How Do You Perform a Financial Discrepancy Review in 2026?

What Is a Financial Discrepancy Review?

A financial discrepancy review is a structured examination of financial records designed to identify amounts that do not agree, appear unsupported, or violate applicable accounting requirements. The objective is not merely to find a mathematical error. It is to determine whether transactions were authorized, accurately recorded, properly classified, and supported by reliable evidence across the full accounting cycle. Discrepancies may occur between bank statements and general ledgers, invoices and purchase orders, payroll registers and tax filings, or reported revenue and the underlying business activity. A useful financial discrepancy review guide therefore connects numbers with documents, controls, and responsible people rather than treating an unexplained balance as proof of fraud.

Also worth reading: How Do Financial Audit Discrepancy Services Identify Errors and What Should Organizations Expect in 2026? · How Do Automated Discrepancy Detection Benchmarks Actually Work for Financial Audits? · How do I perform a Benford second order test in Excel to audit financial data and find discrepancies?

The review can cover a person, department, vendor, nonprofit, school, property, or entire organization. Its depth depends on the records available and the purpose of the investigation. A routine monthly reconciliation may test whether one bank account agrees with the ledger, while a forensic-style review tests whether selected transactions have valid business purposes and whether management has concealed liabilities or misstated results. This distinction matters because a $1,000 timing difference caused by a check issued near month-end is not comparable to a $1,000 payment for which no invoice, approval, or recipient can be identified.

As of September 29, 2026, there is no universal dollar threshold that turns every discrepancy into a reportable event. Reporting duties depend on the entity, jurisdiction, contractual terms, and type of record. Nevertheless, common operational warning signs include unsupported adjustments, repeated reversals, duplicate invoices, round-dollar payments, missing receipts, negative or unusual account balances, and journal entries made close to period-end. Reviewers should document both the amount and the reason a difference arose before assigning a conclusion.

Why Inconsistent Financial Records Happen

Financial discrepancies frequently originate from ordinary process failures. A payment may be recorded twice, a bank fee may be posted in a different month, or an employee may receive a benefit change that payroll implemented incorrectly. Timing differences are particularly common in accounts payable, accruals, and revenue recognition because a transaction can be economically complete in one period while the associated cash movement appears in another. International Financial Reporting Standards may be disrupted by inconsistencies in revenue timing, asset valuation, and lease obligations, showing why reviewers need to inspect the transaction rather than relying on a single report.

Control weaknesses also contribute. If one person can create a vendor, approve a purchase, and process payment, the organization has little separation of duties. Shared credentials, unmonitored bank access, incomplete reconciliations, and manual spreadsheets increase the chance that errors remain undetected. Organizations that later face public scrutiny may discover gaps involving missing checks, incomplete records, and benefit errors, while independent financial reviews of public-benefit programs can identify discrepancies requiring management responses.

Not every discrepancy indicates misconduct. Some result from data conversion, incorrect system configuration, omitted attachments, stale master data, or changes made by an outside service provider. Even a deliberately altered record does not automatically prove fraud; intent is generally a separate question requiring evidence. The Enron case illustrates the danger of assuming that accounting problems alone establish criminal conduct, while the 2008 financial crisis demonstrated the broader consequences of excessive speculation and weak financial information. A disciplined review should therefore classify each item as a likely error, timing difference, control issue, unsupported transaction, valuation issue, or potentially fraudulent activity.

A Practical Six-Stage Review Process

The first stage is to define the scope, period, accounts, and expected population. Instead of vaguely saying that “the finances do not look right,” specify whether the review covers January 1 through September 30, 2026, selected vendors, payroll, cash accounts, grants, or all journal entries above a chosen amount. Sampling is useful only when the full population can be identified and the risk of missing unusual items is addressed. For example, a test of 30 payments out of 3,000 may be practical, but adding all payments above $10,000, all manual entries, and all payments to new vendors is more defensible than relying on a purely random sample.

The second stage is to preserve and normalize the evidence. This includes bank statements, ledgers, invoices, contracts, payroll reports, tax returns, payment applications, board approvals, and system-access logs. Reviewers should create a consistent timeline, convert amounts to one currency, and retain original files without changing their metadata. If relevant, make a forensic image of the electronic data or document why a working copy was created. The population should then be reconciled from the source system to financial reports, with every adjustment separately recorded and independently supported.

