What should a checklist for auditing or reviewing a business's bookkeeping contain?

What does the checklist examine, and what can it conclude?

It examines the bookkeeping itself: whether transactions are all captured, recorded at the right amount, date and account, kept current, supported and protected from unauthorized change. Its output is a findings list about those records, not a view on financial statements.

The AICPA's explainer on compilations, reviews and audits says that in an audit an independent CPA performs verification and substantiation procedures, obtains "high, but not absolute assurance" and gives an opinion on the financial statements; in a review an independent CPA performs inquiry and analytical procedures for limited assurance; and in a compilation the CPA "does not provide any assurance". This work is none of those, so present the output as a findings list on the bookkeeping, state its period, areas and method, and say it is not an audit or a CPA review and gives no assurance. Ask a CPA how to describe the work before sharing it outside the business.

Balance proves little: IRS Publication 583 calls double-entry bookkeeping "self-balancing", so a ledger with a fictitious purchase still balances.

How do you scope the examination?

The Institute of Internal Auditors' Global Internal Audit Standards require an engagement's scope to specify, among other elements, the "locations, processes, systems, components, time period to be covered". For bookkeeping, set four boundaries and one threshold:

• Period. Cover the months under review plus the opening balance of every balance-sheet account, traced back until each balance is supported by an outside record, however many periods that takes, because those accounts carry errors forward for years.
• Accounts. Start with cash, cards, loans, receivables, payables, payroll and sales-tax liabilities, equity and suspense accounts, then the income and expense accounts of the processes in scope.
• Processes. Choose from sales and receipts, purchases and payments, payroll, bank and card feeds, manual journal entries and the period close.
• Threshold. Agree with the owner the smallest error that would matter, as a dollar amount.
• Depth. Choose it by purpose, as the next table shows.

Who will rely on the result, any suspected problem, the history the system keeps and whether the bookkeeper also handles money drive each choice.

Which depth fits your purpose?

How does your relationship to the books change what you can say?

Which areas does the checklist cover, and what counts as an exception?

The payment-detail row is the checklist's own standard, not one taken from a standard-setter, agency or vendor; how to confirm a change belongs to the related question on one person recording, paying and reconciling.

Three areas take a rule or test from outside the books:

• Reconciliation. IRS Publication 583 advises: "You should reconcile your checking account each month." Extending that test to every bank, card and loan account, with the next-statement limit for reconciling items, is the checklist's own standard, not an IRS rule.
• Cutoff. Publication 583 says that under the cash method you report income when you receive it and usually deduct or capitalize expenses when you pay them, and under an accrual method you generally report income when you earn it and deduct or capitalize expenses when you incur them. It requires the same method for the books and for taxable income, so test cutoff against the method the return uses.
• Journal entries. AS 2401, the PCAOB's fraud standard, gives traits for selecting entries to test, including entries to unrelated, unusual or seldom-used accounts, entries "made by individuals who typically do not make journal entries", period-end or post-closing entries with "little or no explanation or description" and entries "containing round numbers or a consistent ending number". Test every manual entry with one of these traits; a trait alone is not an exception.

How do you choose items to test, and when do you test more?

AS 1105, the PCAOB's audit-evidence standard, names three means of selecting items: all items, specific items and sampling, and says results from specific items "cannot be projected" to the whole population, so testing only large entries says nothing about small ones.

AS 2315, the PCAOB's sampling standard, has auditors examine in full the items "for which, in his judgment, acceptance of some sampling risk is not justified"; its example is items whose potential misstatement could alone reach the tolerable misstatement, the most misstatement an account can hold without the financial statements being materially misstated. In bookkeeping, these include every entry at or above the amount agreed at scoping, manual cash entries, payments to the owner or related parties and closed-period changes; sample the rest. For that sample, the standard says "all items in the population should have an opportunity to be selected" and names haphazard and random-based selection as two ways to get a representative sample: pick at random or haphazardly, without regard to how items look. To test capture, it has the sample drawn "from a source in which the omitted items are included": bank, card and supplier records, not the ledger.

Extend testing on these triggers; AS 2315 notes that fraud "ordinarily requires a broader consideration of possible implications" than an error.

How do you test that supporting documents exist?

Retrieve them during the check and match amount, date, counterparty and purpose. IRS Publication 583 says expense documents should show "the amount paid and that the amount was for a business expense", and that proof of payment by itself does not establish a deduction.

AS 1105 says that, in general, evidence from "a knowledgeable source that is independent of the company" is more reliable than internal evidence, but that the reliability of electronic records the company received, and of digitized copies, depends on the company's controls over them. An attached invoice is one of these, so where the bookkeeper controls those files, trace selected invoices to payments on statements you obtained directly.

Count missing support as an exception. AS 2315 recognizes that "supporting documentation may be missing" and has auditors weigh what that implies about "the integrity of management or employees"; clear such an entry only with other evidence.

What can the change log and user list show?

Change history varies by product, as these vendor pages show:

• QuickBooks Online audit log. Intuit's help page "Use the audit log in QuickBooks Online", updated 8/4/2026, says the log tracks "not only financial transactions but all account activities", including edits to customers, vendors and employees, can be searched for a deleted invoice, keeps events for two years and cannot be turned off. It lists admin access as a requirement, so a checker without it must get access from the primary admin before starting.

