Resources
Can a CFO Post Journal Entries Without Independent Review?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
A CFO may be allowed to post journal entries. But rank does not replace review. The segregation of duties question is who checks the entries the CFO posts, and when. As Controller, find out which entries the CFO can post, who reviews them, and what proof is kept. Raise any gap with the person who oversees finance.
Why do these entries matter?
Journal entries change the numbers in the books. Most are routine. Some are not. A manual entry late in the period, or after the books close, deserves more care. The entry may be entirely proper. The question is whether an appropriately independent, competent reviewer examines the entries selected by the company’s risk-based procedure.
Which entries need more attention?
Sort entries by risk. Higher-risk examples are manual entries, entries made near period end or after close, entries to unusual accounts, and adjustments made outside the normal flow. Write down which kinds your company treats as higher risk. Then determine which entries require pre-posting approval, which receive timely post-posting review, and whether a higher-risk subset needs enhanced scrutiny. The selection criteria and any exceptions should be documented.
Should the review happen before or after posting?
| Approach | What it does | What it needs |
|---|---|---|
| Review before posting | Stops an entry from reaching the books until someone else approves it | A system step that enforces it |
| Review after posting | Finds problems later | Clear timing, a list of entries to check, and a record of follow-up |
Management should choose based on the risk of the entries. After-the-fact review only works if it happens on time and leaves proof.
Who can review a senior leader’s entry?
This is a question of governance. A staff member who reports to the CFO may find it hard to challenge the CFO. Depending on the company’s governance structure, management and the audit committee may designate a reviewer outside the CFO’s direct influence. The reviewer needs sufficient independence, authority and accounting competence to challenge the entry and follow up. A CEO, audit committee chair or outside reviewer is not automatically qualified or independent for every entry. Agree on an escalation route and document who performs the review.
What proof should I keep?
Keep who prepared and posted the entry, the business reason, supporting documents, account coding, amount, posting date and period, who reviewed it, the review date, any questions raised, and how they were resolved. The reviewer should examine whether the entry is supported, reasonable and appropriately recorded, not merely sign a list. Ask the system owner whether the audit trail shows posting rights and any overrides.
Example (illustrative)
Near the end of a quarter, the CFO posts a manual adjustment. The Controller sees that the system lets the CFO post without approval. She asks the audit committee chair to name a reviewer. Under the company’s approved risk-based procedure, the designated reviewer receives the relevant CFO-posted entries and their support at a frequency suited to the risk, including unusual or late-period entries. The reviewer documents the checks performed, questions and resolutions. The Controller retains the evidence without being made responsible for overriding the CFO.
Questions people ask
Must every entry be approved before posting?
There is no one answer for every company. Look at the risk of the entries, and at how the review is designed and carried out.
Does a CFO’s title count as approval?
No. A title is not proof that someone else reviewed the entry.
Does this mean the CFO did something wrong?
No. It is a question about how the review is set up.
Is this the same as a user access review?
No. Segregation of duties focuses on conflicting responsibilities or access. A user access review asks whether access is appropriate more broadly.
Your next step
List who can create, post, approve and reverse entries. Mark which of the CFO’s entries are higher risk. Use the free How to Check That a Control Reduces the Risk: Confirm Safeguards Worksheet to list the safeguard, its owner, who checks it, and the proof it leaves. Use the free How to Record Segregation of Duties Decisions: Keep a Record of Decisions Worksheet to record the review you choose, who decided and why.
Then read these articles:
- How Do I Know Whether a Control Reduces a Segregation of Duties Risk?
- What Should I Record After a Segregation of Duties Review?
About SOD Check
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change. A potential conflict does not prove fraud or a control failure.