Substantive testing · NetSuite TD3016323

Journal Entry Testing

Population analysis, risk stratification, and exception testing of every posted journal entry in the account, with five exceptions and one series that should not be called a beginning balance.

Prepared 2026-09-23 · Scope: all 88 posted journal entries, October 2024 to October 2026 · Source: NetSuite via SuiteQL · Prompt: Journal Entry Testing Tool, NetSuite AI Prompt Library v1 · Standard Review depth

Population Summary

Scope: every posted journal entry in the account, 88 entries dated October 2024 to October 2026, 26.8 million dollars of debits, all balanced. Materiality for selection was set at $25,000 of total debits, which captures 59 entries and 99.8% of the value. The full population was tested, not a sample, because 88 entries is small enough to read.

The population divides into two groups that need different treatment. Forty-eight entries share the memo "Beg Balance Entries", one per month per subsidiary for 24 months, 62 or 63 lines each across about 50 accounts, 25.8 million dollars of debits, 96% of everything. They credit 19.8 million dollars to revenue, which is most of the revenue the account has ever recognized. All 48 were created on a single day, September 10, 2026, and are backdated by as much as 709 days. Whatever they are, they are not beginning balances. A beginning balance is posted once. These recur monthly and carry a full income statement each time.

The other forty are manual entries of the ordinary kind, 1.01 million dollars in total. Eleven have no description. Eight share the memo "Negative Cash Flow" and move round amounts between a bank account and equity. Three undescribed entries created on the evening of September 14 move $262,000 in round amounts between balance sheet accounts. Those eleven are the exceptions this test is designed to find.

Entries by transaction month. Two per month is the beginning-balance series; the rise from June 2026 is the manual entries, most of them created in September.

High-Risk Entry Identification

Risk indicators applied: period-end date (day 28 or later), creation outside 08:00 to 18:00, weekend creation, round amount above $10,000, description under ten characters, revenue credited without a cash or receivable debit, expense without cash or payable, P&L-only entries, and top-side keywords in the memo.

The beginning-balance series does not trip the combination flags, because each entry touches bank, receivables, payables, and equity as well as the P&L. It trips the description test in substance rather than in length: the memo is present, and wrong. That is why the population summary, not the indicator table, is where this series shows up. A screen built on keywords would have passed it.

Sample Selection

All 11 manual entries above materiality were tested in full. The 48-entry beginning-balance series was treated as one recurring population: the first, a middle, and the last entry were examined line by line and the remainder compared for structure. Five entries below materiality were read for description and account combination. Nothing was sampled at random, because nothing needed to be.

Testing Results and Exceptions

1. E1. The beginning-balance series is misdescribed and cannot be relied on as described. Forty-eight monthly entries labelled as beginning balances post a complete monthly income statement and balance sheet movement, 19.8 million dollars of it to revenue. They were created in one batch on September 10, 2026. Business purpose is undocumented. Management should explain whether these represent a migration of history from another system, in which case the memo should say so and the source should be retained, or something else.
2. E2. Three undescribed round-amount entries, September 14, 2026. JE160 ($85,000, receivables to other current asset), JE161 ($65,000, payables to other current asset), and JE162 ($112,000, bank to other current asset), created between 20:57 and 21:14, no memo, no preparer. Every risk indicator the prompt carries fires on these. Supporting documentation is required before they can be accepted.
3. E3. The "Negative Cash Flow" series. Eight entries totalling $680,000, each a round amount between $15,000 and $175,000, each moving cash against equity, created within six minutes of each other at 03:28 on a Saturday and backdated to eight different months. Cash-to-equity movements with a memo that describes a symptom rather than a transaction need a business purpose.
4. E4. No preparer or approval evidence on 79 of 88 entries. The preparer field is empty on 79 entries and the approval status on all 88. Segregation of duties and authorization cannot be tested. This is a control gap, not a finding about any entry.
5. E5. Entries dated in the future. Two rent accruals are dated October 1 and 2, 2026, after the test date, and are already posted. The period is open, so this is permitted by the system; it should not be permitted by policy.

Recommendations

• Next 30 days. Obtain support for E2 and E3, or reverse them. Correct the memo on the 48 series entries to state what they are and where they came from.
• 60 days. Turn on journal approval and require a preparer on every entry, so that E4 cannot recur. Close periods once reviewed, so that future-dated postings are blocked.
• 90 days. Re-run this test on entries created after the controls are in place. The exception rate on that population is the number that matters for the audit opinion.

Appendix: Data Lineage

Adaptations from the prompt's templates: amounts come from transactionaccountingline (debit and credit columns) rather than transactionline.amount; account.accttype rather than acctype; transaction.subsidiary is not exposed, so subsidiary comes from the line; the JSON returned for createddate carries no time, so the hour was fetched separately with TO_CHAR; the preparer join to employee was dropped because the creator field is empty on 79 entries; LISTAGG was replaced by aggregation in code.

SELECT t.id, t.tranid, t.trandate, t.createddate, BUILTIN.DF(t.createdby), t.memo, BUILTIN.DF(t.approvalstatus), t.posting, BUILTIN.DF(t.postingperiod), t.lastmodifieddate, BUILTIN.DF(t.lastmodifiedby)
FROM transaction t WHERE t.type = 'Journal'

SELECT tl.transaction, tl.id, tl.subsidiary, a.acctnumber, a.fullname, a.accttype, tal.debit, tal.credit, tal.amount, tl.memo, BUILTIN.DF(tl.department), BUILTIN.DF(tl.entity)
FROM transactionline tl JOIN transaction t ON t.id = tl.transaction
JOIN transactionaccountingline tal ON tal.transaction = tl.transaction AND tal.transactionline = tl.id
JOIN account a ON a.id = tal.account
WHERE t.type = 'Journal' AND tal.posting = 'T'

SELECT id, TO_CHAR(createddate, 'YYYY-MM-DD HH24:MI'), TO_CHAR(createddate, 'DY') FROM transaction WHERE type = 'Journal'

Appendix: Assumptions and Verification

Confidence: 95% in the population figures and the indicator counts; 85% that E2 and E3 are undocumented rather than fraudulent, given the account's evident use as a demonstration environment; the characterization of the beginning-balance series is reported, not concluded, and requires management's explanation.