Every Controller knows the feeling of the last two days of the close. Entries arrive late, reconciliations are signed off in a hurry, an intercompany difference appears that nobody can explain, and the pack goes to the CFO with a footnote. The controls exist on paper. Whether they operated, on every entry and every account, is often only discovered weeks later by an auditor.
This article looks at financial close controls as something that can be monitored every day, not tested once a quarter. It covers the control surface a Controller actually runs, how journal entry monitoring works, a six-step plan to stand it up, and where AI agents help while finance stays accountable. It is deliberately different from our piece on fraud and transaction-risk intelligence: fraud signals are one use of the data, whereas this is about the routine controls behind every period end.
Crest.Digital’s Agentic GRC adds configurable agents that sit on top of your ledger and subledgers, test close controls daily and keep the evidence ready for audit.
Explore Agentic GRCWhy the Financial Close Is a Control Problem, Not Just a Speed Problem
Most close improvement programmes target days to close. That is a reasonable goal, and it is also incomplete. A fast close with weak controls only moves the errors downstream, where they surface as restatement risk, audit adjustments or a material weakness. A slow close with strong controls is frustrating but defensible. The aim is both: speed that is backed by evidence.
Three structural issues keep close controls fragile. First, the controls are periodic. Reconciliations and reviews happen at month end, so an error posted on day three is found on day thirty. Second, testing is sample-based. Auditors and internal audit review a handful of entries and accounts, which is sensible given their time but leaves most of the population untouched. Third, evidence is scattered across spreadsheets, email approvals and workflow tools, so proving a control operated means rebuilding the story after the fact.
Frameworks already point the other way. COSO’s Internal Control – Integrated Framework describes monitoring activities as ongoing evaluations, separate evaluations, or a combination of both, and the PCAOB expects auditors of listed companies to obtain evidence over the controls that address the risk of material misstatement. Organisations that can show ongoing, evidenced monitoring are better placed on both fronts.
None of this removes the need for judgement. Estimates, provisions and accounting policy choices remain human decisions. What monitoring changes is how early the factual breaks are visible: the entry posted without approval, the reconciliation that never happened, the balance that does not agree between two entities.
The Close Control Surface a Controller Actually Runs
Fraud detection looks for the unusual and the malicious. The close control surface is broader and more routine. We group it into five areas, each of which has data, a rule and an owner.
1. Budget and forecast variance. Actual-to-budget variances that exceed a threshold and have no explanation logged by the cost-centre owner. The control is not the variance itself but the documented, reviewed explanation. Monitoring checks that the explanation exists, is timely and was reviewed by the right person.
2. Account and bank reconciliations. Balance sheet accounts without a completed reconciliation, reconciling items ageing beyond policy, and differences above tolerance. A daily view of reconciliation status replaces the end-of-month scramble and shows which accounts are consistently late.
3. Intercompany and consolidation. Mismatched balances between entities, foreign exchange differences, and eliminations that do not net to zero. These are among the most common causes of last-minute close adjustments, and they are well suited to automated matching and exception queues.
4. Provisions, accruals and estimates. Provisions that have not moved despite changing underlying facts, accruals with no supporting reference, and releases without approval. Agents do not decide adequacy. They flag where the evidence trail is thin so the preparer and reviewer can act. Our related work on inventory controls and order-to-cash exceptions shows how operational data feeds these estimates.
5. Treasury and counterparty limits. Cash positions, bank balances and counterparty concentrations measured against approved limits, covered in more depth in our guide to continuous controls monitoring for treasury and cash management.
Journal Entry Monitoring: Where Close Risk Concentrates
Manual journal entries are the most flexible and least constrained part of the ledger, which is why auditors focus on them and why management override is a recognised risk. Traditional testing pulls a population at period end, applies a few filters and samples. Continuous monitoring applies the same logic daily, to every entry, with the result visible to the owner immediately.
Useful rules are simple and business-readable: entries posted outside the close calendar or on non-working days; round-value or just-below-threshold amounts; entries by users who rarely post or who also approve; unusual account combinations such as revenue against a balance sheet reserve; entries with missing or generic descriptions; and reversals that do not reverse. No single rule proves a problem, and most exceptions will have an ordinary explanation. The value is in the explanation being captured, reviewed and retained.
This connects directly to access governance. A journal entry rule is much stronger when it also knows who could post, who approved and whether that combination breached segregation of duties, which we cover in access governance and SoD monitoring. Where entries originate from AI-assisted tools or automated feeds, the same traceability principles apply, as discussed in AI agents in financial reporting and human approval.
The Crest.Digital platform provides the shared evidence layer, workflow and audit trail, with agentic AI handling exception triage and follow-up.
A Six-Step Plan to Monitor Financial Close Controls
We deliver this as a configurable pod rather than a bespoke build: reusable connectors, orchestration, workflow, an evidence repository and an audit trail, with client effort concentrated on your chart of accounts, rules, thresholds and approvals. The sequence is discover, design, connect, deploy, validate and transfer.
