Accounting, Audit and Financial Compliance

01Purpose and scope

• This manual supports the course Accounting, Audit and Financial Compliance. It is written as a working reference for staff accountants, controllers, internal and external auditors, compliance analysts, and learners who are moving into these roles and need to see how the work is actually carried out.
• The work covers four connected activities. Accounting records transactions and produces financial statements. Audit examines whether those statements and the controls behind them can be relied on. Financial compliance checks that the organization meets the reporting, tax, lending, and regulatory obligations that apply to it. Internal control sits across all three, because it determines how errors and irregularities are prevented or caught.
• Practice changes a great deal by context. A small private company may have one bookkeeper, an outside accountant, and an annual review. A listed company has quarterly reporting deadlines, external auditors who must be independent of management, and disclosure rules enforced by securities regulators. Public sector bodies follow their own fund accounting and appropriation rules. Nonprofits face donor restrictions. The principles in this manual apply everywhere, but the detailed procedures, thresholds, and deadlines do not.
• This guidance does not replace qualified professional judgment, approved firm or employer procedures, or required authorization. Where rules depend on jurisdiction, such as tax filing, securities disclosure, anti-money-laundering reporting, or data retention, check the current requirements with the authoritative regulator or a licensed advisor in your location before acting.

02Core principles

• Financial information is useful when it is accurate, complete, recorded in the correct period, correctly classified, valued on the agreed basis, and presented clearly. Auditors often describe these attributes as assertions about occurrence, completeness, cutoff, classification, accuracy and valuation, and presentation and disclosure. Each account balance can be traced back to one or more of these assertions, which tells you what evidence to look for.
• Professional skepticism means you do not accept a figure just because it came from a trusted system or a senior person. You ask what would have to be true for the number to be right, and you look for evidence that could show it is wrong. Skepticism is not hostility. Most of the time the explanation is ordinary, but the work only has value if someone checked.
• Segregation of duties is the most common control principle in practice. The person who approves a vendor should not also release payment to that vendor. The person who records journal entries should not be the only person who reviews them. When staff are too few to separate duties fully, compensating controls such as independent review of bank activity and management sign off on exceptions become essential.
• Materiality is a judgment about how large an error must be before it could change the decisions of people relying on the statements. It is set in relation to a benchmark such as profit, revenue, or net assets, and it is revisited as the work progresses. Materiality helps focus effort, but it does not mean small errors are ignored. Errors that are individually small can indicate a broader control failure, and qualitative factors such as fraud, regulatory breaches, or effects on covenants can matter even when the amount is small.
• Every principle involves a trade-off. More testing increases confidence but raises cost and delays reporting. Tighter controls reduce risk but can slow transactions and frustrate operations. The job is to match the depth of work to the risk, and to be able to explain that choice.

03Planning and preparation

• Start by defining the scope in writing. For a close, scope means which entities, ledgers, bank accounts, and reporting packages are included, and which reporting framework applies, such as U.S. GAAP, IFRS, or a government or tax basis. For an audit, scope includes the period, the financial statements, any special reports, and the agreed timetable. For a compliance review, scope means the specific rules, filings, or contracts being tested. Ambiguity here causes most rework later.
• Understand the entity before testing anything. Read the prior year statements and audit or review findings, the organization chart, key contracts and loan covenants, the chart of accounts, and the systems used to record transactions. Talk to the people who run the processes. Ask what changed during the year, such as a new product line, an acquisition, a system migration, a staffing change, or a shift in customer terms. Each change is a source of risk.
• Prepare a request list early. For an audit this is often called a provided by client list, and it names each document, report, or system extract needed, with an owner and a due date. Ask for data in native form where possible, such as a full general ledger export with user identifiers and timestamps, rather than summary printouts. Confirm that the data is complete by reconciling it to totals in the financial statements before you analyze it.
• Assess risk at the planning stage. Identify areas where misstatement or noncompliance is more likely, such as revenue recognized at a point in time versus over time, inventory counts at multiple locations, significant estimates like loss allowances or warranty reserves, related party transactions, and manual journal entries posted near period end. Document the risk, the assertion at stake, and the planned response. A planning memo with these items gives the team a common picture.
• Set the timetable with realistic dependencies. The bank reconciliations must be complete before the cash balance can be tested, and the fixed asset register must agree to the general ledger before depreciation can be reviewed. Build in time for queries, which in practice often take longer than the original work.

