Journal Entry Review Is Where AI Earns Its Keep

Your auditor is going to read every journal entry you posted this year, or at least their software is, and you're going to review a sample of maybe forty of them on a Tuesday in a spreadsheet that somebody built in 2019. That asymmetry has existed for as long as I've been around finance teams and everybody quietly accepts it, and it's the single most fixable thing on the close calendar right now.

Why journal entries are the right first AI project

Most teams reach for AI on the glamorous stuff - forecasting, commentary, board decks - and then get frustrated because the output is plausible and unverifiable, which is the worst combination in accounting. Journal entry review runs the other direction. The population is finite and sits in one table. Every record has structure: preparer, approver, post date, effective date, account, amount, memo, source. The output is a ranked list of entries a human then opens. You can check the work in ten minutes.

That verifiability is the whole reason to start here. You get a real win, your team sees the mechanism rather than the magic, and nobody has to trust a black box with an accrual. I've made this argument more broadly in the Klarna build-versus-buy piece and it holds here: pick the workflow where you can grade the answer.

What the new fraud standard actually changes

On August 19, 2026 the AICPA's Auditing Standards Board approved SAS No. 151, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, superseding the old AU-C section 240. The final text posts in October and it's effective for periods ending on or after December 15, 2028, so nobody needs to panic this quarter.

What it does is sharpen the fraud lens across risk assessment, require auditors to understand your whistleblower program if you have one, and add more extensive requirements around documentation and what happens when fraud or suspected fraud turns up. The presumption of fraud risk in revenue recognition stays put. None of that removes the long-standing expectation that auditors test journal entries because management can override controls, and in practice a sharper standard means a sharper look at your general ledger, earlier, with more questions about how entries got initiated and approved.

You have roughly two close cycles' worth of runway to get your own house in order before that lands. That's a gift, and most teams will waste it.

Why this matters beyond the audit

The ACFE's Occupational Fraud 2026: A Report to the Nations puts the median loss per case at $104,000, with a median scheme duration of 12 months before detection. The duration curve is the part that should get your attention: schemes caught inside six months carry a $40,000 median loss, and schemes that run past five years carry median losses above $1.1 million.

So detection speed is the variable you control. A review process that catches something in month four instead of month nineteen is worth real money, and that's an argument you can take to a CFO without saying the word AI once.

What AI is genuinely good at here

Ranking a full population instead of sampling one. This is the big unlock. Instead of forty entries chosen by judgment and habit, you score all of them and read the top two hundred. Round-dollar amounts, entries posted after the close cutoff, entries with a preparer who is also the approver, weekend and 2am postings, entries hitting rarely-used accounts, credits to revenue from an unusual source, amounts just under an approval threshold. None of that is new thinking - what's new is that you no longer need a data analyst to run it every month.

Reading memo fields like a human would. Free-text memo lines have always been where the story hides and where rules-based tools go blind. A language model reads "reclass per D. request" and "to true up per discussion" and flags the vagueness, the missing support reference, the entry whose memo doesn't describe what the entry actually does. That's a category of review nobody has been able to automate before and it's the most underrated part of this.

Clustering instead of alerting. Ask it to group the month's entries into families and tell you which families are unusual relative to the prior twelve months, rather than firing a thousand individual flags. You want a shortlist with reasons attached, not an exception report nobody opens.

Drafting the ask. Once you've picked the entries to question, having it draft the support request to the preparer - specific, polite, referencing the entry number and the missing item - saves the hour that usually kills the whole exercise.

Where you'll get burned

It will hallucinate a rationale. Ask why an entry looks unusual and you'll sometimes get a fluent, confident, entirely invented explanation involving a subsidiary you don't have. The fix is structural: the model ranks and explains its ranking signals, and a human opens the entry and the support. The model never concludes.

It will also drift. A prompt that worked brilliantly in March quietly degrades by August because your chart of accounts changed, or somebody renamed a source journal, or you switched ERPs. Re-baseline it every quarter and keep a fixed test set of twenty entries - ten you know are clean, ten you know are weird - and run them through before you trust a month's output.

And be careful with what you feed it. Payroll journals carry individual compensation. If you're using a public model endpoint, strip or tokenize what doesn't need to be there, and get your own policy written down before your auditor asks you for it, because they will.

The bullshit version of this article would tell you AI replaces journal entry review. It doesn't. It replaces the part where you pretend a forty-entry sample was a review.

A workflow you can stand up this quarter

Export the full JE detail for one closed month from your ERP, with preparer, approver, post timestamp, effective date, account, amount, memo and source journal. One month, not a year.

Score that population against a written risk ruleset - round dollars, self-approval, post-cutoff timing, off-hours posting, threshold-adjacent amounts, dormant accounts, manual entries to revenue or cash. Keep the ruleset in a document, not in someone's head, because that document is what you'll hand your auditor.

Layer the language model on top for the memo-quality read and the clustering, and have it output a ranked list with a one-line reason per entry. Review the top fifty by hand. Log what you found and what turned out to be nothing, because the false positives are how you tune the next run.

Then do it again next month and compare. Two cycles in you'll know whether this is worth keeping, and either answer is useful.

If your ERP makes that export painful, that's a finding in itself, and it's worth checking whether the platform you're on exposes the data properly - our software directory scores tools on exactly this kind of thing. Related reading: what AI skills employers are actually asking for in accounting job postings, since the people who build workflows like this are the ones getting the premium.

What I would do

Run it in parallel for one month against your existing sample-based review and see what each catches that the other missed. That comparison is the only evidence that'll convince a skeptical controller, and it's the only evidence that should convince you either. If the ranked list surfaces nothing your sample didn't, you've learned something real and it cost you an afternoon.

Frequently asked questions

What is journal entry testing and why do auditors do it?

It's the examination of general ledger entries and other adjustments for signs of inappropriate or fraudulent activity, and auditors perform it because management can override controls, which makes manual entries one of the easiest ways to misstate financial statements. It's a required response to that risk in a financial statement audit.

Does SAS No. 151 change journal entry testing requirements?

SAS No. 151, approved by the AICPA's Auditing Standards Board on August 19, 2026, supersedes AU-C section 240 and strengthens fraud-related risk assessment, documentation and communication requirements. It's effective for periods ending on or after December 15, 2028, with early implementation permitted.

Can AI replace manual journal entry review?

No. It replaces sampling. AI is good at scoring an entire population and surfacing a prioritized shortlist with reasons attached, and a human still has to open the entries, read the support and reach a conclusion. Treat any tool that claims to conclude for you as a liability.

What data does an AI journal entry review need?

Full JE detail for the period: entry number, preparer, approver, post timestamp, effective date, account, debit and credit amounts, memo text and source journal. The timestamps and the preparer-approver pairing carry most of the signal, and they're the fields people most often leave out of the export.

Is it safe to send journal entry data to an AI model?

It depends entirely on the deployment. Enterprise arrangements with no-training guarantees and your own tenancy are a different risk profile than pasting into a consumer chat window. Strip personally identifiable compensation data regardless, and write the policy down before you start rather than after your auditor asks.

The teams pulling ahead right now aren't the ones with the best AI strategy deck. They're the ones who took one boring, checkable workflow and actually built it, then took the next one. Journal entry review is about as good a first brick as you'll find - go export one month and see what falls out.