Lesson 6 of 6
Sign-off evidence
6 min
Finance controls are tested for two audiences: the business, who need confidence the books will be right, and the auditors, who need evidence that controls work as designed. Good evidence serves both. This lesson defines what evidence to keep for general ledger posting tests, and how to record the results so Dan can sign off.
What counts as evidence
| Test type | Evidence to keep | Where it comes from |
|---|---|---|
| Positive posting | Journal entry number, fiscal year, company code; expected vs actual accounts and amounts; derived attributes | Manage Journal Entries; T-account view |
| Ledger-specific posting | Entry number plus line items shown per ledger (0L and the target ledger) | Display Line Items in General Ledger with a ledger filter |
| Verification workflow | Requester, processor, status history, final journal entry number | Verification apps and workflow log |
| Reversal | Original and reversal entry numbers, reason, posting dates | Manage Journal Entries (related entries) |
| Recurring entry | Template, run date, generated entry numbers | Recurring entry app and the generated entries |
| Negative test | Exact error message text and number, user ID and profile, data used | Message shown at posting |
For a negative test, the evidence is the block itself. "The system did not allow it" is not enough. Record the message text and number, the user, the posting date and amount you tried, and why that combination should fail. Without those details, nobody can tell whether the posting was blocked by the control you meant to test or by an unrelated error, such as a missing cost center.
A test record that signs itself
| Field | Example: closed period test |
|---|---|
| Test ID and objective | GL-NEG-03: postings to closed period 8 are rejected for standard users |
| Preconditions | Period 8 closed for all account types; test user ACC-STD-01 with standard accountant role, no special authorization group |
| Steps and data | Post General Journal Entries, company code 1710, posting date Aug 31, SA, 1,000 USD debit and credit on valid accounts with cost center |
| Expected result | Posting rejected with period-not-open message for period 8 |
| Actual result and evidence | Rejected; message text and number recorded; screenshot of message attached |
| Status and tester | Passed; tester and date |
A complete test record for one negative test.
From test results to sign-off
- ExecutePositive and negative tests run with realistic users and data
- RecordEach result with entry numbers or messages and attachments
- ReviewTest lead checks evidence quality; failures logged as defects
- ResolveDefects fixed and retested; workarounds agreed for any deferred
- SignDan signs the G/L posting controls with the summary and open risks
Common evidence mistakes
- Screenshot without context. An image of a posted entry with no company code, number or date cannot be traced.
- Wrong system or client. Evidence from the development client does not prove behavior in the test client where the release was validated.
- Stale results. A pass from the previous cycle is not evidence for this release.
- Super-user execution. A control tested with an all-powerful user ID says nothing about the clerks it is meant to restrict.
- Expected result written after the fact. The expected result must exist before the test runs, or the test only describes what happened.
Keep the records with the release they belong to. The auditors will not ask whether you tested posting periods; they will ask to see the test, the user, the message and the date. If the answers are in the record, the conversation takes minutes.
What would you do?
Dan is reviewing test evidence. A negative test for tolerance limits says "Posting failed as expected" with no message, user or amount. Everything else in the pack is well documented. What should he do?
- Keep entry numbers and expected vs actual results for positive tests.
- For negative tests, record the exact message, user, data and why it should fail.
- Make sure the intended control, not another error, caused the block.
- Sign controls only with passed negative tests and complete records.
- Store evidence with the release so auditors can re-check it.
Check your understanding · not graded
Lesson check
1. What is the evidence for a negative test?
2. How do you show a ledger-specific entry hit only the intended ledger?
3. Why fill every other field correctly in a negative test?
4. When should a control be signed?