Sources & Methodology
Paciolus is not an accounting or auditing authority. Our tools apply rules published by the bodies that set them, and present the results conveniently. This page lists, for every test, the rule it applies, the source it comes from, and which numbers are our own choices, so you can check our work against the original.
Nothing here is an audit opinion or a substitute for your professional judgment. Where a standard is cited, read the standard itself; we cite at the level of the standard and do not quote paragraph numbers we have not confirmed.
How to read each rule
219 rules across the 18 tools and the composite risk score, each marked with one of four kinds of basis.
The rule or figure is set by the cited source, such as a filing threshold in the tax code.
The cited source names this as an indicator or a procedure to consider, without prescribing the test or its thresholds.
A statistical or forensic method from published literature, applied as published.
Our own choice: a threshold, weight, band or cut-off that no authority sets. These are defaults for your judgment, not rules.
The authorities we cite
Public Company Accounting Oversight Board (PCAOB)
Sets auditing standards (AS) for audits of US public companies.
Where to read it · Free
AS 2305 · AS 2315 · AS 2401 · AS 2501
International Auditing and Assurance Standards Board (IAASB)
Issues the International Standards on Auditing (ISA), used in most countries outside US public-company audits.
Where to read it · Free (handbook download)
ISA 240 · ISA 320 · ISA 500 · ISA 520 · ISA 530 · ISA 540 · ISA 570
American Institute of CPAs (AICPA)
Issues the US auditing standards for non-public entities (AU-C) and practice guides such as the Audit Sampling guide.
Where to read it · Free account for standards; guides are sold
AICPA Audit Sampling Guide · AU-C 570
Financial Accounting Standards Board (FASB)
Maintains the Accounting Standards Codification (ASC), US GAAP.
Where to read it · Free basic view (account required)
ASC 275 · ASC 326 · ASC 330 · ASC 360 · ASC 606 · ASC 740 · ASC 810 · ASC 842 · ASC 850
IFRS Foundation / International Accounting Standards Board
Issues IFRS Accounting Standards (IFRS and the older IAS).
Where to read it · Free account for full text
IAS 16 · IAS 2 · IFRS 10 · IFRS 15 · IFRS 16 · IFRS 9
Internal Revenue Service and the Internal Revenue Code
US federal tax law (IRC sections) and the IRS forms, instructions and publications that apply it.
Where to read it · Free
Form 1120 Schedule M-1 · Form 1120 Schedule M-3 · Form 941 · Form W-2 · Form W-3 · IRC §223(b)(3) · IRC §3101 · IRC §3121 · IRC §402(g) · IRC §414(v) · IRC §6041 · IRC §6041A · IRC §6045(f) · IRC §6049 · IRC §6050N · IRC §6051 · Pub 1220
United States Code
Federal statutes outside the tax code, such as the federal holiday calendar.
Where to read it · Free
5 U.S.C. §6103
Committee of Sponsoring Organizations of the Treadway Commission (COSO)
Publishes the Internal Control — Integrated Framework (2013).
Where to read it · Executive summary free; framework sold
COSO 2013
Association of Certified Fraud Examiners (ACFE)
Publishes the Report to the Nations, a periodic study of occupational fraud.
Where to read it · Free
ACFE 2024
Published statistical and forensic literature
Methods from books rather than standard-setters: Nigrini, Benford’s Law (Wiley, 2012); Iglewicz & Hoaglin, How to Detect and Handle Outliers (ASQC Quality Press, 1993).
Available from libraries and booksellers · Books (libraries and booksellers)
Iglewicz & Hoaglin 1993 · Nigrini 2012
Tool by tool
Open a tool to see each test. Thresholds marked as Paciolus conventions are starting points; where a tool lets you change one for a run, the rule says so.
Journal Entry Testing22 rules
| Test | What it does | Basis |
|---|---|---|
| T1 Unbalanced Entries | Groups lines by entry ID (or reference when there is no ID) and flags every line of an entry whose debits and credits differ by more than $0.01. Severity: HIGH when the difference exceeds $1,000, MEDIUM above $10, otherwise LOW. Debits equalling credits is a bookkeeping invariant, not a standard citation. The $0.01 tolerance and the $10 / $1,000 severity bands are Paciolus defaults. Any unbalanced entry also floors the composite score (see Composite score). | Paciolus convention |
| T2 Missing Fields | Flags lines with a blank account, no date, or a zero amount. MEDIUM when the account or date is missing, LOW when only the amount is missing. Both standards list entries without account numbers among the characteristics of inappropriate journal entries. The date and amount checks and the severity split are Paciolus choices. | Described by a standard ISA 240, AS 2401 |
| T3 Duplicate Entries | Flags lines that share the same date, account, debit, credit and description (case-insensitive) with at least one other line. Always MEDIUM. The matching key and the severity are Paciolus defaults. | Paciolus convention |
| T4 Round Dollar Amounts | Considers lines of $10,000 or more and flags those that are exact multiples of $100,000 (HIGH), $50,000 (MEDIUM) or $10,000 (LOW). Every round line is counted; the 50 largest are listed. Both standards list entries containing round numbers or consistent ending numbers among the characteristics of inappropriate journal entries. The $10,000 floor, the three multiples, their severities and the 50-row display cap are Paciolus defaults. You can change this for a run. | Described by a standard ISA 240, AS 2401 |
| T5 Unusual Amounts | For each account with at least 5 non-zero lines, measures each line against the mean and standard deviation of the account's other lines and flags lines more than 3 standard deviations above. Severity: HIGH above 5 standard deviations, MEDIUM above 4, otherwise LOW. The 3 / 4 / 5 standard-deviation cut-offs and the 5-line minimum are Paciolus defaults. A code comment describes the 4 / 5 severity bands as adapted from Nigrini (2012); Paciolus does not present them as a published threshold. You can change this for a run. | Paciolus convention |
| T6 Benford's Law | Compares the first-digit distribution of amounts of $1 or more with Benford's expected distribution and grades conformity by mean absolute deviation (MAD): below 0.006 close conformity, below 0.012 acceptable, below 0.015 marginally acceptable, otherwise nonconforming. When marginally acceptable or nonconforming, lines in up to three over-represented digits are flagged. Runs only with at least 300 eligible amounts spanning at least two orders of magnitude. The MAD conformity bands are Nigrini's (2012) first-digit thresholds. The 300-amount minimum, the two-orders-of-magnitude pre-check, the $1 floor and the choice of up to three digits to flag are Paciolus settings; the code describes the 300 minimum as Nigrini's figure, but Nigrini favours larger data sets and Paciolus treats 300 as its own floor. | Published method Nigrini 2012 |
| T7 Weekend Postings | Flags lines dated on a Saturday or Sunday (posting date, or entry date when there is no posting date). Severity: HIGH at $10,000 or more, MEDIUM at $2,000 or more, otherwise LOW. ISA 240 and AS 2401 require journal entries to be tested for fraud; posting on a weekend is a Paciolus selection criterion, not a characteristic either standard lists. The $2,000 / $10,000 bands are Paciolus defaults. You can change this for a run. | Paciolus convention |
| T8 Month-End Clustering (volume ratio) | For each month with at least 10 lines, compares the average daily volume in the last 3 days with the month's average daily volume and flags the month-end lines when it is more than 2 times higher. MEDIUM when more than 4 times higher, otherwise LOW. Both standards list entries recorded at the end of a period among the characteristics of inappropriate journal entries. The 3-day window, the 2x and 4x ratios and the 10-line minimum are Paciolus defaults. | Described by a standard ISA 240, AS 2401 |
| T8 Month-End Clustering (comparison with the client's own months) | Also compares each month's month-end concentration with the client's other months. A month is flagged only when its modified z-score is 3.5 or more and it also exceeds the typical month by at least 5 points, so a business that always closes heavily at month-end is not flagged every month. The modified z-score (based on the median and median absolute deviation) and its 3.5 outlier cut-off are from Iglewicz & Hoaglin (1993). The additional requirement that the month-end share be at least 5 percentage points above the median of the other months of the client is a Paciolus guard against flagging trivially small differences. | Published method Iglewicz & Hoaglin 1993 |
| T9 Single-User High Volume | When a posted-by column is present, flags users who posted more than 25% of all lines that carry a user. HIGH above 50%, otherwise MEDIUM. Up to 20 of each such user's largest lines are listed. The 25% / 50% shares and the 20-line cap are Paciolus defaults. A code comment frames this as a segregation-of-duties signal; neither ISA 240 nor AS 2401 sets a concentration threshold. (Those standards instead list entries by individuals who do not usually post journal entries.) You can change this for a run. | Paciolus convention |
| T10 After-Hours Postings | When timestamps are present, flags lines posted before 06:00 or at/after 18:00. Severity: HIGH above $10,000, MEDIUM above $1,000, otherwise LOW. Skipped when the file has no real time data (for example every timestamp is midnight). Business hours of 06:00-18:00 and the $1,000 / $10,000 bands are Paciolus defaults; after-hours posting is a Paciolus selection criterion. You can change this for a run. | Paciolus convention |
| T11 Sequential Numbering Gaps | Splits entry IDs into a series prefix and trailing number and flags any entry whose number is 2 or more above the previous number in its series (at least one number missing). Severity: HIGH when more than 100 apart, MEDIUM when more than 10 apart, otherwise LOW. Gap-size bands are Paciolus defaults. Gaps can have ordinary causes (voided or cancelled entries) and need follow-up rather than a conclusion. You can change this for a run. | Paciolus convention |
| T12 Backdated Entries | When both a posting date and an entry date are present, flags lines where they differ by 30 days or more. Severity: HIGH above 90 days, MEDIUM above 30 days, LOW at exactly 30. The 30- and 90-day thresholds are Paciolus defaults. You can change this for a run. | Paciolus convention |
| T13 Suspicious Keywords | Scores each description against a weighted keyword list (for example manual adjustment, override, reversal, dummy, related party, loan to officer) and flags matches with a weight of 0.60 or more. HIGH when the weight is 0.85 or more and the amount exceeds $10,000; MEDIUM when the weight is 0.70 or more or the amount exceeds $5,000; otherwise LOW. The keyword list, weights, 0.60 threshold and amount bands are Paciolus defaults. You can change this for a run. | Paciolus convention |
| T14 Reciprocal Entries | Flags pairs of separate entries of $1,000 or more where a debit and a credit of the same amount are posted within 7 days. Same-month pairs: HIGH if to different accounts, otherwise MEDIUM. A reversal on day 1 of the next month (a normal accrual reversal): MEDIUM if to different accounts, otherwise LOW. Any other cross-month pair: HIGH if to different accounts, otherwise MEDIUM. The $1,000 floor, 7-day window and timing categories are Paciolus defaults. | Paciolus convention |
