The situation
This is an illustrative scenario. It is a composite built from patterns common in this kind of work and does not describe any real client.
A regional distributor of building supplies, owned by the second generation of its founding family, runs four branches and a central warehouse with about 140 employees. Its main outside reader is a lender, which provides an asset-based revolving line secured on receivables and inventory. The finance team is five people: a controller, a senior accountant, two clerks covering payables and receivables, and a payroll administrator. The books run on Microsoft Dynamics 365 Business Central, with purchasing, inventory and sales in the same system and bank activity imported each morning as BAI2 files.
The senior accountant, eleven years with the company, ran the month-end close, prepared the freight and rebate accruals, and produced the gross margin report the owners reviewed every Monday at 8:00. Along the way the role had gained approval rights for journal batches, so the close would not stall while the controller visited branches.
A new CFO joined shortly after the company renewed its credit line. The lender's annual field exam was four months away, and the CFO wanted an outside view of the books before it. The owners agreed to a fixed-scope diagnostic using full-ledger analytics. Nobody suspected anything in particular.
What we did
In the first two days the engagement lead agreed the scope with the CFO: twenty-four months of general ledger detail, the Business Central user and permission set listing, the change log for approval workflows and posting date settings, and the close calendar. A forensic data analyst loaded about 1.6 million ledger lines and ran the standard test library over every one of them: timing, authorship, amounts, period-end activity, reversals and gaps in document numbering.
The timing tests produced the first clear signal. Across the company, manual journal entries posted outside 07:00 to 19:00 on weekdays were rare, and most came from the controller during audit fieldwork. One user ID accounted for nearly all the rest: 47 manual entries over 11 months, posted on Sunday evenings between 21:10 and 23:55. The authorship test flagged the same entries for a second reason. Each had been created and approved by the same user, the senior accountant, usually within two minutes.
The amount and pattern tests filled in the shape. The entries ranged from $18,000 to $142,000, and most were rounded to the nearest thousand. Almost every one moved cost between cost of goods sold and three balance sheet accounts: accrued freight, vendor rebates receivable and inventory. Thirty-nine of the 47 were reversed in the first week of the following month, on a Monday or Tuesday. Descriptions were short and generic, such as "reclass per review" or "rebate true-up", and none had an attachment.
A statistical outlier model looked at the monthly gross margin series itself. Reported gross margin had stayed between 22.4 and 23.1 percent for eleven straight months. Rebuilt without the Sunday entries, the same months ranged from 20.6 to 25.2 percent, and the swings lined up with the timing of quarterly rebate settlements and fuel-driven freight costs.
No flag went further until a person had reviewed it. The controls specialist walked through six entries with the controller, then with the senior accountant, asking what each was meant to achieve.
What we found
The explanation was consistent and, on its own terms, sincere. The owners had made clear for years that they expected gross margin "around 23". Branch managers' bonuses were calculated on monthly branch margin. Large rebate payments arrived quarterly, and freight invoices lagged deliveries by several weeks, so real margin swung from month to month. The senior accountant saw those swings as timing noise. Sunday evening, after the weekend's last deliveries had posted and before the Monday meeting, was when the month got "trued up". No money left the company and no one benefited personally. Over a full year, the entries netted close to zero.
That did not make them harmless. The findings register ranked five items by consequence:
- Monthly results were misstated. The numbers the owners and branch managers used for pricing and bonus decisions had been adjusted to look stable. A steady decline in rebate income at one branch stayed hidden for most of a year.
- Two quarter-end entries capitalized freight into inventory. That raised the inventory value reported on two borrowing base certificates sent to the lender. The CFO took that question to the company's counsel and then to the lender. It was not ours to resolve.
- One person could create and approve journal entries. The approval workflow listed the senior accountant as an approver for every journal batch, including batches the same user had created.
- Posting periods stayed open for ten days after month end. Entries could be dated into a month after its results had already gone to the owners.
- No one reviewed manual entries as a population. The controller reviewed account reconciliations, which tied out, but never the list of manual entries behind them.
The report stated what the data showed, what people said and what each finding could cost. It did not decide intent. Decisions about the senior accountant's role belonged to the company.
What changed
The CFO and controller chose to fix the system first and to handle the people questions separately.
Over a ten-week segregation-of-duties project, journal entry rights were split. The senior accountant kept the ability to prepare entries but lost approval rights. Manual entries above $10,000 now route to the controller, and entries the controller prepares route to the CFO. The approval workflow was changed so the creator of a batch can never approve it, and the change was tested by attempting exactly that. Posting dates now close on the fifth business day after month end, and reopening a period needs the CFO.
The close checklist gained a step. Before results go to the owners, the controller reviews a system report of every manual entry for the month, sorted by amount, showing author, approver and whether support is attached. Entries without support go back to the preparer.
The owners changed one thing themselves. The Monday report now shows actual gross margin by branch, with a short note on rebate and freight timing, instead of one company figure. Branch bonuses moved to a quarterly calculation.
The analytics that found the pattern became a continuous controls monitoring subscription after a six-week setup. Each week the tests look for entries posted outside working hours, entries approved by their author, entries dated into a closed period, round-number entries above $10,000 and reversals within five days. Exceptions go to the controller, the CFO receives a monthly exception report, and a quarterly review checks whether the tests still fit the business. A half-day session for the finance team walked through each test and what to do when one fires.
The field exam went ahead on schedule. The CFO briefed the lender beforehand on what had been found and what had changed.
What to take from it
Most problems that full-ledger analytics surfaces are not theft. They are well-meant workarounds by capable people under pressure, made possible by a permission someone granted for convenience. That makes them easy to miss in a sample and easy to excuse once found. They still misstate the numbers that owners, lenders and buyers rely on.
Three questions are worth asking of your own close this month. Who can approve an entry they created? When did anyone last look at every manual entry as a single list? And does the way results are reviewed reward a stable number over an accurate one? The Segregation-of-Duties Conflict Finder is a quick way to start on the first.