Discover Your Close Pain Points
Map the close calendar, the accounts and entities involved, and where late adjustments, reopened periods and audit findings have clustered. Rank controls by volume, risk and manual effort.
Design Exception Rules and Approvals
Write each rule in business terms: the data, threshold, owner and response time. Decide what an agent may do alone, such as flagging and chasing, and what stays with people, such as posting adjustments.
Connect Ledger and Subledger Data
Integrate the general ledger, subledgers, bank and treasury feeds, intercompany records and the approval workflow. Reconcile record counts to source before trusting any result.
Deploy the First Close Monitors
Release a focused set, for example journal entry anomalies, reconciliation status and intercompany differences, with daily exception queues for named owners.
Validate Against Past Closes
Back-test the rules on two or three previous closes. Would they have caught known adjustments and audit points, and how much noise did they create? Tune before anyone depends on the output.
Transfer or Manage, Then Expand
Hand the monitors to the finance controls team or run them as a managed service. Extend to more entities and controls, and feed results into the audit committee pack.
Step five is where credibility is earned. If a rule would not have caught the adjustments your auditors raised last year, refine it before expanding. The IIA encourages internal audit to use data analytics and technology where it improves coverage, and a transparent back-test gives audit a reason to engage rather than a black box to question. Our earlier piece on moving audit from sampling to continuous assurance explains how this evidence changes audit planning, and evidence intelligence for control validation covers how supporting documents are validated.
Where Agentic AI Helps, and Where Finance Decides
Close teams spend much of their time chasing: who has not reconciled, which entry lacks support, why an intercompany balance disagrees. Agentic AI is well suited to this work. An agent can test entries as they post, group exceptions by owner and account, request supporting documents, remind reviewers, check responses against the rule and update the exception log, escalating only when a deadline or threshold is missed. Teams working across several entities and time zones, including global capability centres, benefit because follow-up no longer depends on someone remembering to ask.
The boundary stays firm. Agents detect, correlate, draft and chase; named people approve adjustments, judge estimates and sign off reconciliations. Every agent action should log the data used, the rule applied and the person who reviewed the outcome, in line with the approach in our article on why AI agents need audit trails. Reporting teams subject to the SEC internal control reporting requirements, or to equivalent local regimes, will want that human accountability documented. In India, the auditor’s reporting on internal financial controls under the Companies Act makes the same evidence valuable for statutory audit.
Your Turn: How Continuous Is Your Close Assurance?
- Period-end driven: Reconciliations and journal reviews happen in the last days of the close, testing is by sample, and evidence is assembled for the auditors afterwards.
- Partly monitored: Some ERP reports and exception lists exist, but they are run manually, owned inconsistently and rarely lead to a logged, reviewed explanation.
- Continuous and evidenced: Entries, reconciliations and intercompany balances are tested daily, exceptions reach named owners, and the audit committee sees trends rather than surprises.
Where would your Controller place you? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
Internal audit’s relationship with third-party risk has historically been reactive — reviewing incidents after they occur rather than providing assurance that controls are operating effectively in real time. Continuous monitoring creates a new opportunity: internal audit can verify that risk ratings are recalculated when trigger events occur, that escalations are documented, and that the board is receiving accurate information about vendor exposure — all of which are more meaningful assurance activities than an annual programme review.
Frequently Asked Questions
Financial close controls are the checks that make sure the books are complete, accurate and approved when a period ends. They include journal entry review and approval, account and bank reconciliations, intercompany matching, accrual and provision reviews, cut-off tests, variance analysis and management sign-off. Together they support the reliability of financial statements and, for listed companies, internal control over financial reporting. Continuous monitoring runs many of these checks daily against ledger and subledger data instead of waiting for period end.
AI agents can test every journal entry against posting rules, flag unusual timing, amounts, preparers and account combinations, match intercompany balances, track reconciliation status and chase missing sign-offs. They work from the same ledger and subledger data your team uses and attach the evidence to each exception. People still approve adjustments, judge estimates and decide on accounting treatment. The benefit is earlier detection and a complete audit trail, not automated accounting judgement.
Close automation speeds up tasks such as reconciling, accruing and consolidating. Continuous monitoring tests whether the controls around those tasks operated, every day, and raises exceptions when they did not. A team can automate its close and still lack evidence that approvals, segregation of duties and thresholds were respected. The two are complementary: automation reduces effort, monitoring provides assurance, and many organisations need both.
Start with controls that are high-volume, rules-based and frequently cited in audit findings: manual journal entries posted near period end or by unusual users, unreconciled balance sheet accounts, intercompany differences and aged reconciling items. Add treasury and counterparty limit checks next. Pick a small number, define the exception rule and owner for each, and back-test them on a prior close before going live.
No. Continuous monitoring gives management, internal audit and the audit committee earlier and broader visibility, and the evidence it produces can reduce manual sampling effort. External auditors still form their own opinion under their professional standards, and internal audit still decides what to test and how. Share the monitoring design and the exception logs openly so that reliance can be considered on its merits.