| T15 Just-Below-Threshold | Flags amounts within 5% below $5,000, $10,000, $25,000, $50,000 or $100,000 (HIGH for the $50,000 and $100,000 levels, otherwise MEDIUM). Also flags possible splits: same account, same day, same side, each piece below a level but together above it. A split is HIGH only when it has 5 or fewer pieces and each is at least 10% of the level; other splits are flagged MEDIUM. The five approval levels and the 5% band are Paciolus defaults, not the client's actual approval limits; the split-severity conditions are Paciolus choices. | Paciolus convention |
| T16 Account Frequency Anomaly | For accounts with at least 3 months of activity, flags months whose line count exceeds the account's monthly mean by more than 2.5 standard deviations (the largest line of the month is listed). HIGH when the z-score exceeds 4, otherwise MEDIUM. The 2.5 and 4 standard-deviation cut-offs and the 3-month minimum are Paciolus defaults. | Paciolus convention |
| T17 Description Length Anomaly | For accounts with at least 5 lines whose descriptions average more than 5 characters, flags blank descriptions (MEDIUM) and descriptions more than 2 standard deviations shorter than the account average and under 30% of it (LOW). Both standards list entries with little or no explanation or description among the characteristics of inappropriate journal entries. The 5-line minimum, 5-character average, 2 standard deviations and 30% cut-off are Paciolus defaults. | Described by a standard ISA 240, AS 2401 |
| T18 Unusual Account Combinations | When at least 20 entry IDs are present, counts each debit-account / credit-account pairing and flags entries whose pairing appears 2 times or fewer. HIGH only when the line exceeds $10,000 and the file has at least 100 entries (rarity means little in a small file); otherwise MEDIUM. Both standards list entries made to unrelated, unusual or seldom-used accounts among the characteristics of inappropriate journal entries; a rare pairing is Paciolus's proxy for that. The 2-occurrence, 20-entry, 100-entry and $10,000 cut-offs are Paciolus defaults. | Described by a standard ISA 240, AS 2401 |
| T19 Holiday Postings | Flags lines dated on a US federal holiday (the legal public holidays in 5 U.S.C. 6103, including observed dates when a fixed holiday falls on a weekend). Severity: HIGH at $10,000 or more, MEDIUM at $2,000 or more, otherwise LOW; Columbus Day and Veterans Day, when many businesses stay open, are flagged LOW. The auditor can exclude holidays the client works and add the client's own closure days. The holiday list comes from statute; using it as a selection criterion is a Paciolus choice. Code comments and the memo describe holiday postings as an ISA 240 fraud-risk indicator, but ISA 240 does not list holiday postings among its characteristics, so Paciolus does not attribute the test to it. The $2,000 / $10,000 bands are Paciolus defaults. You can change this for a run. | Paciolus convention 5 U.S.C. §6103 |
| Stratified sample selection | Optionally selects a random sample stratified by account, amount range, period and/or user, using a cryptographically secure random generator with a recorded seed. Default rate 10% per stratum (1%-100%), or a fixed count per stratum. This is a selection aid, not a statistical sampling plan; for ISA 530 / AS 2315 sampling with projection and evaluation use the Statistical Sampling tool. The 10% default is a Paciolus setting. You can change this for a run. | Paciolus convention |
| Composite score | Uses the shared test-battery score (see Composite risk score). In addition, any unbalanced entry floors the score at 11 (Moderate), and an unbalanced entry over $1,000 floors it at 26 (Elevated). All floors are Paciolus conventions. | Paciolus convention |
AP Payment Testing15 rules
| Test | What it does | Basis |
|---|---|---|
| AP-T1 Exact Duplicate Payments | Flags every payment in a group sharing the same vendor name, invoice number, amount (to the cent) and payment date. Always HIGH severity. The four-field match key and HIGH severity are Paciolus choices. ISA 500 frames the evidence question (a duplicate overstates expenditure); no standard prescribes this test. | Paciolus convention ISA 500 |
| AP-T2 Missing Critical Fields | Flags payments with a blank vendor name or a zero amount (HIGH) or a blank payment date (MEDIUM). Data-completeness check; field list and severities are Paciolus defaults. | Paciolus convention |
| AP-T3 Check Number Gaps | Sorts numeric check numbers and flags each jump of 2 or more (one or more missing numbers). Severity: gap over 100 HIGH, over 10 MEDIUM, otherwise LOW. Runs only when a check-number column is present. Minimum gap of 2 and the 10/100 severity bands are Paciolus defaults. You can change this for a run. | Paciolus convention |
| AP-T4 Round Dollar Amounts | Flags payments of $10,000 or more that are exact multiples of $100K (HIGH), $50K (HIGH), $25K (MEDIUM) or $10K (LOW); only the largest matching multiple counts. All round payments are counted; the 50 largest are listed. ISA 240 and AS 2401 list round numbers as a characteristic of inappropriate journal entries; applying it to vendor payments is a Paciolus extension. The $10K floor, the multiples and the 50-item display cap are Paciolus defaults. You can change this for a run. | Paciolus convention ISA 240, AS 2401 |
| AP-T5 Payment Before Invoice | Flags payments dated before their invoice date. Severity: more than 30 days early HIGH, more than 7 days MEDIUM, otherwise LOW. Runs only when both dates are present. The 7- and 30-day bands are Paciolus defaults. You can change this for a run. | Paciolus convention |
| AP-T6 Fuzzy Duplicate Payments | Flags pairs of payments to the same vendor for the same amount (within $0.01) on different dates no more than 30 days apart. HIGH if the amount exceeds $10,000, otherwise MEDIUM. Fixed-amount recurring series (3 or more payments of one amount, each at least 25 days apart, e.g. rent) are excluded. The 30-day window, $0.01 tolerance, $10K severity line and the 3-payment / 25-day recurring-series rule are Paciolus defaults. You can change this for a run. | Paciolus convention |
| AP-T7 Invoice Number Reuse | Flags every payment whose invoice number appears under two or more different vendors. Always HIGH severity. Paciolus test design; may also reflect ordinary data-entry error. You can change this for a run. | Paciolus convention |
| AP-T8 Unusual Payment Amounts | For vendors with at least 5 payments, measures each payment against the vendor's other payments (leave-one-out z-score) and flags those 3.0 or more standard deviations away. Severity: z over 5 HIGH, over 4 MEDIUM, otherwise LOW. The 5-payment minimum, the 3.0 cut-off and the 4/5 severity bands are Paciolus defaults. A code comment attributes the severity bands to Nigrini (2012); that attribution has not been verified, so they are shown as a Paciolus convention. You can change this for a run. | Paciolus convention |
| AP-T9 Weekend Payments | Flags payments dated Saturday or Sunday. HIGH if $10,000 or more, otherwise MEDIUM. The $10K severity line is a Paciolus default. Standards do not list weekend payment dates as a red flag; electronic payments are often settled on any day. You can change this for a run. | Paciolus convention |
| AP-T10 High-Frequency Vendors | Flags vendors receiving 5 or more payments on a single day. HIGH at 10 or more, otherwise MEDIUM. The 5- and 10-payment thresholds are Paciolus defaults. You can change this for a run. | Paciolus convention |
| AP-T11 Vendor Name Variations | Compares every pair of distinct vendor names and flags pairs with a text-similarity ratio (Python SequenceMatcher) of 0.85 or more, as possible ghost vendors or deliberate misspellings. HIGH if the two vendors were paid more than $50,000 combined, otherwise MEDIUM. The 0.85 similarity cut-off and $50K severity line are Paciolus defaults. You can change this for a run. | Paciolus convention |
| AP-T12 Just-Below-Threshold | Flags payments within 5% below $5K, $10K, $25K, $50K or $100K (HIGH for the $50K and $100K thresholds, otherwise MEDIUM), and same-vendor same-day payments that are each below a threshold but together exceed it (HIGH). The approval thresholds and the 5% band are Paciolus defaults, not the client's own authorization limits. Confirm against the client's AP authorization matrix before drawing conclusions. You can change this for a run. | Paciolus convention |
| AP-T13 Suspicious Descriptions | Scans payment descriptions against a weighted keyword list (e.g. petty cash, void reissue, manual check, override, rush, one-time vendor) and flags matches weighted 0.60 or more. Severity: weight 0.85 or more and amount over $10,000 HIGH; weight 0.75 or more MEDIUM; otherwise LOW. The keyword list, weights, 0.60 cut-off and severity rules are Paciolus defaults. You can change this for a run. | Paciolus convention |
| AP-T14 Invoice Without PO | When a PO-number column is present, flags payments of $10,000 or more with a blank PO number. HIGH above $50,000 (5 times the floor), otherwise MEDIUM. Skipped when there is no PO column. The ACFE 2024 Report to the Nations describes billing schemes (fictitious invoices) as a category of occupational fraud. It is a fraud survey and does not prescribe a PO-matching test. The $10K floor (reused from AP-T4) and the 5x severity line are Paciolus defaults. A billing-scheme percentage quoted in the code has not been verified and is not repeated here. | Paciolus convention ACFE 2024 |
| Composite score | Each test's flag rate is weighted by its severity (HIGH 3, MEDIUM 2, LOW 1); the weighted sum is divided by the maximum possible and scaled to 0-100. It is then multiplied by 1 + 0.25 x (share of payments flagged by 3 or more tests) and capped at 100. HIGH-severity floors: any HIGH-severity payment lifts the score to at least 11 (Moderate); HIGH payments that are at least 1% of the population and at least 2 lift it to at least 26 (Elevated); at least 5% and at least 5 lift it to at least 51 (High). Tiers: 0-10 Low, 11-25 Moderate, 26-50 Elevated, 51-100 High. The weights, multiplier, floors and tier bands are all Paciolus conventions. The score summarizes how many flags there are; it is not a risk assessment under any standard. | Paciolus convention |
Payroll Testing14 rules
| Test | What it does | Basis |
|---|---|---|
| PR-T1 Duplicate Employee IDs | Flags every entry for an employee ID that appears with two or more different employee names. Always HIGH severity. Paciolus test design. May reflect a pending name change rather than misuse. | Paciolus convention |
| PR-T2 Missing Critical Fields | Flags entries with a blank employee name or zero gross pay (HIGH) or a missing pay date (MEDIUM). Data-completeness check; field list and severities are Paciolus defaults. | Paciolus convention |
| PR-T3 Round Salary Amounts | Flags gross pay of $10,000 or more that is an exact multiple of $100K (HIGH), $50K (HIGH), $25K (MEDIUM) or $10K (LOW). Lists at most the 50 largest. ISA 240 and AS 2401 list round numbers as a characteristic of inappropriate journal entries; applying it to pay amounts is a Paciolus extension. The $10K floor, the multiples and the 50-item cap are Paciolus defaults. You can change this for a run. | Paciolus convention ISA 240, AS 2401 |
| PR-T4 Pay After Termination | Flags payments dated after the employee's termination date. Severity: more than 30 days after HIGH, more than 7 days MEDIUM, otherwise LOW. Runs only when a termination-date column is present. The 7- and 30-day bands are Paciolus defaults. A final paycheck shortly after termination is normal. | Paciolus convention |
| PR-T5 Check Number Gaps | Sorts numeric payroll check numbers and flags each jump of 2 or more. Severity: jump over 10 HIGH, over 5 MEDIUM, otherwise LOW. Runs only when a check-number column is present. The minimum jump of 2 and the 5/10 severity bands are Paciolus defaults (tighter than the AP check-gap bands). You can change this for a run. | Paciolus convention |
