We recently had an IT Audit and one of the recommendations is to perform a daily review of our manual transaction postings (we manually post things such as monthly depreciation, interest earned on our Fed acct, payroll entries and so on). Some days the report is 10 pages, other days it is nearly 100 pages (around month-end). I am not disputing the need for these procedures - I think this is a very necessary control, however, I am not even sure where to start. (I didn't find what I received from the auditor to be very helpful, so I wanted to reach out to those in the industry.)

Does anyone have procedures they could share. I am thinking of establishing a threshold for review - for example review the report in it's entirety for large transactions and anything that looks suspicious and if a posting is greater than say, $5,000 pull the backup and establish that it is legitimate. And then of course have no dollar threshold for anything that looks suspicious.

Any thoughts or opinions would be greatly appreciated!

I might back up a step and look at the entire process.

#1. What controls are currently in place?
#2. Why so many manual entries, can something be automated?
#3. Who did the auditor recommend perform the review? I'd not want audit (or compliance) to be part of the control. I'd say the individual departments/accounting should review all manual entries (possibly as part of a monthly reconciliation) and then audit (or compliance) do a sample test.

First of all, I am surprised this was a recommendation through an IT audit. Our external auditors are provided a list of manual journal entries. Our manual journal entries are not reviewed on a daily basis. In your case, this means the daily report would have to be kept. For us, all online entries have to be approved.