The final stages involve testing, escalation, and reporting. Tests should address duplicate payments, arithmetic accuracy, authorization, business purpose, cutoff, classification, valuation, and reconciliation completeness. Exceptions should be assigned severity based on financial amount, recurrence, management involvement, regulatory impact, and likelihood of further loss. A report should distinguish confirmed discrepancies from open questions, quantify the effect on financial statements or available cash, identify evidence gaps, and recommend control corrections. A finding is not complete merely because an accountant labels it “suspicious.”

Core Tests and Evidence Standards

Bank reconciliation is usually the best starting point because it connects reported cash with independent bank evidence. The reviewer should confirm the opening and closing balances, identify outstanding checks, deposits in transit, bank fees, returned items, electronic transfers, and reconciling items that have remained unresolved for an unusual period. A 30-, 60-, or 90-day-old outstanding item deserves explanation, but age alone does not establish a loss. Many organizations investigate items older than 90 days, and some accounting policies require correction within the same reporting month, while others use shorter or longer internal thresholds.

Accounts payable testing should match each selected payment to an invoice, purchase order where applicable, receiving evidence, approval, and bank record. The reviewer should search for repeated invoice numbers, identical amounts and dates, duplicate beneficiary details, payments split near an approval limit, and invoices altered after approval. A three-way match—purchase order, goods receipt, and invoice—is common, but its effectiveness depends on whether the underlying documents are reliable. In a payroll audit, employees should be traced to authorized rosters, pay rates, time records, deductions, tax accounts, and bank destinations. Changes to payroll data and terminations should be linked to independent authorization.

Revenue and balance-sheet testing requires different evidence. Revenue should be connected to contracts, delivery evidence, credit notes, and payment records rather than accepted solely because cash was received. Assets should be checked for existence, ownership, valuation, and impairment, while liabilities should be searched for omitted invoices, unpaid taxes, lease obligations, and guarantees. Reviewers should avoid treating a missing paper receipt as conclusive when a complete digital workflow exists. Evidence must be authentic, contemporaneous where possible, relevant, and sufficiently independent to support the conclusion.

Organizations can choose among internal reconciliation, external accounting assistance, targeted forensic review, audit, and regulatory reporting. Internal review is economical when staff are independent of the process being tested and have sufficient technical ability. It is weaker when the same person controls transactions, records, and reconciliation or when internal concerns cannot be raised safely. External accounting assistance is useful for specialized valuation, tax, payroll, or revenue questions, although an accounting engagement does not automatically include the full fraud examination performed in a forensic review.

A forensic financial review is more intensive because it may reconstruct events, analyze electronic records, interview personnel, and investigate whether records were altered or omitted. A conventional audit evaluates financial statements and internal controls against recognized criteria; it is not identical to a forensic investigation commissioned to answer a specific allegation. Regulatory or law-enforcement reporting becomes relevant when laws, grant agreements, securities duties, or public-interest requirements may have been violated. Reviewers should not file an accusation externally merely to create leverage unless the applicable rules require or permit it.

Technology can accelerate population testing, but automated anomaly detection is not proof of wrongdoing. AI may compare invoices, ledger entries, or medical bills and surface patterns that a reviewer overlooked. The 2026 reporting context includes increased attention to artificial intelligence in auditing, while reported experiments with AI on medical bills have found billing errors that warrant manual verification. Humans must still decide whether an item is valid, resolve duplicate context, and evaluate legal significance. Access to powerful tools does not cure weak source data or replace professional skepticism.

Common Mistakes During Discrepancy Reviews

A common error is beginning with a preconceived conclusion. If a reviewer assumes that a large payment is fraudulent because the amount is round or the vendor is unfamiliar, the evidence gathering may become biased. Another mistake is treating cash shortages as the main objective. Off-book revenue, unrecorded liabilities, inflated assets, duplicate payroll, and concealed related-party transactions can cause serious harm even when cash appears correct. Reviewers should test both reported statements and the underlying transactions that generate them.

Another error is stopping at the first explanation. A missing receipt may be resolved by a later invoice, while a ledger mismatch may reflect a legitimate accrual. Even so, “it was fixed” does not explain who changed the record, when the change occurred, or why the original transaction was wrong. Reviewers should document the original condition, the corrective action, the person responsible, and the control that failed. They should also avoid confusing an isolated error with a systemic issue without establishing frequency and root cause.