| PR-T6 Unusual Pay Amounts | Within each department (minimum 5 positive gross-pay entries), flags gross pay 3.0 or more standard deviations from the department mean, in either direction. Severity: z over 5 HIGH, over 4 MEDIUM, otherwise LOW. The 5-entry minimum, 3.0 cut-off and 4/5 severity bands are Paciolus defaults. The mean and standard deviation include the entry being tested. You can change this for a run. | Paciolus convention |
| PR-T7 Pay Frequency Anomalies | Takes the most common interval between pay dates (1-60 days) as the expected cadence, and for employees with 3 or more pay dates flags intervals more than 50% shorter or longer than it. An employee who is regularly paid on a longer cycle of their own (e.g. monthly in a biweekly population) is measured against that cycle. Shorter intervals: MEDIUM if under 30% of the cadence, else LOW; longer intervals LOW. The 50% tolerance, 30% line and 3-entry minimum are Paciolus defaults. You can change this for a run. | Paciolus convention |
| PR-T8 Benford's Law on Gross Pay | Compares the first-digit distribution of gross pay ($1 or more) with Benford's expected distribution using mean absolute deviation (MAD): under 0.006 conforming, under 0.012 acceptable, under 0.015 marginally acceptable, otherwise nonconforming. Requires at least 500 amounts spanning at least 2 orders of magnitude. When marginal or nonconforming, entries in the over-represented digits are flagged. The MAD conformity bands come from Nigrini (2012). The 500-entry minimum (JE testing uses 300), the 2-order-of-magnitude pre-check and the flag severities are Paciolus defaults. Pay is often clustered by pay grade, so a Benford result on a payroll register is weaker evidence than on a general ledger. You can change this for a run. | Published method Nigrini 2012 |
| PR-T9 Ghost Employee Indicators | Counts indicators per employee: no department on any entry; a single pay entry (only when the register covers several pay dates and fewer than half of employees were paid once); pay only in the first and/or last month of the period. With an HR master file it adds: absent from the HR master, paid after the HR termination date, and address matching an executive's. One indicator is MEDIUM, two or more HIGH. The indicator set, the 1-indicator minimum and the severity rule are Paciolus defaults. The code cites ISA 240 / AS 2401 for ghost-employee indicators, but neither standard lists them. You can change this for a run. | Paciolus convention |
| PR-T10 Duplicate Bank Accounts / Addresses | Flags entries whose bank account is shared by two or more employee names (exact match, HIGH), and pairs of employees whose addresses have a text-similarity ratio of 0.90 or more (MEDIUM). Runs only when a bank-account or address column is present. The 0.90 address-similarity cut-off and severities are Paciolus defaults. Family members can legitimately share an address. You can change this for a run. | Paciolus convention |
| PR-T11 Duplicate Tax IDs | Flags every entry whose tax ID is shared by two or more employee names. Always HIGH severity. Runs only when a tax-ID column is present. Paciolus test design. You can change this for a run. | Paciolus convention |
| PR-T12 Duplicate Employee Names | Flags every entry for an employee name (case and spacing ignored) that appears under two or more distinct employee IDs. Always HIGH severity. The ACFE 2024 Report to the Nations describes ghost-employee payroll schemes. It is a fraud survey and does not prescribe this name-matching screen. A ghost-employee percentage quoted in the code has not been verified and is not repeated here. Two employees can genuinely share a name. | Paciolus convention ACFE 2024 |
| PR-T13 Gross-to-Net Reconciliation | Flags entries where gross pay minus deductions differs from net pay by more than $0.01. HIGH if the difference exceeds $100, otherwise MEDIUM. Entries with zero gross, net or deductions are skipped. Arithmetic check. The $0.01 tolerance and $100 severity line are Paciolus defaults. The code cites the AICPA Employee Benefit Plan audit guide; that guide covers benefit-plan audits, the citation is not registered, and it is not relied on here. | Paciolus convention |
| Composite score | Each flag is weighted by its severity (HIGH 3, MEDIUM 2, LOW 1); the total is divided by the number of payroll entries and scaled to 0-100. It is then multiplied by 1 + 0.25 x (share of entries flagged by 3 or more tests) and capped at 100. HIGH-severity floors: any HIGH-severity entry lifts the score to at least 11 (Moderate); HIGH entries that are at least 1% of the population and at least 2 lift it to at least 26 (Elevated); at least 5% and at least 5 lift it to at least 51 (High). Tiers: 0-10 Low, 11-25 Moderate, 26-50 Elevated, 51-100 High. Payroll divides by entries, not by the maximum possible score as the other testing tools do. The weights, multiplier, floors and tier bands are all Paciolus conventions; the score summarizes how many flags there are and is not a risk assessment under any standard. | Paciolus convention |
Revenue Testing20 rules
| Test | What it does | Basis |
|---|---|---|
| Tool framing: presumed fraud risk in revenue recognition | The auditing standards presume a risk of fraud in revenue recognition (rebuttable). Revenue Testing is a battery of analytics over the revenue ledger that helps the auditor respond to that presumed risk; it does not test compliance with ASC 606 / IFRS 15 by itself. The presumption comes from the standards. Which tests run and every number below are Paciolus choices. | Required by a standard or statute ISA 240, AS 2401 |
| RT-01 Large Manual Revenue Entries | Flags revenue entries of $50,000 or more. If the entry type marks the entry as manual: HIGH above $100,000 (2x the threshold), otherwise MEDIUM. If the file has no entry-type column, entries at or above $50,000 are flagged LOW (source unknown). Entries typed as non-manual are not flagged. The fraud standards point auditors to non-standard and manual entries. The $50,000 threshold and the 2x HIGH band are fixed Paciolus defaults. Despite the engine and memo wording, the threshold is not linked to the engagement's performance materiality. | Described by a standard ISA 240, AS 2401 |
| RT-02 Year-End Revenue Concentration | Flags the entries in the last 7 days of the period when they make up more than 20% of period revenue (by absolute amount). HIGH above 40%, otherwise MEDIUM. The period end is the one the user enters, or else the month-end of the last entry date. The user can enter the period start and end dates. The 7-day window and the 20% / 40% bands are fixed Paciolus defaults. You can change this for a run. | Paciolus convention ISA 240 |
| RT-03 Round Amount Revenue Entries | Flags entries of $10,000 or more that are exact multiples of $100,000 (HIGH), $50,000 (HIGH), $25,000 (MEDIUM) or $10,000 (LOW). Each entry is matched to the largest of these that applies. At most 50 entries are listed. The fraud standards list entries with round numbers as a typical feature of inappropriate journal entries. The divisors, the $10,000 floor and the 50-entry list limit are Paciolus defaults. | Described by a standard ISA 240, AS 2401 |
| RT-04 Revenue Sign Anomalies | Works out which sign the file uses for revenue (whichever sign most non-zero rows have), then flags entries with the opposite sign that are not marked as contra-revenue by keyword (return, refund, allowance, discount, rebate, credit memo/note, reversal, write-off, contra, adjustment). HIGH above $50,000, MEDIUM above $10,000, otherwise LOW. Revenue normally carries a credit balance, which is basic bookkeeping. The keyword list and the $10,000 / $50,000 bands are Paciolus defaults. | Paciolus convention |
| RT-05 Unclassified Revenue Entries | Flags entries that have neither an account name nor an account number. All are MEDIUM. The fraud standards list entries without account numbers as a typical feature of inappropriate journal entries. The MEDIUM severity is a Paciolus choice. | Described by a standard ISA 240, AS 2401 |
| RT-06 Revenue Z-Score Outliers | With at least 10 non-zero entries, flags entries whose absolute amount is 2.5 or more standard deviations from the mean of all entries in the file. Severity: HIGH when z > 5, MEDIUM when z > 4, otherwise LOW. The 2.5 cut-off, the 10-entry minimum and the 4 / 5 severity bands are Paciolus defaults. The mean and standard deviation come from the whole file, not from each account or prior periods. The memo's "account's historical distribution" wording does not match the code. | Paciolus convention |
| RT-07 Revenue Trend Variance | If the user enters prior-period revenue, compares it with current net revenue and flags a change of more than 30% as one aggregate finding. HIGH above 50%, otherwise MEDIUM. Skipped when no prior-period figure is entered. Comparing periods is an analytical procedure (ISA 520). The user enters the prior-period total. The 30% / 50% bands are fixed Paciolus defaults. The memo describes a month-by-month trend line, but the code compares one total with another. You can change this for a run. | Paciolus convention ISA 520 |
| RT-08 Revenue Concentration Risk | Flags every entry in an account that holds more than 50% of gross revenue (the file's normal-sign side). HIGH above 70%, otherwise MEDIUM. The 50% / 70% bands are Paciolus defaults. | Paciolus convention |
| RT-09 Cut-Off Risk (period end) | Flags entries dated within 3 days of the period end, where revenue can be recognised too early. HIGH above $50,000, MEDIUM above $10,000, otherwise LOW. The period end is the one the user enters, or else the month-end of the last entry date. The fraud standards name early recognition and entries at the end of a period as risks. The user can enter the period dates. The 3-day window and the $10,000 / $50,000 bands are fixed Paciolus defaults. You can change this for a run. | Described by a standard ISA 240, AS 2401 |
| RT-09b Prior-Period Timing (period start) | Flags entries dated within 3 days after the period start. These may be prior-period revenue booked late into the current period. HIGH above $50,000, MEDIUM above $10,000, otherwise LOW. Split from RT-09 so that each timing direction gets its own follow-up. The user can enter the period dates. The 3-day window and amount bands are fixed Paciolus defaults. You can change this for a run. | Paciolus convention ISA 240 |
| RT-10 Benford's Law (first digit) | Compares the first digits of amounts of $1 or more with the Benford distribution, using mean absolute deviation (MAD): conforming below 0.006, acceptable below 0.012, marginally acceptable below 0.015, nonconforming above that. Runs only with at least 50 qualifying entries spanning at least 2 orders of magnitude. When the result is marginal or nonconforming, entries in over-represented digit groups are flagged (MEDIUM if nonconforming, LOW if marginal). The MAD bands come from Nigrini (2012). The 50-entry minimum is a Paciolus default and is well below the 300 that Journal Entry Testing uses on Nigrini's guidance, so results on small revenue files are less reliable. | Published method Nigrini 2012 |
| RT-11 Duplicate Revenue Entries | Flags entries that share the same amount, date and account. HIGH when the amount is above $10,000, otherwise MEDIUM. The matching key and the $10,000 band are Paciolus defaults. | Paciolus convention |
| RT-12 Contra-Revenue Anomalies | Picks out contra-revenue entries by keyword (see RT-04) and flags all of them when they exceed 15% of gross revenue. HIGH above 25%, otherwise MEDIUM. The keyword list and the 15% / 25% bands are Paciolus defaults. | Paciolus convention |
