Aipedia: Auditors

Machine learning journal entry testing

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

Machine learning tools can score every journal in a ledger and flag the unusual ones for fraud testing, but the auditor still decides what counts as unusual and must show why. Journal testing sits at the heart of fraud procedures, so a badly set tool can leave the riskiest entries untested.

Part of: AI in Auditors

In short

Journal entry testing is the use case the FRC chose for its June 2025 AI guidance. Its fictional firm combines a machine learning model with rules-based routines, calibrates thresholds and checks data quality before relying on the flags. The lesson is that the tool narrows the population but the judgements stay human. Under ISQM (UK) 1 the firm must certify the tool, and under ISA (UK) 230 the file must show the version used, the input checks and how the flags shaped the work. If fraud is later found in entries the model scored as normal, a PI claim is likely to test those records.

How auditors use AI on journals

Traditional journal testing relies on rules: entries posted at weekends, round sums, postings by senior staff, unusual account pairings. Machine learning tools add pattern detection. They learn what a client's normal journals look like and score each entry by how far it departs from that pattern, so the team can focus on a short list instead of a long rules-based extract.

This is the example the FRC used in Part 1 of its AI in audit guidance (June 2025). The fictional firm builds an in-house tool within its fraud procedures and has to decide which model to use, how to combine it with existing rules-based routines, where to set thresholds and how to check the quality of the ledger data. The FRC presents these as judgements to be made and recorded, not as settled answers.

The duties that apply

ISQM (UK) 1 paragraphs 32(f) and (g): the firm must have appropriate technological resources, which the FRC treats as including certification of AI tools before use.
ISA (UK) 230 paragraph 8: the file should let an experienced auditor understand what was done. The FRC suggests recording the tool and model version, why use was appropriate, the input completeness and accuracy checks, central approval and how the outputs informed judgements.
ISA (UK) 220: the engagement partner remains responsible for the quality of the engagement, including the decision to rely on the tool.
Explainability: the FRC says the level of explainability needed depends on the use. For fraud work, the team should be able to say why an entry was or was not flagged.

What can go wrong

Illustrative scenario: an audit team runs a journal tool across a client's full ledger. The threshold is left at the default, which suits a larger client with more varied postings, so only a handful of entries are flagged and all are cleared. Months later, a finance employee is found to have posted false accruals in small, regular amounts that looked like routine month-end entries. The model scored them as normal because they had become part of the pattern it learned. The company, now under new management, claims the auditor should have found the fraud.

Other failure points include an incomplete ledger extract (the tool cannot flag what it never received), a model trained on a period that already contained the manipulation, and teams treating 'no flags' as evidence that no further fraud work was needed.

How PI usually responds

Failure-to-detect-fraud claims are among the more serious claims auditors face, and they often follow insolvency or a change of control. An audit firm's PI policy would usually respond to the negligence claim in the normal way, subject to its terms, limit and excess; the use of a model does not of itself take the claim outside cover. The defence will turn on whether a competent auditor would have set and challenged the tool as the firm did, which is why the central record and file notes matter. Questions of causation, contributory fault and scope of duty can reduce the recoverable loss; see the note on Barings v Coopers & Lybrand and fraud detection and audit firm PI cover.

If one miscalibrated setting was used across several audits, each affected client may have its own claim, and how the policy aggregates them will matter.

Practical controls

Reconcile the ledger extract to the trial balance before running the tool, and keep the evidence.
Set thresholds for each engagement and record the reasoning, rather than accepting defaults.
Keep rules-based tests for known fraud risks alongside the model, as the FRC example does.
Sample some low-scored entries to test whether the model is missing things.
Record the tool and model version on file, and check it matches the centrally certified version.
Read the firm's tool certification and know the limits it records.

For wider analytics, see full-population data analytics and the FRC guidance explainer.

How Apex helps

Apex arranges PI for audit firms and can review how your policy would treat a fraud-detection claim where AI tools were part of the work. More on the AI in audit hub.

Sources

Frequently asked

Does the FRC approve machine learning for journal testing?

The FRC does not approve tools. Its June 2025 guidance uses a fictional journal tool to illustrate the judgements involved and the documentation expected. Whether a particular tool is appropriate is for the firm to decide and evidence under ISQM (UK) 1.

Can a machine learning tool replace rules-based journal tests?

The FRC's worked example combines AI with rules-based routines rather than replacing them. Keeping targeted rules for known risks is a sensible safeguard, because a model that learns a client's normal pattern can treat a long-running manipulation as normal.

What should the file say about the journal tool?

The tool and model version, why it was appropriate for this client, how the completeness and accuracy of the ledger extract were checked, that the tool was centrally approved, how thresholds were set, and how the flagged and unflagged entries informed the auditor's conclusions.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.