ISA 240 asks the auditor to design and perform procedures to test the appropriateness of journal entries recorded in the general ledger and other adjustments made in preparing the financial statements. The auditor is to make enquiries about inappropriate or unusual activity, select entries made at the end of the period, and consider the need to test entries throughout it (IAASB, 2009). The United States standard on fraud contains equivalent requirements (PCAOB, 2016). Neither standard prescribes a technique. Both expect the selection to be reasoned and the reasoning to be recorded.

The best known statistical screen is digit analysis based on Benford's law, introduced to auditors by Nigrini and Mittermaier (1997). It is quick and needs only the amounts, but it works at the level of the population: it says that a set of entries has too many amounts starting with a given digit and not which entries to examine. Filters on time, user and account identify individual entries but generate long lists, and a long list in a small firm means that only the top of it is ever looked at. No et al. (2019) treat this as the central practical problem of audit analytics and propose prioritising exceptions instead of sampling from them. A taxonomy of data mining applications in fraud detection is given by Gray and Debreceny (2014).

Supervised models need labelled examples of fraudulent entries, and an audit firm almost never has them. Unsupervised methods need none. They characterise what is typical in the data and score each record by its distance from it (Chandola et al., 2009). Early work applied such ideas to large ledgers (Bay et al., 2006), and later studies trained autoencoder networks to flag entries that reconstruct poorly (Schreyer et al., 2017). For a small practice two methods stand out. The isolation forest scores a record by how few random splits are needed to separate it from the rest (Liu et al., 2008); it is fast, has few settings and copes with mixed features. The local outlier factor compares the density around a record with the density around its neighbours (Breunig et al., 2000) and tends to catch entries that are unusual within their own account or user group. Both are implemented in scikit-learn (Pedregosa et al., 2011).

Nothing downstream is worth doing unless the data are complete. The auditor should request every journal line for the period, including opening and closing entries and postings from sub-ledgers, with at least the entry number, line number, posting date, entry date, account, amount, user, source and description. The file is then rolled forward: opening balances plus the net movement per account should equal the closing trial balance. Differences are investigated before any analysis begins.

Profiling is ordinary descriptive work: how many entries and lines, who posts them, from which sources, in which months, to which accounts. It serves two purposes. It gives the auditor the understanding of the client's posting patterns that later makes an anomaly interpretable, and it reveals data problems, such as a missing month or a generic user identifier, that would otherwise distort the scores.

The detectors work on numbers, so each entry must be described numerically. The temptation is to generate many features. For a small practice the better course is a short list that maps onto the characteristics named in ISA 240, so that any flagged entry can be explained in the standard's own terms. A workable set is: the logarithm of the amount; whether the amount is round; the day of the week and hour of posting; the number of days between entry date and period end; the gap between posting date and entry date; how often the user posts; how often the account is used; how often that pair of debit and credit accounts occurs together; whether the source is manual; and the length of the description. Frequencies are computed from the client's own data, which is what makes a rare account pairing rare.

An isolation forest is fitted to the feature table with default settings and a fixed random seed, so that the run can be reproduced. A local outlier factor is fitted separately, with entries grouped by account class where the ledger is large. Two detectors are used because they fail differently: the forest favours entries that are extreme overall, the local method those that are odd for their neighbourhood. Neither score is a probability of fraud, and the file should say so.

The scores are converted to ranks and averaged. Conventional flags are then added as a count: manual entry, period-end posting, senior user, round amount, blank description. Entries are ordered first by the number of flags and then by the average rank. The effect is that an entry which is both statistically unusual and conventionally suspect rises to the top, while the purely statistical outliers follow. The auditor fixes in advance how many entries will be examined, having regard to assessed fraud risk and materiality, and does not adjust the number after seeing the list.

Each selected entry is traced to its support: the authorisation, the underlying document, the business reason. Anomaly scores often flag entries that are unusual and entirely proper, such as an annual insurance premium or a one-off asset disposal, and these are cleared quickly. What matters is that the reason for clearing is evidence and not management's explanation alone.

The auditor records what was done, what was found and what it means for the assessed risk of override. If exceptions are found, testing is extended down the ranked list. The memorandum should let an experienced auditor with no connection to the engagement understand the selection and repeat it.