| RT-13 Recognition Before Obligation Satisfaction (contract-aware) | Requires an obligation-satisfaction-date column. Flags revenue recorded before the satisfaction date: HIGH if more than 7 days before, otherwise MEDIUM. Entries marked as recognised over time (over-time, percentage of completion, input/output method) are exempt. Confidence is reduced when contract data is partial or there is no contract ID. ASC 606 / IFRS 15 require revenue to be recognised when (or as) a performance obligation is satisfied. The test relies on the satisfaction date in the client's data. The 7-day HIGH band and the confidence adjustments are Paciolus defaults. | Required by a standard or statute ASC 606, IFRS 15 |
| RT-14 Missing Obligation Linkage (contract-aware) | Requires a contract-ID or performance-obligation-ID column. Flags entries that have a contract ID but no performance-obligation ID (MEDIUM), and entries that have a performance-obligation ID but no contract ID (LOW). ASC 606 / IFRS 15 require performance obligations to be identified (Step 2). They do not require the ledger to tag each entry with an obligation ID, so a missing tag is a documentation signal, not a breach. The severities are Paciolus choices. The memo mentions "purchase order", which the code does not check. | Paciolus convention ASC 606, IFRS 15 |
| RT-15 Modification Treatment Mismatch (contract-aware) | Requires contract-ID and contract-modification columns. Flags all entries of a contract when its entries show more than one modification type (HIGH), or when some entries are marked as modified and others are not (MEDIUM). ASC 606 / IFRS 15 set out how contract modifications are accounted for. A contract can properly carry several modifications treated in different ways, so mixed treatment is a reason to look, not evidence of non-compliance. The engine wording "risk indicator for non-compliance" overstates this. The severities are Paciolus choices. | Paciolus convention ASC 606, IFRS 15 |
| RT-16 Allocation Inconsistency (contract-aware) | Requires contract-ID and allocation-basis columns. Flags all entries of a contract that uses more than one allocation basis (HIGH), or where only some entries record a basis (LOW). Confidence is reduced when fewer than half the entries have a basis. ASC 606 / IFRS 15 require the transaction price to be allocated on relative standalone selling prices. They allow different estimation methods for different obligations in the same contract, so more than one basis is not in itself inconsistent. The severities and the 50% fill-rate cut-off are Paciolus choices. | Paciolus convention ASC 606, IFRS 15 |
| RT-17 Contract Data Completeness | Runs when any entry has contract data. Checks three things on each entry: a contract ID with no performance-obligation ID; a recognition method with no contract ID; point-in-time recognition with no obligation-satisfaction date. HIGH when two or more apply, MEDIUM when one does. Framed by the five-step model (contract, obligations, point-in-time transfer of control). The checks look for missing data fields and do not assess the contract-existence criteria. The engine calls this "ASC 606 Step 1", but its first check is about Step 2 (performance obligations). The severity rule is a Paciolus choice. | Paciolus convention ASC 606, IFRS 15 |
| Composite score | Each test that ran (skipped tests are left out) contributes its flag rate, weighted by test severity (HIGH 3, MEDIUM 2, LOW 1) and scaled to 0-100. The score is then multiplied by 1 + 0.25 x the share of entries flagged by 3 or more tests, capped at 100. Tiers: 0-10 Low, 11-25 Moderate, 26-50 Elevated, 51-100 High. Minimum scores apply when HIGH-severity rows exist: any HIGH row gives at least 11 (Moderate); HIGH rows that are at least 1% of entries and at least 2 rows give at least 26 (Elevated); at least 5% and at least 5 rows give at least 51 (High). The weights, multiplier, tier bands and minimum-score rules are all Paciolus conventions. The score is a summary signal, not an assessment of risk. | Paciolus convention |
AR Aging14 rules
| Test | What it does | Basis |
|---|---|---|
| Tool framing: allowance as an accounting estimate | AR Aging collects data signals that help the auditor evaluate receivables and the credit-loss allowance. The allowance is an accounting estimate that management measures under the credit-loss standards. The auditor evaluates it under the estimates standards. The standards define the estimate and how it is audited. Every bucket, ratio and percentage below is a Paciolus convention, and none of the tests decides whether the allowance is sufficient. | Required by a standard or statute ASC 326, IFRS 9, ISA 540, AS 2501 |
| AR-01 AR Balance Sign Anomalies (trial balance) | Flags AR accounts in the trial balance that have a credit balance. HIGH when the credit balance is above $10,000, otherwise MEDIUM. Receivables normally carry a debit balance, which is basic bookkeeping. The $10,000 band is a Paciolus default. | Paciolus convention |
| AR-01b Sub-ledger Negative Invoice | When a sub-ledger is supplied, flags invoices with a negative amount (credit memos, reversals or data-entry errors). HIGH above $10,000, otherwise MEDIUM. The $10,000 band is a Paciolus default. A code comment cites an "AICPA Audit Guide for Receivables (5.11)". That reference could not be verified, so it is not cited here. | Paciolus convention |
| AR-02 Missing Allowance (contra-AR) Account | Flags HIGH, against the largest AR account, when the trial balance has AR accounts but no account recognised as an allowance for doubtful accounts or credit losses. ASC 326 / IFRS 9 require expected credit losses to be measured on receivables. They do not require a separately named allowance account in the trial balance (it may be netted, mapped differently, or immaterial). The engine and memo say the account is "required under IFRS 9 / ASC 326", which overstates this. The HIGH severity is a Paciolus choice. | Described by a standard ASC 326, IFRS 9 |
| AR-03 Negative Aging | Flags sub-ledger entries with negative aging days and no due date (a date-logic error). All are MEDIUM. Invoices with a due date that are simply not yet due are not flagged. Aging is measured from the as-of date the user must supply with a sub-ledger. The MEDIUM severity is a Paciolus choice. You can change this for a run. | Paciolus convention |
| AR-04 Unreconciled AR Detail | Compares the sub-ledger total with the trial-balance AR balance and flags a difference larger than the greater of 1% of the AR balance or $100. HIGH when the difference is above 5% of the AR balance, otherwise MEDIUM. Agreeing detail records to the ledger is a common audit-evidence procedure. The 1% / $100 tolerance and the 5% HIGH band are Paciolus defaults. | Paciolus convention ISA 500 |
| AR-05 Aging Bucket Concentration | Groups the sub-ledger into aging buckets (Current 0-30, 31-60, 61-90, 91-120, over 120 days) and flags the top 5 items of any bucket holding more than 60% of total AR. HIGH when that bucket is 91-120 or over 120, otherwise MEDIUM. The bucket boundaries, the 60% threshold and the top-5 sample are Paciolus defaults. | Paciolus convention |
| AR-06 Past-Due Concentration | Flags the top 10 past-due items when receivables more than 30 days past due exceed 25% of total AR. HIGH above 50%, otherwise MEDIUM. Invoices aged only from their invoice date (no due date) are not counted as past due. The 30-day definition, the 25% / 50% bands and the top-10 sample are Paciolus defaults. | Paciolus convention |
| AR-07 Allowance Adequacy Ratio | Divides the allowance by gross AR from the trial balance. Flags HIGH below 1% (possible under-provisioning) and MEDIUM above 10% (possible over-provisioning). The 1% / 10% range is a fixed Paciolus default, not an industry benchmark (the memo says "industry benchmarks", which the code does not use). Whether the allowance is sufficient remains the auditor's judgement under ISA 540 / AS 2501. | Paciolus convention ASC 326, IFRS 9, ISA 540 |
| AR-08 Customer Concentration | Flags the top 3 items of any customer holding more than 20% of total amounts owed (customers in credit are left out of the base). HIGH above 40%, otherwise MEDIUM. The 20% / 40% bands and the top-3 sample are Paciolus defaults. | Paciolus convention |
| AR-09 DSO Trend Variance | Days sales outstanding = AR / revenue x days in period (default 365). If the user enters a prior-period DSO, flags a change of more than 20% (HIGH above 50%, otherwise MEDIUM). Skipped when no prior DSO is entered. A ratio comparison is an analytical procedure (ISA 520). The user enters the prior DSO and the number of days in the period. The 20% / 50% bands are fixed Paciolus defaults. You can change this for a run. | Paciolus convention ISA 520 |
| AR-10 Roll-Forward Reconciliation | If the user enters beginning AR and total collections, checks beginning + revenue - collections against ending AR. Flags a difference larger than the greater of 5% of ending AR or $100. HIGH above 10%, otherwise MEDIUM. Skipped when either input is missing. The user enters beginning AR and collections. Revenue is taken from the trial balance and is treated entirely as credit sales. The 5% / $100 tolerance and the 10% band are fixed Paciolus defaults. You can change this for a run. | Paciolus convention |
| AR-11 Credit Limit Breaches | When the sub-ledger has a credit-limit column, flags the top 3 items of each customer whose balance exceeds its limit. HIGH above 150% of the limit, otherwise MEDIUM. The 150% band and the top-3 sample are Paciolus defaults. | Paciolus convention |
| Composite score | Only tests that ran count (without a sub-ledger, only the trial-balance tests AR-01, AR-02, AR-07 and AR-09 can run). Each test contributes its flag rate, weighted by test severity (HIGH 3, MEDIUM 2, LOW 1) and scaled to 0-100. The score is then multiplied by 1 + 0.25 x the share of items flagged by 2 or more tests (AR uses 2, not 3), capped at 100. Tiers: 0-10 Low, 11-25 Moderate, 26-50 Elevated, 51-100 High. Minimum scores apply when HIGH-severity rows exist: any HIGH row gives at least 11 (Moderate); HIGH rows that are at least 1% of items and at least 2 rows give at least 26 (Elevated); at least 5% and at least 5 rows give at least 51 (High). The weights, multiplier, multi-flag threshold, tier bands and minimum-score rules are all Paciolus conventions. Aggregate tests (reconciliation, ratios, DSO, roll-forward) report a flag rate of 0 or 100%. | Paciolus convention |
Fixed Assets12 rules
| Test | What it does | Basis |
|---|---|---|
| FA-01 Fully Depreciated Assets | Flags assets still on the register whose accumulated depreciation is equal to or greater than cost (net book value zero or below). Severity by cost: HIGH above $100,000, MEDIUM above $10,000, otherwise LOW. Fully depreciated assets in use are not errors in themselves; the flag prompts a review for disposals or ghost assets. The cost bands are Paciolus defaults. | Paciolus convention |
| FA-02 Missing Required Fields | Flags register rows missing an identifier (asset ID or description), a cost, or an acquisition date. HIGH when two or more are missing, otherwise MEDIUM. A data-completeness check. The required field list and severity rule are Paciolus choices. | Paciolus convention |
| FA-03 Negative Cost or Accumulated Depreciation | Flags assets with a negative cost or a negative accumulated depreciation figure. HIGH when the larger of the two exceeds $50,000, otherwise MEDIUM. The $50,000 severity cut-off is a Paciolus default. Registers that hold accumulated depreciation as a contra (negative) balance will be flagged here. | Paciolus convention |
| FA-04 Depreciation Exceeds Cost | Flags assets where accumulated depreciation exceeds cost by more than 1% of cost, which is treated as more than rounding. HIGH when the excess is above 10% of cost, otherwise MEDIUM. The 1% rounding allowance and the 10% HIGH band are Paciolus defaults. | Paciolus convention |
