Journal Entry Testing Is Where ISA 240 and AI Actually Meet

Journal entries are the single most useful population in a fraud audit, and from December 2026 they carry a requirement that did not exist before. They are also, not coincidentally, the worked example the Financial Reporting Council chose when it published the world's first regulator guidance on using artificial intelligence in audit. Those two facts belong together.

Why journals, and not something else

The reason journal entries matter disproportionately is structural. Most financial statement manipulation has to pass through the ledger, and a manual or non-standard entry is the cheapest way to move a number after the fact. ISA 240 works from a presumption that management override of controls is a risk present in all entities, and journal testing is the procedure that engages that risk most directly.

ISA 240's application material names the techniques it expects auditors to have in mind, covering both manipulation of records and override of controls. The point of listing them is not to produce a checklist but to establish that the risk is specific rather than generic, which is what makes the population worth interrogating rather than sampling casually.

What changes in December 2026

ISA 240 (Revised) was issued on 8 July 2025 and takes effect for periods beginning on or after 15 December 2026, alongside ISA 570 (Revised 2024) on going concern.

The change that matters for journal testing is a requirement addressing the completeness of the population of journal entries. Under the extant standard, an auditor selecting entries from a listing is implicitly relying on that listing being complete, and a great deal of practice has treated completeness as assumed. The revised standard makes the auditor's work on completeness an explicit obligation rather than an implicit assumption.

The practical consequence is a different first step. The question is no longer only which entries to test, but how the auditor knows the extract contains every entry posted in the period, including entries posted directly to the ledger outside the normal sub-ledger routes, entries reversed within the period, and entries made by system or interface accounts rather than by named users.

Two cautions before anyone plans around a paragraph number. Paragraph numbers moved between the extant and revised standards, in some cases twice, and citations taken from secondary sources are frequently wrong as a result. And we were unable to verify from the IAASB's published pages whether ISA 240 (Revised) addresses automated tools and techniques in its own text. That is an absence of evidence on summary pages rather than evidence of absence in a standard of well over a hundred pages, and we are not going to assert it either way. If the point matters to your planning, read the final pronouncement.

The FRC chose journals as its AI example, and that was not accidental

On 26 June 2025 the FRC published AI in audit: Illustrative example and documentation guidance. Its worked use case is the application of AI to enhance procedures over journals.

The choice makes sense. Journal populations are large, highly structured, and full of weak signals that no sampling approach handles well: unusual posting times, round-sum amounts, rare account combinations, entries by users who post infrequently, reversals that cross a period end. These are exactly the patterns a model can rank and a human cannot scan. Journals are also the area where auditors most often already run data routines, so the guidance met firms where they were.

The FRC was explicit about the guidance's status: it is not prescriptive and does not introduce new regulatory requirements. It sets out expectations around proportionate, appropriate documentation of tools that use AI, outlines a coherent approach to implementing a hypothetical AI-enabled tool, and addresses tools obtained from third parties. Its definition of AI encompasses both traditional machine learning and deep learning models, including generative AI, so a firm cannot place a journal-scoring routine outside the guidance by calling it statistics.

Two features of the guidance are worth adopting regardless of whether you use AI. It aims explicitly at proportionality and at avoiding over-documentation, which is a more useful steer than it sounds for a procedure that can generate enormous evidence files. And it treats explainability as varying with context and use rather than as a fixed standard, which is the right frame for a tool whose output is a ranked population rather than a conclusion.

Where accountability sits

The FRC returned to the subject on 30 March 2026 with its Generative and Agentic AI Guidance, the first publication of its kind from any audit regulator globally. It offers a framework for judging how much confidence to place in an AI tool's output and leaves the specific mitigating steps to professional judgement. Its central proposition is that the human auditor is always accountable, and it directs firms to consider their AI use within their existing quality management obligations under ISQM (UK) 1, with the engagement partner's responsibilities under ISA (UK) 220.

That matters for journal testing specifically, because a ranked population is a seductive output. A model that surfaces two hundred entries out of four hundred thousand has not concluded anything. The auditor still has to establish that the population was complete, that the ranking criteria address the fraud risks actually identified for that entity, and that the entries not surfaced were not surfaced for a reason. Our piece on what the FRC guidance does and does not require covers the status question in full, including why non-mandatory guidance is not safe to ignore.

A practical sequence

Establish completeness of the journal population first, and document how. That ordering is what the revised standard makes explicit, and it is also the step an AI tool cannot do for you, since a model can only rank what it is given.

Derive the testing criteria from the entity's assessed fraud risks rather than from a generic list of red flags. An entity with a revenue recognition risk and an entity with an expense capitalisation risk should not be running the same journal filters.

Record who exercised judgement over the output and on what basis. This is where accountability lands, and it is the documentation the FRC's framework is built around.

Keep the documentation proportionate. The FRC's own preference is against over-documentation, and a journal routine can easily produce evidence nobody will read.

And separate the standard from the guidance in your working papers. ISA 240 (Revised) is a requirement from 15 December 2026; the FRC material is guidance against which judgement will be assessed. Confusing the two in either direction is the error our analysis of ISA 240 (Revised) and of mandatory versus non-mandatory text in the IIA Standards both warn against. The FRC's publications are listed on its AI in audit library page.