Somewhere in the prepared-by-client list is a request that looks disproportionate: every journal entry posted during the year, with fields most people have never exported. For a mid-sized business that can be tens of thousands of rows.
Then the auditor tests perhaps twenty of them. The request looks like overreach. It is not, and understanding why makes the whole thing easier to supply.
Why it is on every audit
Auditors work on the basis that management override of controls is a risk at every engagement. Not because any particular client is suspected, but because it is the one control weakness that cannot be designed out: the people who set the controls can go around them, and the journal is how it is usually done.
A fictitious revenue entry, a reversed provision, a reclassification that moves a cost out of the period, a late adjustment to hit a covenant. These do not appear as transactions in a subsidiary ledger. They appear as journals.
So the procedure is standard and universal. It is not a signal about you.
What the auditor does with the file
The population is not sampled randomly. It is filtered, which is the entire reason the full extract is needed.
Typical criteria: entries posted outside normal hours or at weekends, entries dated close to or after the period end, round sum amounts, entries posted by someone whose role does not normally involve posting, entries with no narrative or a vague one, unusual account combinations such as revenue credited against a balance sheet account that never otherwise interacts with it, entries just below an authorisation threshold, and entries by a user who posted very few during the year.
From that filtered set the auditor selects items and asks for support: what it was, why it was posted, who approved it and the documentation behind it.
Increasingly this runs across the whole population rather than a sample, because the data allows it. That is a better audit and usually a lighter one for you, since the questions are fewer and more precisely aimed.
What the extract needs to contain
Ask for the specification at planning rather than at fieldwork. Typically: entry number, date posted, effective or accounting date, account code and description, debit and credit amounts, narrative or description, the user who posted, the user who approved if your system records it, source or journal type so system-generated entries can be told apart from manual ones, and the batch reference.
The two fields that cause trouble are the posting user and the posted date as distinct from the effective date. Some systems do not retain them, or retain them only in an audit log that needs a different export. Find out before year end which category you are in.
Making it painless
Export once, properly. A file missing a column means doing it again, and the second extract never quite reconciles to the first because something moved in between. Agree the specification, run it, and reconcile the total to the trial balance movement before sending.
Write narratives as you post. This is the single highest-value habit. A journal described as “adj” or “per JS” costs you a conversation months later with someone who has to reconstruct what they were thinking. A narrative naming the reason and the supporting document closes the query in one email.
Keep the support with the journal. A reference to the calculation, the email authorising it, the schedule behind it. Most journal queries are answered instantly if the support is attached and slowly if it has to be found.
Restrict who can post. A short list of people with posting rights is easier to explain, produces fewer flagged items, and is better practice anyway. Entries from users who post twice a year are disproportionately likely to be selected.
Review manual journals monthly. Someone other than the preparer, looking at the manual entries for the month. It takes very little time, catches errors while they are cheap, and gives you a control you can describe to the auditor.
None of this is burdensome once it is routine. The businesses that find this part of the audit painful are the ones reconstructing a year of unexplained entries in February, and the ones that find it trivial are doing the same work in twenty minutes a month.