| FA-05 Useful Life Outliers | Flags assets with a recorded useful life below 0.5 years or above 50 years. Below the minimum is MEDIUM. Above the maximum is MEDIUM up to 100 years and HIGH beyond that. Useful life is an accounting estimate, and ISA 540 covers how auditors evaluate estimates. The 0.5-year and 50-year bounds are Paciolus defaults, not limits set by ISA 540, ASC 360 or IAS 16. | Paciolus convention ISA 540 |
| FA-06 Cost Z-Score Outliers | Flags assets whose cost is 2.5 or more standard deviations from the mean cost of the register. Needs at least 10 assets with a non-zero cost. Severity: HIGH above z 5, MEDIUM above z 4, otherwise LOW. A standard z-score, measured against the whole register. The 2.5 cut-off, the 10-asset minimum and the 4/5 severity bands are Paciolus defaults. The code comment attributes the severity bands to Nigrini 2012; we treat them as a Paciolus choice. | Paciolus convention |
| FA-07 Asset Age Concentration | Flags every asset acquired in a year that accounts for more than 50% of total register cost (a possible sign of bulk capitalisation). HIGH when that year exceeds 70%, otherwise MEDIUM. The 50% and 70% bands are Paciolus defaults. | Paciolus convention |
| FA-08 Duplicate Assets | Flags assets that share the same cost, description and acquisition date. HIGH when the shared cost is above $50,000, otherwise MEDIUM. The matching key and the $50,000 band are Paciolus defaults. Identical purchases bought on the same day (for example, several identical laptops) will also match. | Paciolus convention |
| FA-09 Residual Value Anomalies | Flags a negative residual (salvage) value as HIGH. Also flags a residual value above 30% of cost: HIGH above 50% of cost, otherwise MEDIUM. Residual value is an accounting estimate (ISA 540). The 30% and 50% thresholds are Paciolus defaults. ISA 540 does not set a residual-value percentage. | Paciolus convention ISA 540 |
| FA-10 Lease Indicators | Looks for lease keywords in asset descriptions (lease, leased, leasehold, right-of-use, ROU, finance lease, operating lease, capital lease) and flags each match as MEDIUM, so the treatment under ASC 842 / IFRS 16 can be confirmed. ASC 842 and IFRS 16 set out how leased assets are recognised. They do not define this test. The keyword list is a Paciolus choice. A match only suggests a lease and says nothing about how the lease should be classified. | Described by a standard ASC 842, IFRS 16 |
| FA-T11 Depreciation Recalculation | Runs when cost, useful life, depreciation method and acquisition date are all present. It recalculates expected accumulated depreciation to the as-of date. Straight-line uses (cost - residual) / life x years elapsed. Declining balance uses cost x (1 - (1 - r)^t), where r = 2/life, or 1.5/life for 150% DB. The result is capped at cost less residual. Flags a variance above 5% for straight-line or above 15% for declining balance. HIGH above 25%, otherwise MEDIUM. Skips future-dated assets, assets more than 1.5 times past their useful life, and unrecognised methods. Straight-line and declining-balance are depreciation methods accepted under ASC 360 and IAS 16. The 5% and 15% tolerances, the 25% HIGH band, the 1.5x-life skip and the 365.25-day year are Paciolus defaults. Partial-year conventions (half-year, mid-quarter) are not modelled, and the wider declining-balance tolerance is meant to absorb that. Elapsed time runs to the engagement period end or as-of date when one is set, otherwise to the processing date. | Paciolus convention ASC 360, IAS 16 |
| Composite score | For each test, the flag rate is multiplied by the test's severity weight (HIGH 3, MEDIUM 2, LOW 1). The total is divided by the sum of the weights and scaled to 0-100. It is then multiplied by 1 + 0.25 x the share of rows flagged by 3 or more tests, and capped at 100. Tiers: 0-10 Low, 11-25 Moderate, 26-50 Elevated, 51-100 High. Floors for HIGH-severity rows: any HIGH row sets a minimum of 11 (Moderate). HIGH rows that are at least 1% of rows and at least 2 in number set a minimum of 26 (Elevated). At least 5% and at least 5 set a minimum of 51 (High). The weights, multiplier, tier bands and floors are all Paciolus conventions. The score ranks where to look first. It is not a risk assessment. | Paciolus convention |
Inventory Testing11 rules
| Test | What it does | Basis |
|---|---|---|
| IN-01 Missing Required Fields | Flags items missing an identifier (item ID or description), a quantity, or a unit cost or value (quantity and cost count as missing only when extended value is also zero). HIGH when two or more are missing, otherwise MEDIUM. A data-completeness check. The memo describes it as an ISA 500 indicator, but the field list and severity rule are Paciolus choices. | Paciolus convention |
| IN-02 Negative Quantities or Costs | Flags items with a negative quantity, unit cost or extended value. HIGH when the larger of extended value or quantity x unit cost exceeds $50,000, otherwise MEDIUM. The $50,000 severity cut-off is a Paciolus default. | Paciolus convention |
| IN-03 Extended Value Mismatch | Flags items where quantity x unit cost differs from the recorded extended value by more than 1% or by more than $1,000. A zero extended value is tested when the register carries extended values. Severity by dollar difference: HIGH above $10,000, MEDIUM above $1,000, otherwise LOW. The 1% and $1,000 tolerances and the severity bands are Paciolus defaults. | Paciolus convention |
| IN-04 Unit Cost Outliers | Flags items whose unit cost is 2.5 or more standard deviations from the mean unit cost. Needs at least 10 items with a non-zero cost. Severity: HIGH above z 5, MEDIUM above z 4, otherwise LOW. The 2.5 cut-off, the 10-item minimum and the severity bands are Paciolus defaults. Measured across the whole register, not within each category. | Paciolus convention |
| IN-05 Quantity Outliers | Flags items whose quantity is 2.5 or more standard deviations from the mean quantity. Needs at least 10 items with a non-zero quantity. Severity: HIGH above z 5, MEDIUM above z 4, otherwise LOW. The 2.5 cut-off, the 10-item minimum and the severity bands are Paciolus defaults. | Paciolus convention |
| IN-06 Slow-Moving Inventory | Flags items with no movement for more than 180 days, counted from the last movement date to the as-of date. Severity: HIGH above 365 days, MEDIUM above 270 days, otherwise LOW. An obsolescence indicator that feeds the valuation estimate (ISA 540). It does not determine obsolescence or NRV. The 180, 270 and 365-day bands are Paciolus defaults. Days run to the engagement period end or as-of date when one is set, otherwise to the processing date. | Paciolus convention ISA 540 |
| IN-07 Category Concentration | Flags every item in a category holding more than 50% of total inventory value. HIGH when that category exceeds 70%, otherwise MEDIUM. The 50% and 70% bands are Paciolus defaults. | Paciolus convention |
| IN-08 Duplicate Items | Flags items with the same description and unit cost (one item entered under two IDs), and the same item ID recorded twice at one location. The same SKU stocked at different locations is not flagged. HIGH when the group's combined value exceeds $50,000, otherwise MEDIUM. The matching keys and the $50,000 band are Paciolus defaults. | Paciolus convention |
| IN-09 Zero-Value Items | Flags items with quantity on hand but neither a unit cost nor an extended value. MEDIUM when the quantity is above 100, otherwise LOW. Flags a possible pricing problem. It does not determine a write-down. The 100-unit band is a Paciolus default. | Paciolus convention |
| IN-T10 Lower of Cost and NRV Indicator | Runs only when a selling-price or NRV column is present. Flags items whose unit cost is more than 90% of the selling price, which is a margin below 10%. HIGH when unit cost exceeds the selling price (the item is underwater), otherwise MEDIUM. The requirement: IAS 2 measures inventory at the lower of cost and net realisable value. ASC 330 uses lower of cost and NRV for most methods, and lower of cost or market for LIFO and the retail method. The test is a Paciolus proxy. It treats selling price as NRV without deducting costs to complete or sell, and the 10% margin floor is a Paciolus default. A flag points to a possible write-down. It is not an NRV measurement. | Required by a standard or statute IAS 2, ASC 330 |
| Composite score | For each test, the flag rate is multiplied by the test's severity weight (HIGH 3, MEDIUM 2, LOW 1). The total is divided by the sum of the weights and scaled to 0-100. It is then multiplied by 1 + 0.25 x the share of rows flagged by 3 or more tests, and capped at 100. Tiers: 0-10 Low, 11-25 Moderate, 26-50 Elevated, 51-100 High. Floors for HIGH-severity rows: any HIGH row sets a minimum of 11 (Moderate). HIGH rows that are at least 1% of rows and at least 2 in number set a minimum of 26 (Elevated). At least 5% and at least 5 set a minimum of 51 (High). The weights, multiplier, tier bands and floors are all Paciolus conventions. | Paciolus convention |
Three-Way Match9 rules
| Test | What it does | Basis |
|---|---|---|
| Phase 1: PO-number match | Links each purchase-order line to invoices and receipts that carry the same PO number (case-insensitive). On a multi-line PO, each line takes the closest invoice or receipt line, by description first, then quantity, then unit price. Several receipts against one line are combined as partial deliveries. When no receipt references the PO, a receipt that references the linked invoice number is used. Matching PO, receiving and invoice records is a procedure for gathering audit evidence (ISA 500). The linkage rules are Paciolus choices. | Paciolus convention ISA 500 |
| Phase 2: Fuzzy fallback match | For POs left unmatched, scores candidate invoices on vendor name similarity (40%), amount closeness (30%) and date proximity between order and invoice date (30%). Scores candidate receipts on vendor similarity (50%) and quantity closeness (50%). A candidate needs vendor similarity of at least 0.85 and a combined score of at least 0.70. An invoice with no receipt is recorded as a partial match. The weights, the 0.85 vendor-similarity cut-off (SequenceMatcher ratio) and the 0.70 composite cut-off are Paciolus defaults. The vendor-similarity cut-off can be changed in the tool's saved settings or for one run, the composite cut-off for one run; the weights cannot be changed in the app. You can change this for a run. | Paciolus convention |
| Amount variance (PO vs invoice) | Flags a difference between PO total and invoice total above $0.01. Severity by percentage of the PO total: HIGH above 10%, MEDIUM above 5%, otherwise LOW. The $0.01 tolerance and the 5% and 10% bands are Paciolus defaults. You can change this for a run. | Paciolus convention |
| Quantity variance (PO vs receipt) | Flags any difference between ordered and received quantity (tolerance 0). Severity by percentage of the ordered quantity: HIGH above 10%, MEDIUM above 5%, otherwise LOW. Exact-quantity matching and the 5% and 10% bands are Paciolus defaults. You can change this for a run. | Paciolus convention |
| Billed quantity variance (invoice vs receipt) | Flags any difference between invoiced and received quantity. Billing for more than was received is HIGH when the difference is above 5%, otherwise MEDIUM. Billing for less (a partial invoice) is MEDIUM above 10%, otherwise LOW. Over-billing is graded more severely than under-billing because paying for goods not received is the payment risk this match is designed to catch. The bands are Paciolus defaults. You can change this for a run. | Paciolus convention |
