# How Should Organizations Conduct a Financial Discrepancy Review in 2026?

financialauditexpert.com · September 28, 2026

> What Is a Financial Discrepancy Review? A financial discrepancy review is a structured examination of accounting records, transactions, balances...

## What Is a Financial Discrepancy Review?

A financial discrepancy review is a structured examination of accounting records, transactions, balances, receipts, payroll records, contracts, and supporting documents to identify amounts that do not agree, appear unsupported, or may have been recorded incorrectly. It is not automatically a full financial statement audit, although a discrepancy review may lead to one. Its purpose is to determine whether differences represent errors, timing differences, accounting-policy choices, unauthorized activity, theft, or unresolved records. A 2026 review should preserve source files, document the population and period examined, and distinguish mathematical differences from evidence that an actual loss occurred. A $10,000 variance caused by a payment received one month late has a different meaning from a $10,000 payment for which no invoice, approval, or recipient record exists. The review should also define materiality early. For example, a team might investigate every unusual item over $1,000 while separately examining whether several smaller entries collectively exceed a 5% error threshold. The final report should explain what was tested, what could not be tested, the size and cause of each discrepancy, and the corrective action required. This makes the process useful to boards, owners, lenders, insurers, regulators, and courts without implying that every reviewer is qualified to issue an audit opinion.

**Also worth reading:** [What Is Forensic Financial Investigation, and When Should Organizations Use One?](https://financialauditexpert.com/knowledge/what_is_forensic_financial_investigation_and_when_should_organizations_use_one.php) · [How Should Financial Organizations Structure Their AI Audit Vendor Evaluation Process in 2026?](https://financialauditexpert.com/knowledge/how_should_financial_organizations_structure_their_ai_audit_vendor_evaluation_process_in_2026.php) · [How Do Organizations Accurately Measure Continuous Control Monitoring Software ROI in Financial Audits?](https://financialauditexpert.com/knowledge/how_do_organizations_accurately_measure_continuous_control_monitoring_software_roi_in_financial_audits.php)

## Why Discrepancies Require Detailed Investigation

Financial records can disagree for ordinary reasons, so a difference alone does not prove misconduct. Banks may show a deposit in transit, businesses may recognize revenue under different contract terms, and a subsidiary may use a different reporting date from its parent. Timing issues often disappear when bank statements, invoices, and subsequent receipts are matched. More serious differences include missing support, duplicate payments, unsupported journal entries, unexplained related-party transactions, payroll paid for nonexistent workers, inventory shortages, and liabilities omitted from the books. The review should ask why each mismatch occurred and whether the underlying transaction was valid, not merely whether the two reports contain the same number. Controls also matter. A large organization may have thousands of monthly entries, so testing every item can be inefficient; sampling is acceptable only when the population is complete and the sample represents a risk-based mix of large, unusual, and recurring transactions. In a public or regulated setting, a materiality threshold such as 5% of revenue or total assets may affect reporting obligations, but it does not permit an organization to ignore suspected fraud. Fraudulent acts can be material regardless of the sampling plan, particularly when management override or concealed transactions are involved.

## A Practical Six-Stage Review Process

First, establish scope, dates, accounts, locations, and expected records. A useful engagement might cover January 1 through December 31, 2026, focusing on cash, accounts receivable, payroll, procurement, grants, and general ledger entries. Second, obtain a complete data set, including ledgers, bank statements, credit-card statements, invoices, contracts, payroll registers, tax filings, minutes, and reconciliations. Preserve read-only copies and record who supplied each file. Third, perform analytical comparisons, such as month-over-month revenue changes, bank-to-ledger cash comparisons, payroll-to-headcount calculations, and budget-to-actual variance analysis. A 20% increase in travel spending should be explained against the number of transactions, not dismissed as normal. Fourth, test selected transactions by tracing them from authorization to payment and from accounting entry to underlying support. Fifth, investigate exceptions through interviews and external confirmation, while allowing the person being questioned to respond to conflicting evidence. Sixth, prepare a written conclusion that separates confirmed errors, unresolved exceptions, scope limitations, suspected misconduct, and recommended controls. A sound review often takes days for a small set of records and several weeks or months for a multi-year or multi-entity examination. The process should not be accelerated merely to meet a reporting deadline.

