The Second Signature, and the File the Auditor Keeps
Some accounts deserve more care than others: the bank, the control accounts, equity. Mark them sensitive and any manual journal touching them needs a second person. And when the auditor arrives, one file holds the ledger, who signed what, every close and reopen, and a checksum for each part.
A manual journal that debits Accounts Payable and credits the bank is how a payment that never happened gets hidden, and it looks exactly like a correction. Most organizations know this. Most also set journal approval at a threshold that a careful person can stay under. The size of a journal is the wrong question. Which accounts it touches is the right one.
Mark the accounts that matter
Under Accounting → Dimensions & Sensitive Accounts, any account can be marked sensitive. There is no fixed list: a bank, cash, the receivables and payables control accounts, retained earnings, a director’s loan, whatever your finance lead or auditor names. Marking and unmarking is limited to people who manage accounts, and each change is written to the audit log, so an account cannot be quietly unmarked for an afternoon.
From then on, a manual journal with even one line on a sensitive account always waits for approval, whatever the workspace’s journal approval setting and whatever its size. A KES 300 journal to the bank account waits just like a KES 3 million one.
- The approver needs the sensitive-journal approval permission. The ordinary journal approval permission is not enough for these.
- The author cannot approve their own while anyone else in the workspace holds that permission.
- The second signature is stored on the posting: who approved it as a sensitive journal, and when.
When there is nobody else
In a workspace where the author is the only person holding the permission, they may approve their own sensitive journal, because a journal nobody can ever approve helps nobody. The audit log records it as a self-approval, and the integrity check below lists it. The control does not disappear; it becomes visible.
The Reconciliation screen’s integrity checks include one for exactly this: manual journals posted to a sensitive account in the last 90 days that only one person signed, either because they were posted without approval or approved by their author. It shows the count and the total, and it is marked high severity. Anything there is worth a conversation before the auditor finds it.
A threshold asks how big a journal is. A sensitive account asks where it is going. Only the second one catches the small journal to the bank.
Writing off a debt takes two people too
Giving up on money a customer owes is the receivables version of the same risk. Under Accounting → Write-offs, one person requests a write-off against an invoice, for no more than what is still owed. The request changes nothing: the invoice stays owed and the ledger is as it was. A different person, holding the write-off approval permission, approves it, and only then does it post bad debt expense against receivables, once. The person who asked can never approve their own write-off, in any size of workspace.
The file the auditor takes away
Audit fieldwork usually starts with a request list and a week of exports. Someone with the audit-evidence permission can now produce one ZIP file for any date range, from the certified statements page. It holds:
| File | What it answers |
|---|---|
| The ledger lines file | Every ledger line in the range, with its posting, account, side, amount, tags and currency |
| postings.csv | Every posting: who drafted it, who approved it, who gave the sensitive-account signature, who posted it, and what it reverses |
| The period closes and reopen requests files | Which months were closed and reopened, by whom, and the reasons and decisions behind each reopen |
| The close evidence folder | The evidence pack stored at each close, every version |
| certified/ | Every certified statement version overlapping the range |
| integrity.json | The ledger integrity checks as they stand on the day of the export |
| The accounting audit log file | The accounting audit trail for the range |
| manifest.json | The SHA-256 checksum of every file above, the range, and who generated it when |
The ZIP itself is checksummed too. Its SHA-256 goes into the audit log at the moment it is made, and a copy is kept in the workspace’s private storage. So if a question comes back in six months about a figure in the file the auditor received, you can prove that the file they hold is the one you gave them, and every file inside it is the one the manifest describes.
One year-end request, answered from the ZIP
Illustrative. The auditor still tests; the ZIP removes the week of assembling what they test.
How the audit log itself resists tampering is on the audit trail integrity page and in the Audit Logs guide. Journal approval and reversal are in the Journal Entries guide, and the full set of rules is on the accounting controls page.
Taking separation one step earlier
The second signature works at the moment a journal posts, and the integrity check finds anything that slipped through. These would move the control earlier, or hand the evidence over more directly.
A role editor that refuses a conflict
Saving a role that holds both sides of a pair you name, such as drafting and approving sensitive journals, refused at the role rather than caught at the journal.
Sensitive journals approved from the phone
The second signature given in the mobile app, beside the write-off approvals already there.
An auditor portal
Read-only access for your auditor to the evidence file and the tax audit workbook, with every download logged, instead of handing files over.
Tell us which pairs your auditor tests and we will return a written scope and cost.
Talk to us about controlsWhat AWRA OpsHub does today
- Sensitive accounts, marked by people who manage accounts, with every change audited.
- A second signature on any manual journal to a sensitive account, at any size, from someone holding the sensitive-journal permission who is not the author.
- A recorded fallback where the author is the only person who could approve, logged as a self-approval.
- An integrity check listing sensitive-account journals with one signature in the last 90 days.
- Receivable write-offs under maker-checker, with no self-approval in any workspace.
- An auditor evidence ZIP for any date range, with a SHA-256 manifest for every file and the ZIP’s own checksum in the audit log.
- A tax audit export for up to two years: output and input tax lines with customer and supplier PINs and eTIMS status, till sales, credit notes, withholding deducted and remitted, the tax rate history, VAT returns, and the tax accounts reconciled to the documents, with the file’s SHA-256 in the audit log.
- Write-offs requested and approved in the AWRA mobile app, under the same rule that the requester cannot approve, with a connection.
More we can add to your workspace
- A role editor that refuses to save a role holding both sides of a conflict you define, so separation is enforced when access is granted.
- Sensitive-journal approvals in the mobile app, beside the write-off approvals already there.
- An auditor portal giving your auditor read-only access to the evidence file and the tax audit workbook, with every download logged.
Where we point you to a specialist
- Which accounts are sensitive, and which duties your organization must keep apart, is your finance lead’s and your auditor’s decision. We provide the switch and record what happens under it.
- The evidence file is the record, not the audit. Testing it and forming an opinion belongs to your auditor.
Our position
Mark the bank, cash, the two control accounts and equity as sensitive on day one, and give the sensitive-journal permission to two people, so a self-approval only ever happens when it has to. Read the one-signature check every month before you close. And at year-end, hand the auditor the ZIP and its checksum rather than a folder of exports: it is faster for both of you and it can be proved unchanged.
See the accounting controls
Sensitive accounts, journal approval, write-offs, period locks and the evidence file an auditor takes away.
Explore accounting controlsFrequently asked questions
What is a sensitive account in AWRA OpsHub?
An account your organization marks as needing extra care, such as a bank, cash, a control account or equity. Any manual journal touching it always needs approval from someone other than its author who holds the sensitive-journal approval permission, whatever its size.
Can the author approve their own journal to a sensitive account?
Only when nobody else in the workspace holds the permission. In that case the approval is recorded as a self-approval in the audit log, and the integrity check lists it.
Who can approve a receivable write-off?
Someone holding the write-off approval permission who did not request it. The requester can never approve their own write-off. Nothing posts until it is approved.
What is in the auditor evidence pack?
A ZIP for a date range with the ledger lines, every posting and who drafted, approved and posted it, period closes and reopen requests, close evidence packs, certified statements, the integrity checks, the accounting audit log, and a manifest with the SHA-256 checksum of every file. The ZIP’s own checksum is written to the audit log.