| Price variance (PO vs invoice unit price) | Flags a unit-price difference above 5% of the PO unit price. HIGH above 10%, otherwise MEDIUM. The 5% threshold and 10% band are Paciolus defaults. You can change this for a run. | Paciolus convention |
| Delivery date variance (receipt vs PO expected delivery) | Flags a receipt dated more than 30 days from the PO expected delivery date. HIGH above 60 days, MEDIUM above 30 days. The 30-day window and 60-day band are Paciolus defaults. You can change this for a run. | Paciolus convention |
| Unmatched documents | Lists POs with no matching invoice or receipt, invoices with no matching PO, and receipts with no matching PO or invoice. An invoice without a PO may mean a payment was made without an authorised order. Each unmatched item needs follow-up by the auditor. | Paciolus convention |
| Overall risk assessment | Match rate = full matches / largest document population + 0.5 x partial matches / largest population. Material variances are those rated HIGH or MEDIUM. LOW: match rate at least 90% and no material variances. MEDIUM: match rate at least 70% and no more than 5 material variances. Otherwise HIGH. The denominator, the half credit for partial matches, and the 90%, 70% and 5-variance bands are Paciolus conventions. This tool uses a 3-level scale, unlike the 4-tier composite score. | Paciolus convention |
Bank Reconciliation10 rules
| Test | What it does | Basis |
|---|---|---|
| One-to-one matching | Matches each bank transaction to an unmatched ledger transaction, largest amounts first. The amounts must agree within $0.01 and the dates must be the same day (date tolerance 0). If either date is missing, the match is allowed. Unmatched items become bank-only or ledger-only. Bank reconciliation is a substantive procedure that produces audit evidence (ISA 500). The $0.01 amount tolerance, the same-day date rule and the largest-first order are Paciolus defaults. | Paciolus convention ISA 500 |
| Split matching (one bank item to several ledger items) | Turns a bank-only item into a split match when 2 to 4 ledger-only items with the same sign, from the same date window, sum to the bank amount within $0.01. The search considers at most 20 candidate ledger items for each bank item. The 2-4 item limit and the cap of 20 candidates are Paciolus conventions that keep the search bounded. A valid split can be missed when more than 20 candidates qualify; such a bank item stays an open exception, marked as not searched exhaustively. | Paciolus convention |
| Reconciling difference | Reports total bank amount minus total ledger amount across matched, split, bank-only and ledger-only items. A difference greater than $0.01 adds 15 points to the diagnostic score, plus 10 more when it exceeds performance materiality (default $50,000, which can be entered for each run). The point values and the $50,000 default are Paciolus conventions. Materiality and performance materiality can be entered in the run settings; the results state each figure used and whether it was entered or is the default. You can change this for a run. | Paciolus convention |
| Stale deposits in transit | Flags ledger-only receipts (deposits recorded in the books but not yet credited by the bank) that are more than 10 days older than the latest bank statement date. HIGH above 30 days, otherwise MEDIUM. The 10-day and 30-day bands are Paciolus defaults. | Paciolus convention |
| Stale outstanding checks | Flags ledger-only payments more than 90 days older than the latest bank statement date, rated MEDIUM. The 90-day cut-off is a Paciolus default. State unclaimed-property rules for stale checks are not applied. | Paciolus convention |
| NSF / returned items | Flags any bank or ledger item whose description contains NSF, return(ed), bounced, insufficient, R01, R02, chargeback, reversed or dishonoured, rated HIGH. The keyword list is a Paciolus choice. R01 and R02 are ACH return reason codes. | Paciolus convention |
| Same-day transfer pairs | Flags a debit and a credit of $10,000 or more on the same date whose amounts agree within $1.00, rated HIGH, as a possible interbank transfer or check-kiting pattern. The $10,000 threshold and $1.00 tolerance are Paciolus defaults. Most such pairs are legitimate transfers between the entity's own accounts. The memo cites a specific ISA 240 paragraph for kiting. We could not confirm that citation, so it is not repeated here. | Paciolus convention |
| High-value transactions | Flags any single bank or ledger transaction at or above materiality (default $50,000, which can be entered for each run), rated MEDIUM. The code compares against materiality, while the memo text says performance materiality. Both default to $50,000. You can change this for a run. | Paciolus convention |
| Suggested journal entries | Proposes an entry for bank-only items whose description or reference matches a keyword list: NSF, wire fee, overdraft, service charge, interest income, interest expense, bank fee. Each comes with default accounts and a confidence between 0.85 and 0.95. These are suggestions for the auditor to review, not entries to post. The keywords, default accounts and confidences are Paciolus choices. | Paciolus convention |
| Diagnostic score | Additive points, capped at 100. Reconciling difference 15, or 25 when above performance materiality. More than 20 outstanding items 8, more than 10 outstanding items 4. Any stale deposit 6. Any stale check 4. Any NSF item 10. Any same-day transfer pair 15. Any high-value item 5. Tiers: 0-10 Low, 11-25 Moderate, 26-50 Elevated, 51-100 High. All point values and tier bands are Paciolus conventions. | Paciolus convention |
Trial Balance Diagnostics21 rules
| Test | What it does | Basis |
|---|---|---|
| Materiality threshold | Every TB finding is labelled material or immaterial against a dollar materiality threshold that you enter for the run (default 0, meaning no materiality split). Many findings below are HIGH when material and MEDIUM or LOW when not. ISA 320 frames materiality as auditor judgment; Paciolus does not compute it for you on this screen. You can change this for a run. | Paciolus convention ISA 320 |
| Trial balance in balance | Total debits must equal total credits, within a one-cent tolerance. Double-entry identity. The one-cent tolerance is a Paciolus rounding allowance. | Paciolus convention |
| Balance sheet equation | Assets are compared with liabilities plus equity. A difference under $1,000 is LOW, $1,000 to $9,999 MEDIUM, $10,000 or more HIGH. The equation is the accounting identity; the $1,000 / $10,000 severity bands are Paciolus defaults. | Paciolus convention |
| Abnormal balance direction | Each account is classified (from your account-type column, or by keyword when none is supplied) and flagged when its net balance runs opposite to its normal side, for example a credit-balance asset. HIGH when at or above materiality, otherwise LOW. Keyword classification and the severity mapping are Paciolus heuristics; contra accounts are recognised and excluded. | Paciolus convention |
| Round-number balances | Balances of $10,000 or more that are exact multiples of $100,000 (HIGH pattern), $50,000 (MEDIUM) or $10,000 (LOW) are flagged; account types where round balances are normal (for example loans or share capital) are downgraded to informational or minor. Three or more accounts of the same type carrying the identical round amount are raised to HIGH. At most 20 are reported. Round numbers are a recognised indicator in journal-entry guidance (AS 2401 / ISA 240); the dollar bands, account-type tiers and 3-account rule are Paciolus defaults. | Paciolus convention |
| Suspense and clearing accounts | Accounts whose names match weighted suspense/clearing keywords (for example suspense, clearing, to be allocated) or structural signals (no letters, placeholder names) at a confidence of 0.60 or more, and that carry a balance, are flagged. HIGH when material, otherwise MEDIUM. Keyword list, weights and the 0.60 cut-off are Paciolus defaults. | Paciolus convention |
| Category concentration | A single account holding 50% or more of its category total (asset, liability, revenue or expense) is HIGH; 25% to 49% is MEDIUM. Categories under $1,000 in total are skipped. ASC 275 requires disclosure of certain concentrations; the 25% / 50% bands and the $1,000 floor are Paciolus defaults, not ASC 275 figures. | Paciolus convention ASC 275 |
| Revenue and expense concentration | A single revenue account above 30% of total revenue, or a single expense account above 40% of total expenses, is flagged. HIGH when material, otherwise MEDIUM. The 30% and 40% thresholds are Paciolus defaults. | Paciolus convention ASC 275 |
| Related-party accounts | Accounts whose names indicate related-party activity (for example officer, shareholder, related party) are flagged for a disclosure assessment. HIGH when material, otherwise MEDIUM. ASC 850 requires related-party disclosures; the keyword detection and severity mapping are Paciolus heuristics. | Described by a standard ASC 850 |
| Intercompany imbalance (single TB) | Intercompany receivable and payable accounts within one trial balance are paired by counterparty (from a mapping you supply, else parsed from the account name) and flagged when they do not offset. HIGH when material, otherwise MEDIUM. The multi-entity elimination workflow is the separate Intercompany Elimination tool. | Paciolus convention |
| Equity signals | A retained-earnings deficit (debit balance) alongside declared dividends is flagged as a governance and solvency signal. HIGH when the deficit is material, otherwise MEDIUM. Paciolus heuristic; whether a distribution was lawful is a legal question outside the tool. | Paciolus convention |
| Account number gaps | Gaps of 10 or more in the numeric account sequence are reported: 100 or more with tight clusters on both sides is HIGH, 50 or more MEDIUM, otherwise LOW. Forensic signal for suppressed accounts; all thresholds are Paciolus defaults. | Paciolus convention |
| Classification validator | Checks the chart of accounts for duplicate account numbers, orphan accounts, unclassified accounts (material at $1,000 or more), numbering gaps of 100 or more, inconsistent naming (name similarity 0.6 or more) and sign anomalies. All thresholds are Paciolus defaults. | Paciolus convention |
| Lead sheet mapping | Accounts are grouped into lettered lead sheets (A to Z) by account type and name keywords. The lead-sheet scheme is a Paciolus workpaper convention. | Paciolus convention |
| Financial ratios | 17 core ratios (current, quick, debt-to-equity, gross, net and operating margin, interest coverage, ROA, ROE, DSO, DPO, DIO, cash conversion cycle, equity ratio, long-term debt ratio, asset, inventory and receivables turnover) are computed with textbook formulas. ROA and ROE use average balances when prior-period totals are supplied, otherwise ending balances. Equity includes current-period earnings that have not yet been closed to retained earnings. Ratio analysis is an analytical procedure under ISA 520 / AS 2305; the formulas are standard practice, not prescribed by those standards. Adding unclosed earnings keeps equity consistent with assets minus liabilities before year-end close. | Paciolus convention ISA 520, AS 2305 |
| Ratio interpretation bands | Each ratio is labelled against fixed bands, for example current ratio 2.0 strong / 1.0 adequate / 0.5 warning; debt-to-equity 0.5 / 1.0 / 2.0; interest coverage 3.0x adequate, 1.5x watch; DSO 30 / 45 / 60 / 90 days. Negative equity is reported as balance-sheet insolvency. Industry-generic bands chosen by Paciolus; appropriate levels vary by industry. | Paciolus convention |
| DuPont decomposition | ROE is decomposed as net profit margin x asset turnover x equity multiplier (ending balances), and the product is checked against ending-basis ROE. A standard financial-analysis identity; not drawn from an audit standard. | Paciolus convention |
