Month-End Close Process: A Control-First Checklist

Most close calendars show who is doing what and when. They often do not show whether a task is sufficiently supported to let dependent work continue. A reconciliation can be marked complete while open items have no owner. A variance review can be signed without recording what was investigated. A late journal can change reports after the controller has reviewed them.

A control-first month-end close treats completion as a gated state. Each critical task needs a named owner, a required evidence set, a review decision and an escalation route. The close lead can then distinguish work that is merely performed from work that is ready for period release.

What is a control-first month-end close?

A control-first month-end close is a dependency-based operating process in which every critical activity has an owner, evidence requirement, review standard, exception rule and release criterion.

For U.S. public-company audits, PCAOB AS 2201 treats the period-end financial reporting process as a central part of internal control over financial reporting. Its scope includes transaction totals entering the general ledger, journal entries, recurring and nonrecurring adjustments, financial statement preparation and related oversight. PCAOB AS 2110 also points to financial reporting roles, responsibilities and monitoring activity. These are audit requirements in their stated jurisdiction, but the process components are useful design tests for a controller in other settings.

The objective is reasonable assurance, not a claim that no error can occur. SEC staff guidance on management’s ICFR assessment says companies should apply informed judgment and fit documentation and testing to their own operations, risks and procedures. That is why a close policy should define local thresholds, calendars and approval levels rather than copy another organisation’s timetable.

Design the close around dependencies, not a list of dates

Start with the outputs that must be released, then work backwards to the data, approvals and reviews each output requires. A due date without a dependency rule allows teams to finish tasks against a moving ledger and creates avoidable rework.

1. Define the release package. Identify the final trial balance, entity or consolidation package, management reports, required statements and any control certification that marks the end of the close.
2. Map the critical path. Show which feeder systems, subledgers, estimates, reconciliations, journals and reviews must finish before the next activity can start.
3. Assign three types of authority. Name the preparer, the reviewer and the person who can accept an exception or release the period. One person may hold more than one role only where the risk is assessed and a compensating check is documented.
4. Set completion and escalation rules before day one. Define the evidence, investigation threshold, response time and escalation recipient for each critical task.

Actual calendars vary. The University of Washington’s current close calendar, for example, sequences transaction cutoffs, subledger closure, journal deadlines, controller-only activity and final consolidated reporting across different close days. The useful lesson is the dependency design, not the specific number of days.

Bank reconciliation sits on the critical path, and most of its timing differences are structural

The dependency map above places reconciliations ahead of the reviews that consume them. Bank reconciliation is usually the one that moves the whole close, because it is the only reconciliation whose counterparty settles on a calendar the entity does not control.

Most unmatched items at period end are not errors. They are the predictable output of payment schedules set outside the ledger. Under the Federal Reserve’s FedACH processing schedule, entries that are not same-day eligible settle at 8:30 a.m. ET on the next business day, while same-day entries settle in three windows at 1:00 p.m., 5:00 p.m. and 6:00 p.m. ET. A disbursement the ledger records on the final day of the period will, in a predictable share of cases, reach the bank in the next one.

Deposits behave the same way by rule. Regulation CC requires cash, wire transfers and certain check deposits to be available by the business day after the banking day of deposit, while local check deposits need not be available until the second business day following deposit. That float is a schedule, not a delay to escalate.

Treating both groups as one queue of unexplained differences is what makes bank reconciliation slow. Three rules separate them:

1. Classify before investigating. Separate items explained by a known settlement window from items with no scheduled explanation. Only the second group is an exception, and only it should consume investigation time.
2. Give every in-transit item an expected clearing date. Derive it from the payment rail rather than from the age of the item. An item still open past that date has changed category and belongs in the exception process.
3. Define the statement-to-period bridge. Where the bank statement cycle does not end on the accounting period end, the reconciliation needs a stated method for the gap between the two dates. Without one, the same items are re-explained every cycle and the reviewer cannot separate a new difference from a carried one.

The ageing threshold, materiality and sign-off authority that then apply to genuine exceptions are reconciliation-programme decisions. They are set once and applied across accounts rather than rebuilt inside the close calendar.

Sequenced month-end close checklist

The following checklist is a control architecture, not a universal accounting calendar. Map each phase to the organisation’s entities, systems, reporting obligations and risk thresholds.