## Core Methods and Threshold Comparisons

Reviewers commonly combine reconciliation, data analytics, document testing, confirmation, and control testing. Reconciliation proves that two records agree only after identified differences have been resolved; it does not prove that the underlying transaction occurred. Data analytics can identify duplicate invoice numbers, round-dollar payments, weekend transactions, unusual vendors, or journal entries posted just before period-end. Document testing asks whether approval, receipt, contract, and payment records support a claim. External confirmation can test receivables, liabilities, and bank balances with third parties, although responses may be delayed or unreliable. Control testing evaluates whether authorization, segregation of duties, review, and documentation operate consistently. The choice between a basic review and a forensic review depends on the evidence available and the consequence of error.

| Feature | Basic financial discrepancy review | Forensic or expanded investigation |
| --- | --- | --- |
| Primary purpose | Reconcile records and identify unsupported or inconsistent amounts | Establish what happened, when, how, and potentially who was responsible |
| Typical period | Recent month, quarter, or fiscal year | Multiple years or a transaction population linked to suspected misconduct |
| Sampling | Risk-based sample, often hundreds to thousands of records | Targeted testing of unusual, related, duplicate, or high-risk transactions |
| Evidence | Ledgers, bank statements, invoices, payroll, contracts, and reconciliations | Digital images, access logs, device records, communications, interviews, and external evidence |
| Likely output | Exception schedule and management recommendations | Findings report, evidence index, control recommendations, and possible legal or insurance support |
| Approximate professional cost | Often $2,000-$10,000 for a limited engagement | Often $10,000-$100,000 or more, depending on records and complexity |

The figures are planning ranges, not quotations. Fees vary with transaction volume, data quality, travel, professional credentials, and whether testimony or litigation support is required. A qualified reviewer should provide a written estimate, explain assumptions, and state whether the work is a review, agreed-upon-procedures engagement, compilation, or audit.

## Practical Steps for Small Businesses and Nonprofits

A small organization can begin by obtaining a bank-independent monthly reconciliation for at least the last 12 months. Compare the ending bank balance with the general ledger and identify deposits in transit, outstanding checks, bank fees, and transfers between accounts. Reconcile payroll to the payroll register, time records, tax filings, and bank payments; a difference of one employee or one pay period deserves explanation. For procurement, match purchase orders, receiving records, invoices, approvals, and payment evidence, looking especially for duplicate invoice numbers and split purchases that bypass approval limits. Compare inventory counts to perpetual records and investigate differences that remain unexplained after normal shrinkage is considered. For grants, trace each expenditure to the grant agreement, allowable expense category, documentation, and reporting schedule. Unexplained spending cannot simply be reclassified between budget categories to make a report balance. A nonprofit should also review restricted versus unrestricted funds, because an expense may be properly recorded financially but still violate a donor restriction. Records should be retained according to legal, contractual, tax, and organizational requirements rather than an arbitrary one-year rule.

## Common Mistakes That Weaken the Review

One common mistake is treating an accounting difference as proof of theft. Another is testing only the general ledger and failing to inspect bank statements, payment applications, or third-party records. Reviewers sometimes use a small sample that emphasizes routine transactions while omitting high-risk manual journal entries. Others compare totals without checking whether the underlying populations are complete. A reconciliation that begins with an incomplete bank export cannot identify all missing transactions. Several problems arise from poor documentation: interview notes lack dates, source files are overwritten, questions are leading, and conclusions do not identify the evidence supporting them. Timing must also be recorded. A transaction posted in March but paid in April may be valid, while a December entry with no later settlement may require investigation. Management should not delay the review until records disappear, but it should avoid broad accusations before evidence is gathered. The report should use terms such as “unexplained difference,” “unsupported amount,” and “control exception” when facts do not support stronger conclusions. Only after corroboration should it describe an item as unauthorized, fraudulent, or stolen.