Finally, reviewers can mishandle confidentiality. Spreading allegations, accessing records without authorization, or attempting to confront an employee may contaminate evidence or create legal exposure. A formal engagement letter should define authority, privilege expectations, retention requirements, data handling, and reporting recipients. Records should be stored securely, and conclusions should use qualified language when facts remain incomplete. Independence matters: a reviewer who designed or operates the control being tested may not be suitably independent for the intended assurance.

When to Escalate, Report, or Seek Help

Immediate escalation is appropriate when ongoing activity could cause additional loss, identities or accounts may be misused, or electronic evidence is at risk. Examples include active transfers to unfamiliar beneficiaries, unexplained privileged access, repeated override of controls, or unexplained changes to payroll master files. The organization should preserve relevant records, suspend only the activity authorized to be suspended, and maintain a documented chain of custody. It should not delete alerts, wipe devices, or alter records described as anomalies.

Professional help is sensible when the discrepancy is material relative to the organization, spans several accounting systems, involves complex accounting estimates, or may indicate fraud. A forensic accountant, independent auditor, tax adviser, cybersecurity specialist, lawyer, or regulator may each perform a different part of the response. Qualification and independence should be evaluated rather than relying on a vendor's broad marketing claims. In public programs, grant conditions may require notification within specified days, and local governments or nonprofits may have statutory audit or investigation duties.

Materiality does not have one universal percentage. A 5% budget overrun may be significant in a small school but immaterial to a multinational company; even $500 can matter if repeated across hundreds of transactions or if it represents a prohibited conflict. Reviewers should consider both quantitative size and qualitative factors such as legal violations, management override, public interest, reputational damage, and control implications. As a practical starting rule, an organization may investigate any item that exceeds its formal approval threshold, but that threshold should not be used to ignore smaller anomalous patterns.

Cost, Timing, and Choosing the Right Scope

Routine reconciliation work is usually the least expensive option because it uses records already produced for accounting. Costs rise when records must be reconstructed, thousands of transactions require data extraction, interviews are needed, or specialist valuation and digital-evidence work is required. Small targeted reviews may cost several thousand dollars, while broad or complex forensic engagements can range from tens of thousands to much more depending on personnel, data volume, duration, and legal requirements. These figures are market ranges rather than fixed rates, so an organization should request a written scope, assumptions, hourly or milestone pricing, expense policy, and change-control process.

A small business can begin by reconciling all bank and credit accounts monthly, testing payroll to a current authorized roster, and reviewing manual journal entries. A larger nonprofit, school, company, or public agency should add vendor master-file review, grant-expense testing, related-party checks, access-log preservation, and independent escalation. Public entities may also need to follow open-records, procurement, audit, or whistleblower procedures. A review of preventive-care payment or work-study financial incentives should test whether reported amounts were earned, eligible, properly calculated, and delivered rather than assuming that the program description matches the ledger.

The right scope balances expected loss, evidence availability, urgency, and cost. Reviewing every trivial transaction may cost more than the discrepancy risk, while relying only on a small random sample can miss purposeful manipulation. Expand the review when exceptions cluster, controls are weak, management cannot provide support, or the suspected amount grows. A defensible report dated September 29, 2026, should identify the records examined, period covered, methods used, limitations, findings, monetary effects, corrective actions, and responsible follow-up dates.

What a Defensible Financial Discrepancy Finding Contains

A strong finding states the issue precisely and ties it to evidence. It should identify the account or process, transaction dates, amount, source records, expected treatment, observed treatment, and calculated effect. It should distinguish a confirmed unsupported payment from a missing document that may still exist. Where appropriate, it should explain recurrence, root cause, control weakness, and whether the discrepancy could affect cash, liabilities, revenue, expenses, compliance, or management reporting.

The conclusion must be proportional to the evidence. “The ledger reports $250,000 in vendor payments, but $40,000 lacks an approved invoice or receiving record” is more useful than “the organization stole $40,000.” If the amount remains unresolved, the report can say that the discrepancy has not been explained within the agreed review period and recommend further procedures. It should avoid invented percentages, false precision, and unsupported claims about intent. Management should then correct confirmed errors, recover recoverable funds, remediate the control failure, and demonstrate that the correction was independently checked.

A discrepancy review ultimately improves financial reliability only when its findings lead to action. Confirmation of balances without testing transaction validity is incomplete, while allegations without calibrated evidence are unfair. The best process combines reconciliation, document testing, independent judgment, preservation of evidence, and clear reporting. That approach works whether the review concerns one $75 bank charge, $1.2 million in grant expenses, or a complex set of records distorted across many periods.