementing independent review of specific activities.

• Who will prepare the reports and review them?
• What are the activities that you want to implement segregation of duties between?
• What will be the allowed exceptions to these segregation of duties, if any, and how will you review these?
• How will you follow up on any identified exceptions or segregation of duties conflicts?

See review control test.

The test should focus on how the exceptions are mitigated or resolved.