| Industry benchmarks | Selected ratios are placed on a percentile scale against benchmark distributions for six industries; above the 65th percentile and below the 40th are highlighted. Benchmark figures are Paciolus-curated reference data; the code describes them as RMA-style distributions. Treat them as indicative, not as a published dataset. | Paciolus convention |
| Going concern indicators | Flags net liability position, working capital deficit, recurring losses, revenue decline over 10%, debt-to-equity above 3.0, and (when supplied) negative operating cash flow and breaches of covenant floors/ceilings you enter. ISA 570 lists these as examples of events or conditions that may cast doubt on going concern. The 10% decline and 3.0 leverage triggers are Paciolus defaults; covenant thresholds and operating cash flow are your inputs. Descriptive only; no going concern conclusion is drawn. You can change this for a run. | Described by a standard ISA 570, AU-C 570 |
| Lease account diagnostics | Lease accounts are found by keyword. Checks: a right-of-use asset is accompanied by a lease liability (and vice versa); current and non-current lease liability portions are both present; the ROU asset reduces versus prior period; a lease expense or amortisation account exists. ASC 842 / IFRS 16 require lessees to recognise both an ROU asset and a lease liability; the keyword detection and the presence checks are Paciolus heuristics. | Described by a standard ASC 842, IFRS 16 |
| Cut-off risk indicators | Accrual, prepaid and deferred-revenue accounts are flagged when the balance is an exact multiple of $1,000 (possible estimate), a material prior balance is now zero (possible omission), or the balance moved more than 3x versus prior period. All three triggers are Paciolus defaults. Cut-off is an assertion considered under ISA 315; the engine does not cite ISA 501. | Paciolus convention |
Multi-Period Comparison8 rules
| Test | What it does | Basis |
|---|---|---|
| Account matching | Accounts are matched across periods by normalised name; rows sharing a normalised name are summed and reported as a duplicate warning. | Paciolus convention |
| Variance formula | Change % = (current - prior) / |prior| x 100. No percentage is shown when the prior balance is under half a cent. The absolute-prior denominator is disclosed on every result. | Paciolus convention |
| Material movement | A movement at or above the materiality amount you enter is classified Material. Materiality is your input. You can change this for a run. | Paciolus convention ISA 320 |
| Significant movement | Below materiality, a movement of $10,000 or more, or 10% or more, is Significant; anything else is Minor. The 10% / $10,000 defaults can be overridden through the API but not yet in the app. | Paciolus convention |
| New, closed and sign-change accounts | Accounts that appear, disappear or flip sign between periods are always at least Significant, and Material when the change reaches materiality. | Paciolus convention |
| Dormant accounts | Accounts that are zero in both periods are listed as dormant. | Paciolus convention |
| Budget variance direction | In the three-way (prior / current / budget) view, income-statement variances are favourable or unfavourable by account nature, within $0.01 counts as on budget, and balance-sheet variances are neutral. | Paciolus convention |
| Comparison as an analytical procedure | Period-over-period comparison grouped by lead sheet supports analytical procedures; expectations and their evaluation remain the auditor's. The tool performs no reclassification detection. | Described by a standard ISA 520, AS 2305 |
Statistical Sampling11 rules
| Test | What it does | Basis |
|---|---|---|
| Confidence levels | You choose the confidence level; supported levels correspond to risks of incorrect acceptance of 1%, 3%, 5%, 10%, 15% and 20% (default 95%). An unsupported level is refused rather than approximated. Poisson reliability factors (e.g. 3.00 at 95%, 2.31 at 90%) are taken from the AICPA guide; the 3%, 15% and 20% rows are recorded in the code as not yet independently corroborated. You can change this for a run. | Published method AICPA Audit Sampling Guide |
| MUS sample size | Sampling interval = (tolerable misstatement - expected misstatement x expansion factor) / reliability factor; sample size = population value / interval, rounded up. Tolerable and expected misstatement are your inputs. Expansion factors (1.6 at 5% risk, 1.5 at 10%) depend only on the risk of incorrect acceptance, per the AICPA guide. You can change this for a run. | Published method ISA 530, AS 2315, AICPA Audit Sampling Guide |
| MUS selection | Systematic dollar-interval selection from a cryptographically random start within the first interval. Negative-balance items are excluded from MUS selection and reported, so they can be tested as a separate stratum. | Published method AICPA Audit Sampling Guide |
| High-value stratum | Items at or above a stratification threshold you set are selected 100%; the remainder is sampled. ISA 530 describes stratification; the threshold is your choice. You can change this for a run. | Described by a standard ISA 530 |
| Random selection sample size | For random selection you either enter a sample size or Paciolus sizes it with the MUS formula above. Reusing the MUS formula to size a random sample is a Paciolus choice. You can change this for a run. | Paciolus convention |
| Minimum population | At least 5 non-zero items are required; smaller populations are declined with a recommendation to use other procedures. | Paciolus convention |
| Misstatement and tainting | A misstatement is recorded minus audited (differences under half a cent ignored); tainting = |misstatement| / |recorded|, capped at 100%. Rows without a readable audited amount are unassessed, not errors, and a warning appears when more than 10% are unassessed. The 10% warning threshold is a Paciolus default. | Paciolus convention |
| MUS evaluation (upper error limit) | Upper error limit = basic precision (reliability factor x interval) + projected misstatement (tainting x interval for each sampled error, largest first) + incremental allowance from the reliability-factor series. Errors in items at or above the interval are added at face value with no projection or allowance. Pass when the limit does not exceed tolerable misstatement. Paciolus labels this the Stringer bound. Pass/fail is an input to the auditor's evaluation, not a conclusion on the population. | Published method ISA 530, AS 2315, AICPA Audit Sampling Guide |
| Zero-error samples | A sample with no errors still reports basic precision. MUS: confidence factor x sampling interval. Random selection: book value x confidence factor / sample size. The MUS figure follows the AICPA guide; the random-selection formula is a Paciolus convention. | Paciolus convention AICPA Audit Sampling Guide |
| Overstatements and understatements | Overstatements and understatements are bounded separately and never netted against each other. Separate evaluation follows the AICPA guide for MUS; Paciolus applies the same rule to random selection. | Published method AICPA Audit Sampling Guide |
| Random selection evaluation | Projected misstatement = misstatement / evaluated sample value x population value; precision = projected x confidence factor / square root of sample size; pass when projected plus precision does not exceed tolerable misstatement. A simplified ratio projection chosen by Paciolus; it is not the classical-variables (standard-deviation) method. | Paciolus convention |
Segregation of Duties13 rules
| Test | What it does | Basis |
|---|---|---|
| AP-01 Vendor master + invoice | A user who can create vendors and also create or post AP invoices. HIGH. COSO 2013 frames segregation of duties generally; this rule library and its severities are Paciolus choices. | Paciolus convention COSO 2013 |
| AP-02 Invoice + payment release | A user who can create AP invoices and also release or post payments. HIGH. | Paciolus convention COSO 2013 |
| AP-03 Payment + bank reconciliation | A user who can release payments and also perform bank reconciliations. HIGH. | Paciolus convention COSO 2013 |
| JE-01 Create + post/approve | A user who can create journal entries and also post or approve them. HIGH. | Paciolus convention COSO 2013 |
| JE-02 Post + period close | A user who can post journal entries and also run period close. MEDIUM. | Paciolus convention COSO 2013 |
| PR-01 Employee master + payroll payment | A user who can add employees and also release payroll payments (ghost-employee risk). HIGH. | Paciolus convention COSO 2013 |
| PR-02 Rate change + payroll payment | A user who can change pay rates and also release payroll payments. MEDIUM. | Paciolus convention COSO 2013 |
| REV-01 Customer create + credit memo | A user who can create customers and also issue or approve credit memos. MEDIUM. | Paciolus convention COSO 2013 |
| REV-02 Invoice + cash application | A user who can raise AR invoices and also apply cash receipts (lapping risk). MEDIUM. | Paciolus convention COSO 2013 |
| INV-01 Custody + inventory adjustment | A user with physical custody of inventory who can also adjust counts or write inventory off. MEDIUM. | Paciolus convention COSO 2013 |
| ADM-01 User admin + transactions | A system administrator who also holds AP invoice, JE, payroll payment or credit memo permissions. HIGH. | Paciolus convention COSO 2013 |
| Effective permissions | A user listed on several rows, or holding several roles, is evaluated on the union of all permissions from all roles. Permissions that no rule mentions are listed so a naming mismatch is not mistaken for a clean result. | Paciolus convention |
| User risk tier | Risk score = 3 per HIGH conflict + 2 per MEDIUM + 1 per LOW. Any HIGH conflict tiers the user High; otherwise a score of 6 or more is High, 3 to 5 Moderate, below 3 Low. Weights and tier cut-offs are Paciolus defaults. Suggested mitigating controls are not tested for operating effectiveness. | Paciolus convention COSO 2013 |
Intercompany Elimination5 rules
| Test | What it does | Basis |
|---|---|---|
| Full elimination of intercompany balances | Reciprocal intercompany balances and transactions between consolidating entities are eliminated: receivables against payables, revenue against expense. The consolidation standards require elimination in full; the matching logic below is Paciolus's. | Required by a standard or statute ASC 810, IFRS 10 |
| Identifying intercompany accounts | An account is intercompany when its name contains whole-word intercompany phrases (due from/to, intercompany receivable/payable, IC AR/AP, management fee, investment in subsidiary) and, for generic phrases such as due to, names another entity in the upload. A counterparty column overrides name parsing. | Paciolus convention |
| Pair matching | Lines are matched one-to-one per entity pair: first compatible lines that reconcile within tolerance, then compatible lines that do not (amount mismatch); anything left is no-reciprocal or direction mismatch. | Paciolus convention |
| Reconciliation tolerance | A pair reconciles when the net residual is within the tolerance (default $1.00). The $1.00 default allows for small cut-off residuals. You can change this for a run. | Paciolus convention |
| Elimination entries | One elimination entry per reconciling pair, for the smaller of the two amounts, reversing each side's natural balance. Non-reconciling pairs get no entry and are listed for manual reconciliation. The tool does not assert the consolidation is complete and computes no investment-in-subsidiary, equity or goodwill elimination. | Paciolus convention ASC 810, IFRS 10 |