04Recommended workflow

1. 1
   : Confirm the engagement or review scope, reporting basis, and deadlines with the responsible person, and record the agreed terms in an engagement letter or task memo. Identify who signs off on each deliverable and who has authority to accept changes in scope.
2. 2
   : Obtain and validate the data. Pull the trial balance, general ledger detail, subledgers, and bank statements directly from source systems where possible. Check that the trial balance balances, that subledgers agree to control accounts, and that the population you intend to test is complete. Keep a record of how each extract was produced and who produced it.
3. 3
   : Perform analytical procedures on the population. Compare current balances with prior periods, budgets, and expectations built from known drivers such as headcount, volume, or rates. Investigate significant differences by asking what explains them and what evidence would support that explanation. Analytics do not prove a balance is correct, but they point effort where it belongs.
4. 4
   : Reconcile key accounts. Agree bank balances to bank confirmations or statements, reconcile accounts receivable and payable to subledgers, and tie accrued liabilities to supporting calculations. Review reconciling items individually. Items that remain open for a long time, or that are cleared without support, should be escalated.
5. 5
   : Test controls and transactions. Select samples using a method suited to the risk, whether that is random selection, selection of all items above a threshold, or targeted selection of unusual items. For each sampled item, inspect the underlying evidence such as invoices, contracts, approvals, shipping documents, and cash receipts. Record the attribute tested, the result, and any exception. When an exception is found, determine whether it is an isolated error or a sign of a control weakness, and extend testing if needed.
6. 6
   : Evaluate results and form conclusions. Summarize misstatements found, both those corrected and those left uncorrected, and compare the total against materiality. Consider whether the control deficiencies identified, individually or combined, represent a significant deficiency or material weakness under the applicable framework. Discuss proposed adjustments with management and record their response.
7. 7
   : Report and follow up. Issue the deliverable in the agreed form, whether that is a set of financial statements, an audit report, a compliance memo, or a management letter on control matters. Track each finding to a named owner and a target date, and confirm remediation in the next cycle rather than assuming it happened.

05Quality checks, risk controls and compliance

• Quality depends on review at several levels. Preparers should check their own work against a list of standard checks, such as tie-outs, reasonableness of estimates, and completeness of disclosures. Reviewers should examine the working papers, not just the summary, and should ask for evidence where the notes are thin. Partners, controllers, or engagement leaders should review areas of judgment, significant risks, and any matters that will go to the audit committee or board. Document each review with a date and reviewer name, and retain the evidence that the review took place.
• Working paper standards matter because another person must be able to understand what was done and why without asking the preparer. Each schedule should show its source, the procedure performed, the result, and the conclusion. Cross references should link schedules to the financial statements and to supporting evidence. Tickmarks should have a legend and should not be used to mean different things in different files.
• For public companies in the United States, the Sarbanes-Oxley Act requires management to assess internal control over financial reporting, and external auditors to attest to that assessment for certain filers. Many organizations use the COSO internal control framework to structure that assessment. Auditors in the United States follow standards issued by the Public Company Accounting Oversight Board for listed company audits and by the American Institute of Certified Public Accountants for private company audits. Internationally, the International Standards on Auditing apply in many jurisdictions. Confirm which standards apply to your engagement with the engagement letter and your regulator.
• Compliance work adds specific obligations. Tax filings have their own deadlines, forms, and elections. Lending agreements often require financial ratios and reporting packages on fixed schedules. Anti-money-laundering, sanctions, and data protection rules may require documented policies, staff training, and records retention. Each obligation should be listed in a compliance calendar with an owner, a source reference, and a method of evidence. Where a rule is unclear, ask the regulator, outside counsel, or a qualified tax or legal advisor rather than relying on a general interpretation.
• Independence and conflicts of interest need active management. An auditor may not perform management functions or audit work that the auditor designed. Internal staff who also prepare the statements should not be the only reviewers of those statements. Record independence confirmations at the start of each engagement and update them when circumstances change.