  The same page says QuickBooks logs some actions under profiles it creates: Online Banking Administration (automatic changes related to connected bank accounts), Support Representative (changes by a QuickBooks Online support consultant) and System Administration (automatic changes, such as an edit's knock-on change to another record, or data a connected third-party app sends or changes). Before treating such an event as a finding, trace it to the edit, bank connection, app or support request behind it.

• QuickBooks Online closed books. Intuit's page "Edit your closed books in QuickBooks", updated 8/5/2026, says only admins can change the closing date or its password, and that an Exceptions to Closing Date report shows "any changes made after you close your books".
• Zoho Books. Zoho's undated U.S. help page "Does Zoho Books have Audit Trail?" says the trail shows "how, when and who modified a transaction", saves a new version with each change and requires Admin access to view.

Read the log in the system with your own login, filter it for deletions, closed-period changes, entries by users who do not normally post and edits to customer, vendor and employee records, and keep a dated copy of each run's filtered results (an export where the product offers one, otherwise a saved report or dated screenshots).

Neither log described above is said to record why a change was made or whether it was right, so the reason has to come from a record kept outside the log. No log shows who used a shared login, changes made before entry or in a spreadsheet feeding the ledger, or anything before its retention period or the system's start.

How do you rate findings and tell them from matters of style?

The IIA's standards treat a difference between "the evaluation criteria and the existing state of the activity under review" as a potential finding. Their examples of adequate criteria run from internal policies, procedures and targets and external "laws, regulations, and contractual obligations" to authoritative practices such as frameworks and standards, established organizational practices, expectations based on a control's design and procedures that may not be formally documented. So a finding names the criterion it breaches: a law, tax rule or contract, the accounting method or standard the business follows, its policies and practices, written or not, or the checklist line's evidence test. A preference that breaches none, such as account names, memo wording or a consistent coding habit, is a style note, kept off the findings list unless it causes misclassification.

The same standards judge significance by the likelihood of a risk and "the impact the risk may have". Use the first row that applies.

How are findings owned, fixed and re-checked?

The IIA's standards require the final communication to "specify the individuals responsible" for addressing findings and "the planned date by which the actions should be completed". Confirming implementation includes "Performing follow-up assessments using a risk-based approach", and when actions miss their dates, internal auditors "must obtain and document an explanation from management".

Log each finding with an ID, area, condition, criterion, severity, owner, fix, due date, re-check method and result. Close it only when a re-check on fresh items passes, re-checking High findings at their due date and others at the next run. If a fix misses its date, record the owner's explanation and raise it with the business owner, who decides whether to accept the risk.

This extract shows how the lines connect.

What changes when you have just taken over the books?

Set a baseline first, since a difference may reflect a convention you have not yet learned:

1. Agree each balance-sheet account at the takeover date to outside statements and to the last closed period's figures.
2. Export the chart of accounts and note accounts in use, duplicates and suspense balances.
3. Write down the conventions applied: basis, bank-feed rules, classes or locations, and approvers.
4. Record how invoices and bills open at the takeover date were treated.

On the accrual basis, invoices and bills unpaid at the takeover date belong in receivables and payables, and their later collection or payment clears those balances rather than counting as income or expense again. On the cash basis they are listed but not posted as opening balances: under the Publication 583 cash method, an open invoice reaches income when collected, and an open bill is usually deducted or capitalized when paid. Posted into an opening balance or equity instead, their collection or payment never reaches income or expense. Trace a few open items to settlement to confirm each reaches the return exactly once.

What changes when the bookkeeper also handles the money?

AS 2401 lists "Inadequate segregation of duties or independent checks" among opportunities for misappropriation, and AS 1105 generally rates evidence obtained directly above evidence obtained indirectly. Checks resting on the bookkeeper's own records or exports prove nothing, so if you are not the bookkeeper, run these yourself:

• Obtain bank, card and loan statements and check images directly from each institution, through your own login or by mail to you.
• Reperform each cash account's period-end reconciliation against those statements.
• Read the change log and user list in the system with your own admin access, never from an export or screenshot the bookkeeper supplies.
• Scan the payees on those statements and check images, and a payroll register you pull from the payroll system or provider with your own login, for names nobody recognizes.

Treat any unexplained cash difference as a finding, whatever its size. If the owner is the only other person, the owner runs these checks; if the owner is the bookkeeper, none is independent unless an outside accountant runs them. Setting up the controls themselves belongs to the related question on one person recording, paying and reconciling.

When must the work stop and go to a professional?

Stop and pass the matter on in these situations:

• Possible fraud. Deletions, or trait-bearing entries or missing support that testing could not clear, clustered on one person, are warning signs. AS 2401 says evidence that fraud may exist "should be brought to the attention of an appropriate level of management"; for you, that means someone senior to anyone involved and a qualified professional, with records and saved log copies left unchanged.
• Reliance by others. A lender, buyer, investor or grantor who will rely on the books sets what it requires; ask, and engage a CPA for the service that meets it.
• A filed return that may be wrong. A tax professional decides what the finding means for tax or payroll filings.
• Judgment beyond your standing. Questions such as revenue timing or whether a purchase is an asset go to a CPA.
• Records you cannot get. Report the area as not examined rather than concluding on it.

How do you rerun the checklist so results compare?

The IIA's standards require documentation from which a competent person "could repeat the work and derive the same engagement results". Version the checklist and hold its areas, evidence tests, exception conditions and severity levels fixed. Record for each run the period, accounts, depth, population, selection method, sample sizes and checker, and carry open findings forward. Compare counts by area and severity between runs, flagging any changed test. Across several businesses, keep the core lines fixed and add business-specific lines separately.