## When to Escalate, and What It May Cost

Escalation is appropriate when a discrepancy is large, recurring, concealed, tied to management, or accompanied by missing records. Immediate notification may be required by a lender, insurer, auditor, regulator, board, or law-enforcement agency. A useful internal trigger is any confirmed shortage above the organization’s approved tolerance, a pattern of duplicate payments, unsupported cash withdrawals, or a control failure affecting a material account. Even smaller amounts matter when they reveal deliberate concealment or weak oversight. The organization should secure relevant records, limit access to them, and avoid altering or deleting electronic information. Legal counsel may be needed before contacting a bank or filing a report, especially where contracts, privilege, employment obligations, or statutory deadlines apply. A private reconciliation may cost less than a full audit, but it may not satisfy a lender’s requirement for an independently issued opinion. For example, a $250,000 annual discrepancy may justify several thousand dollars of targeted testing, while a multi-year payroll and procurement investigation can quickly cost tens of thousands. The expected financial exposure, legal risk, and value of preventing recurrence should guide the decision, not the size of the accounting difference alone.

## What a Defensible Final Report Should Contain

A final report should begin with the objective, scope, period, and limitations. It should identify the records examined, the sampling approach, the materiality threshold, and any unavailable evidence. The main schedule should list each discrepancy, its amount, affected account, period, probable cause, evidence reviewed, and status: corrected, unresolved, escalated, or referred for legal review. A $48,500 variance should be described precisely, with dates and supporting references, rather than summarized as “cash problems.” The narrative should explain whether controls failed because one employee could both approve and pay a transaction, whether management was informed, and whether remediation has been assigned. Management responses and completion dates should be tracked separately from the auditor’s findings. A report that says no exceptions were found is meaningful only if the reviewer can explain how exceptions would have been detected. A report that identifies discrepancies but provides no correction plan is incomplete. The strongest deliverable connects accounting evidence to practical action: restrict payment authority, require two approvals over a defined threshold, preserve invoices electronically, separate payroll preparation from payroll approval, and require monthly independent bank reconciliations. Independent review does not replace sound bookkeeping; it tests whether the records and controls are capable of producing reliable financial information.

## Quick answers

### Is a financial discrepancy review the same as a full audit?

No. A discrepancy review usually focuses on identifying and explaining specific differences, while a financial statement audit tests evidence, evaluates controls as relevant, and issues an opinion on whether the statements are fairly presented in accordance with the applicable framework. A review may become more extensive if the initial work indicates fraud, omission, or unreliable records.

### What is a reasonable materiality threshold for a small business?

There is no universal percentage. Some organizations investigate every item over $1,000 or any item that exceeds 5% of a relevant account balance, but the threshold should reflect the organization’s size, risk, legal requirements, and users of the financial statements. Smaller exceptions still deserve attention when they form a pattern or appear deliberate.

### Can AI tools replace a human financial reviewer?

AI can help compare records, flag duplicates, detect unusual patterns, and organize documents, but it cannot independently establish authorization, collect every relevant record, or make legal conclusions about misconduct. The results require validation against source evidence, professional judgment, and clear responsibility for the final conclusion.

### How long should an organization retain the records used in a review?

Retention depends on tax law, contract terms, litigation holds, audit requirements, and the organization’s industry. Records should be preserved at least as long as the organization may need them to support financial statements, tax filings, audits, grant reports, insurance claims, or disputes. Once a legal hold applies, deletion should stop until counsel authorizes release.

### Should discrepancies be reported to a bank or the police immediately?

The organization should first secure the records and obtain advice from qualified legal, accounting, and insurance professionals when a possible loss or reporting deadline is involved. Reporting requirements vary by contract, jurisdiction, insurer, lender, and auditor. Prompt action can limit further loss, but premature or unsupported allegations can create legal and reputational problems.

Canonical: https://financialauditexpert.com/knowledge/how_should_organizations_conduct_a_financial_discrepancy_review_in_2026.php
Markdown: https://financialauditexpert.com/knowledge/how_should_organizations_conduct_a_financial_discrepancy_review_in_2026.php/index.md