06Collaboration and documentation

• Accounting and audit work depends on steady communication with the people who hold the records. Agree on a single point of contact for each area, a shared request tracker, and a regular status call during busy periods. Send written queries with specific questions and deadlines rather than broad requests. When a response is incomplete, say exactly what is missing and why it matters for the conclusion.
• Keep a clear line between information you have obtained and conclusions you have drawn. A file note should record who said what, when it was said, and whether the statement was corroborated by documents. Oral explanations are useful, but they are weak evidence alone. If management gives an explanation for an unusual entry, look for an invoice, contract, or approval that supports it.
• Documentation should be sufficient for an experienced reviewer with no prior involvement to understand the work. Retain the trial balance used, the population and sampling method, the evidence examined, the exceptions and how they were resolved, and the final sign off. Store files in an approved location with access controls, and follow the retention periods set by law and by the engagement terms. Do not keep personal data or client information in personal email or unapproved storage.
• Communication with those charged with governance is a specific obligation in audits and a good habit in internal reviews. Summarize significant findings, control deficiencies, unusual transactions, and disagreements with management in plain language. Give the rationale for each matter and the likely effect on the financial statements or on compliance.

07Measures and continuous improvement

• Track indicators that show whether the process is working. Useful measures in accounting include the number of business days to complete the month end close, the number of post close adjustments, the percentage of bank and balance sheet reconciliations completed on time, the number of reconciling items older than an agreed age, and the number of manual journal entries posted after the close. In audit and compliance, useful measures include the number of significant findings, the time taken to clear queries, the rate of exceptions in control testing, and the number of findings remediated by the agreed date.
• Interpret indicators with care. A short close is not automatically better if it came from skipped reviews. A rising number of adjustments may reflect better detection rather than worse processes. Compare results over time within the same organization, and be cautious about comparing across businesses that differ in size, complexity, or systems. Avoid setting targets that encourage people to hide problems.
• Use review results to improve the process. After each engagement or close, hold a short debrief that asks what took longer than expected, which data sources caused problems, which controls were hard to test, and which findings recurred. Update the checklists, request templates, and system reports based on what you learn. Assign each improvement an owner and check whether it worked in the next cycle.
• Technology changes the work but does not remove the need for judgment. Automated reconciliation tools, data analytics, and robotic process automation can test full populations rather than samples, but they depend on the quality of the data and the logic built into them. Test the tool itself before relying on it, and document the logic, parameters, and the population it covered.

08Common mistakes and how to prevent them

• Relying on a balance without testing its composition is a common error. A bank reconciliation that agrees the total cash figure may still hide a large stale check or a transfer recorded twice. Prevent this by reviewing the reconciling items individually and by checking the age and nature of each one.
• Accepting a management explanation without evidence is equally common. The explanation may be honest and still be wrong. Ask for the document that supports it, and note in the file when none was available. Treat missing evidence as a finding to be resolved, not a detail to be overlooked.
• Sampling from the wrong population produces misleading results. If the sample is drawn from a summary report that excludes some transactions, the conclusion does not cover those transactions. Before sampling, confirm the population is complete by reconciling it to the control total, and document that reconciliation.
• Ignoring cutoff near period boundaries causes many misstatements. Revenue, expenses, and liabilities recorded just before or after the year end are a frequent source of error. Test a sample of transactions on both sides of the boundary, and check subsequent receipts and payments that relate to the period.
• Treating compliance as a one-time exercise leads to gaps. Filings, covenant tests, and policy reviews recur. Keep a calendar with owners, and check each recurring obligation against the current rule, because requirements change.
• Poor documentation hides the reasoning behind a conclusion. Preparers often remember why they did something, but reviewers and future staff do not. Write the rationale down at the time the work is done, especially for judgments about materiality, risk, and significance.

09Practical checklist

• Confirm the scope, reporting basis, period, and deadlines in writing before starting work.
• Obtain the trial balance and full general ledger detail, and reconcile them to the reported totals.
• Identify significant risks and record the assertions and planned procedures for each.
• Reconcile bank accounts, receivables, payables, and accrued liabilities to source records and review each reconciling item.
• Select samples from a complete population and document the selection method and the reason for it.
• Inspect source evidence for each sampled item and record the result, including exceptions.
• Evaluate misstatements and control deficiencies against materiality and the applicable framework.
• Confirm the regulatory and tax obligations that apply in the relevant jurisdiction with the current authoritative source.
• Obtain independent review of judgments, estimates, and significant findings before issuing the deliverable.
• Log each finding with an owner, a target date, and a remediation check for the next cycle.

★Learning sources

• Micro Degree: Accounting, Audit and Financial Compliance
• Micro Degree: Leadership and Team Management
• Micro Degree: Business Intelligence Management
• Micro Degree: ESG Advisory Services