W-2 / W-3 Reconciliation9 rules
| Test | What it does | Basis |
|---|---|---|
| Statutory limits by tax year | Limits are applied for the tax year you select. Only tax year 2025 is tabulated; for any other year you must supply the figures, and the run is refused rather than using another year's limits. The per-request override exists in the API but is not exposed in the app; the tool page lists the tax years the app supports, read from the backend. | Paciolus convention |
| Social Security wage base | Box 3 Social Security wages must not exceed the annual wage base ($176,100 for 2025). Payroll wages above the base are flagged HIGH when the draft is not capped. The wage base is set annually by the Social Security Administration. | Required by a standard or statute IRC §3121, Form W-2 |
| Social Security and Medicare tax | Box 4 should equal capped Social Security wages x 6.2%; Box 6 should equal Medicare wages x 1.45% plus 0.9% Additional Medicare Tax on wages over $200,000. Medicare wages are not capped. The employer withholds the 0.9% above $200,000 regardless of filing status. | Required by a standard or statute IRC §3101, Form W-2 |
| Draft W-2 versus payroll | Boxes 1 to 6 and Box 12 codes D (401(k)), S (SIMPLE) and W (HSA) are compared with payroll year-to-date figures, including the tax payroll actually withheld. IRC §6051 requires the employer to furnish the W-2; the line-by-line comparison is the tool's method. | Required by a standard or statute IRC §6051, Form W-2 |
| Difference tolerance and severity | Differences within the tolerance (default $1.00) are ignored; up to 100x the tolerance is MEDIUM; beyond that HIGH. You can change this for a run. | Paciolus convention |
| 401(k) elective deferral limit | Deferrals above the 2025 limit of $23,500, plus a $7,500 catch-up from age 50 or $11,250 at ages 60 to 63, are flagged HIGH. Age must be supplied for catch-up to apply. Figures from IRS Notice 2024-80 as recorded in the code; practitioner re-verification is pending. | Required by a standard or statute IRC §402(g), IRC §414(v) |
| SIMPLE IRA deferral limit | SIMPLE deferrals above the 2025 limit of $16,500 are flagged HIGH. The age-50 and age-60-to-63 SIMPLE catch-up limits are optional inputs; when they are not supplied the catch-up check is reported as not run rather than assumed. | Required by a standard or statute IRC §414(v) |
| HSA contribution limit | HSA contributions above the 2025 limit for the employee's coverage ($4,300 self-only, $8,550 family) are flagged HIGH. The age-55 catch-up is an optional input; when it is not supplied the catch-up check is reported as not run. 2025 base limits from Rev. Proc. 2024-25 as recorded in the code. | Required by a standard or statute IRC §223(b)(3) |
| Form 941 quarters versus payroll | The sum of the four quarterly Forms 941 (federal wages, federal withholding, Social Security wages, Medicare wages) is compared with payroll year-to-date totals. MEDIUM beyond tolerance, HIGH beyond 100x tolerance. The comparison is to payroll totals; the W-3 totals are computed as the sum of the W-2 drafts and are not compared with a separately prepared W-3. You can change this for a run. | Paciolus convention Form 941, Form W-3 |
Form 1099 Preparation10 rules
| Test | What it does | Basis |
|---|---|---|
| 1099-NEC threshold | Nonemployee compensation (including attorney fees) per payee in the tax year at or above the threshold for the year produces a 1099-NEC candidate: $600 through tax year 2025, $2,000 for 2026. Payees between $600 and the threshold are listed separately as not required, for review. The 2026 figure reflects 2025 legislation as reported by secondary sources; confirm against the IRS instructions for the year. From 2027 the threshold is inflation-indexed and Paciolus applies the 2026 figure with a notice to confirm (an indexed threshold cannot be lower, so no required filing is missed). | Required by a standard or statute IRC §6041, IRC §6041A |
| 1099-MISC rents, medical, other income | A 1099-MISC is due when any one box reaches its own threshold: rents (box 1), other income (box 3), medical and health care payments (box 6) at $600 each through tax year 2025 and $2,000 each for 2026. Boxes are not added together. Same basis and confirmation note as the 1099-NEC threshold. | Required by a standard or statute IRC §6041 |
| 1099-MISC royalties | Royalties (box 2) of $10 or more produce a 1099-MISC. | Required by a standard or statute IRC §6050N |
| 1099-MISC attorney gross proceeds | Gross proceeds paid to an attorney (box 10) of $600 or more produce a 1099-MISC. Kept at $600 for 2026 because it is unclear whether the 2025 change reaches this box; the lower figure cannot miss a required filing. Confirm against the IRS instructions. | Required by a standard or statute IRC §6045(f) |
| 1099-INT threshold | Interest of $10 or more per payee produces a 1099-INT. | Required by a standard or statute IRC §6049 |
| Corporate payee exemption | Payments to corporations and S corporations are excluded, except medical and health care payments and payments to attorneys. The exemption and its exceptions come from the Treasury regulations under §6041. Vendors with unknown entity type are not exempted and are flagged. | Required by a standard or statute IRC §6041 |
| Government and tax-exempt payees | Payments to governments and tax-exempt organisations are excluded. Exempt-payee rules from the Treasury regulations under §6041. | Required by a standard or statute IRC §6041 |
| Card and third-party network payments | Payments by credit card or PayPal are excluded because the payment settlement entity reports them on Form 1099-K. Treasury regulations under §6041 defer to 1099-K reporting. Treating every PayPal payment as network-reported is a Paciolus simplification; PayPal friends-and-family transfers are not. | Required by a standard or statute IRC §6041 |
| Payee aggregation and payment year | Thresholds are applied per payee, identified by TIN (vendor records sharing a TIN are combined), to payments dated in the tax year. Undated payments are treated as in the year. | Paciolus convention |
| Data quality and W-9 list | Vendors with a missing TIN, a TIN that is not 9 digits, an incomplete address or unknown entity type are flagged; candidates missing or with invalid TINs go on a W-9 collection list. Format check only; no IRS TIN matching is performed. | Paciolus convention Pub 1220 |
Book-to-Tax Reconciliation5 rules
| Test | What it does | Basis |
|---|---|---|
| Schedule M-1 versus M-3 | Entities with total assets of $10 million or more are labelled M-3 filers; below that, M-1. Both schedules are produced. Total assets is your input. | Required by a standard or statute Form 1120 Schedule M-3 |
| Taxable income bridge | Taxable income = book pretax income + additions - subtractions, laid out as permanent and temporary items. Simplified layout: the bridge starts from pretax book income with the federal-income-tax-per-books line left at zero for you to complete. You can change this for a run. | Required by a standard or statute Form 1120 Schedule M-1, Form 1120 Schedule M-3 |
| Permanent versus temporary catalog | A built-in catalog classifies common items: permanent (50% meals disallowance, fines and penalties, officer life insurance, tax-exempt interest, political and lobbying costs, dividends received deduction) and temporary (depreciation, bad debt reserve, prepaids, accrued vacation, UNICAP, stock compensation, warranty reserve). A catalog-coded item cannot be entered with the opposite nature. The catalog is a convenience list reflecting common Internal Revenue Code treatment; you remain responsible for each item's treatment on your facts. You can change this for a run. | Paciolus convention ASC 740 |
| Deferred tax roll-forward | Deferred tax movement = net temporary differences x the federal rate you enter. A positive movement first reduces any deferred tax liability, then builds a deferred tax asset; a negative movement does the reverse. Simplification: the state rate is not applied to deferred taxes and no valuation allowance is assessed. You can change this for a run. | Paciolus convention ASC 740 |
| Current tax and effective rate | Current tax = taxable income (floored at zero) x federal rate, plus x state rate; total tax expense = current + deferred; effective rate = total tax / book pretax income. No net operating loss carryforward or credits are modelled. You can change this for a run. | Paciolus convention ASC 740 |
Cash Flow Projector7 rules
| Test | What it does | Basis |
|---|---|---|
| Forecast horizon | A daily cash forecast over 90 days from your opening balance and start date, summarised at 30, 60 and 90 days, under base, stress and best scenarios. A forward-looking operational forecast. ASC 230 governs historical statements of cash flows and does not prescribe this method. | Paciolus convention |
| AR collection rates | Share of each AR aging bucket expected to be collected (current / 1-30 / 31-60 / 61-90 / over 90 days): base 95/85/70/50/20%, stress 80/65/50/30/10%, best 100/95/85/70/40%. | Paciolus convention |
| AP payment rates | Share of each AP aging bucket paid within the horizon: base 100/100/95/90/80%, stress 100% throughout, best 90/85/80/75/70%. | Paciolus convention |
| Timing of collections and payments | Expected collections are spread evenly over 30, 20, 15, 10 and 45 days by bucket; current AP is paid over days 10 to 40 and older AP over the first 15, 10, 7 and 5 days. | Paciolus convention |
| Recurring flows | Recurring inflows and outflows you enter are placed on their weekly, biweekly, monthly or quarterly dates; monthly and quarterly dates follow calendar months. You can change this for a run. | Paciolus convention |
| Liquidity flags | Each scenario reports the first day the balance goes negative, the lowest balance and its day, and whether the balance falls below a minimum safe cash level you set. You can change this for a run. | Paciolus convention |
| Collection priorities and AP deferral | AR buckets are ranked by the amount not expected to be collected; AP deferral candidates are listed where the scenario pays less than 100% (none under stress). | Paciolus convention |
Composite risk score (testing tools)3 rules
| Test | What it does | Basis |
|---|---|---|
| Base score | For Journal Entry, AP, Revenue, AR Aging, Fixed Asset and Inventory testing: each test's flag rate is weighted by the test's severity (HIGH 3, MEDIUM 2, LOW 1), summed, and divided by the sum of the weights, giving 0-100. Payroll instead divides the severity-weighted count of flags by the number of rows. The score is then multiplied by 1 + 0.25 x (share of rows flagged by 3 or more tests) and capped at 100. The weights, the multi-flag multiplier and the normalisation are Paciolus conventions. This score summarises the test battery; it is not the ISA 315 risk-of-material-misstatement assessment, which is the auditor's. | Paciolus convention |
| Risk tier bands | Score 0-10 Low, 11-25 Moderate, 26-50 Elevated, 51-100 High. Band boundaries are Paciolus conventions. | Paciolus convention |
| HIGH-severity floors | So that a few serious items are not averaged away in a large file: any HIGH-severity row lifts the score to at least 11 (Moderate); HIGH rows making up at least 1% of rows and numbering at least 2 lift it to at least 26 (Elevated); at least 5% and at least 5 rows lift it to at least 51 (High). Applies to the JE, AP, Payroll, Revenue, AR Aging, Fixed Asset and Inventory composites. The 1% / 5% shares and the 2 / 5 row counts are Paciolus conventions. | Paciolus convention |
Think a citation here is wrong or out of date? Tell us and we will check it against the source and correct it.