Ownership, evidence and escalation matrix

The close should make two questions easy to answer: who owns resolution, and who has authority to accept the resulting risk? The accountable owner is not automatically the independent reviewer or the period-release decision-maker.

The 2025 GAO Green Book applies to U.S. federal agencies, so it is not a private-company mandate. As a control-design reference, it is useful on two points: management assigns responsibility and authority while considering segregation of duties, and alternative controls are needed when full segregation is impractical. The same source describes quality information as current, complete, accurate, accessible, verifiable, retained as appropriate and timely, and calls for responsibility and corrective actions to be documented when deficiencies are identified.

Set the evidence standard before the close begins

A tick mark or electronic sign-off proves that someone changed a status. It does not prove what the person reviewed or how an exception was resolved. PCAOB Staff Audit Practice Alert No. 11 makes this distinction directly for management review controls: sign-off by itself provides little or no evidence about effectiveness, while useful evidence shows the review steps, investigation of significant differences, conclusions and corrective action. The same test applies when no person touched the step at all, which is why what an automated close step has to leave behind has to be specified before the automation is switched on.

For each critical close control, define an evidence package that lets a qualified second person understand the work without reconstructing it from email or memory:

• Population and period: what data, accounts, entities and reporting period were covered.
• Source and completeness: where the information came from and how completeness and accuracy were checked.
• Procedure: what comparison, calculation, approval or review was performed.
• Result: what was found, including differences and unresolved items.
• Investigation and disposition: what was challenged, who responded, what was corrected and what remains open.
• Conclusion and version: the preparer and reviewer conclusions, timestamps and the report or workpaper version reviewed.

The evidence burden should rise with the risk. A routine recurring entry may need a standard calculation and approval. A nonstandard estimate, late journal or unexpected variance may require more granular support, a stronger reviewer and a documented challenge process. Treasury Wine’s multi-asset write-down shows how one demand reset can require separate inventory, impairment, disposal and tax evidence before the close is released.

Escalate by impact, not only by lateness

A missed due time is an operational signal. Escalation becomes a control decision when the delay affects completeness, accuracy, review independence, report release or the ability to demonstrate what happened.

• Critical-path delay: route to the close coordinator when another controlled task cannot start.
• Financial reporting exposure: route to the controller when the item could alter a statement, management report or close conclusion.
• Control failure: route under the organisation’s deficiency process when a required control did not operate or evidence cannot demonstrate operation.
• Possible override or inappropriate activity: use the confidential escalation route defined in the fraud and ethics framework rather than keeping the matter inside the normal close tracker.
• Post-release change: use a separate reopening or post-close adjustment workflow that identifies every affected report and review.

Late entries deserve additional scrutiny without assuming wrongdoing. PCAOB AS 2401 notes that inappropriate entries can occur at period end or after close and highlights unusual timing, users, accounts, explanations and nonstandard processing as relevant characteristics. A close policy can turn those characteristics into review triggers.

Define the release criteria for locking the period

The controller should make an explicit release decision. “All tasks green” is not enough unless every status has a controlled meaning.

• All critical-path tasks are in reviewed or approved-exception status.
• Material feeder and subledger control totals agree to the ledger, or an authorised exception records the impact.
• Critical and higher-risk balances have current support and reviewer conclusions.
• Required journals are approved and posted; changes after review have reopened and cleared the affected review tasks.
• Analytical-review differences that met investigation criteria have evidence-backed conclusions.
• The final trial balance, statements and management reports use controlled, mutually consistent versions.
• The exception register identifies owner, amount or exposure, due date, compensating action and approval for every unresolved item.
• The controller has authorised the period lock or equivalent restriction on prior-period posting.

Use the post-close log to improve the next cycle

Time to close is useful, but it does not explain why the process was late or fragile. Track measures that expose control and dependency failure: critical-path misses, tasks reopened after review, late or rejected journals, age of unresolved exceptions, review cycle time, post-close adjustments and repeat root causes.

After release, assign one action for each recurring cause, not one action for every symptom. Examples include changing an upstream cutoff, correcting an interface control, clarifying an evidence standard, adding backup reviewer coverage or moving a recurring task earlier in the month. The next close calendar should show whether the action changed the dependency, owner, evidence requirement or escalation rule.