As part of a SOX audit, we found that manual journal entries are not reviewed before posting. The company says that would hinder their closing. So the accountants at this company prepare and post their own journal entries. The "review" of the JE comes after posting. The "review" consists of the accounting manager going through the manual journal entry book with a control listing, supposedly reviewing each JE, and then signing the control listing once to evidence their review of over 100 manual journal entries that have already been posted that month. The public accountants, a top international firm, sees no problem with this!
Am I wrong in thinking that taking a strong preventative control (review of manual JE before posting) and changing it into a weak detective control (review of already posted JEs) is not good enough? Why would the public accountants support this?
I love the energy and fierceness with which you are attacking this. Part of doing our job is questioning everything - including the placement of a control. The inclusion of a preventative control would be "best" for this process. However, management has decided they will accept the risk of an error to facilitate speed. This trade off is common. However, this places great reliance on the detective review process. It should be timely and sufficient to ensure that each JE gets the love and attention it deserves.
And finally, although I often place public accountants in league with Lucifer, they have years of exposure to closing practices and they know how to protect their wallets. While their attitudes and slimy natures often disgust me, you can ususally rely on what they opine about. BUT - never stop questioning them or your auditees - it is what will make you valuable!!!
Do the right things for the right reasons.
As usual, Crash has already provided some solid advice.
Controls require time and thus have a cost that should not exceed the benefit from the reduced risk. Depending on the circumstances a preventive control is not a must. In addition, a detective control is not necessarily weak.
If the speed of the closing and thus the availability of the numbers is the main issue and if an immediate review by the accounting manager before the posting of manual journal entries would take too much time, then a detective control through a review after posting is the only other option. As long as the magnitude of potential errors or fraud in relation to the consolidated financial statements is not material or as long as the likelihook of an error or fraud (given other compensating controls, such as budget to actual variance analysis) is less than reasonably possible, you do not need to worry too much about errors or fraud (materiality and risk).
Having different controls for different classes of manual journal entries with different risks and amounts may also be an option. This may include only reviewing a sample of transactions. I tend to be quite cost conscious and dislike reviewing 100% of transactions unless the risk is very high.
If the public accountants audit this control and if you are not asked to review it as a basis of management's assessment of the effectiveness of internal control over financial reporting (section 404(a) SOX), it may not be necessary to duplicate their work.
My favorite "review" of MJEs was a GL printout 10 pages long showing only account number, debit, credit. No account descriptions or posting description anywhere. I asked the controller whether he was a savant to be able to perform an adequate review of MJEs.
Our company doesn't try to close within a couple days of M/E; but, we do close well before the middle of the following month. My point with this is that waiting two or three days more for final close isn't so bad and it helps reduce MJEs and estimates including any related reversing entries. Our accounting staff also reviews all JEs prior to final close despite being understaffed.