+86 400-623-3007
MTC · Industry Depth, Global Breadth
Series: Month-End and Year-End Close · Part 3

Can the Ledger Still Change After Financial Statements Are Signed?

Historical ledgers may still change when posting periods remain open or access is poorly controlled. This article explains SAP Business One period controls, reopening authority, multi-entity alignment and the financial-reporting governance expected of CEOs.

Chris Li·Senior Consultant, MTC·Published 2026-08-03·Updated 2026-08-26
SAP Business OneCEOFinancial Governance
On this page

Introduction

Once financial statements have been reviewed and signed, could someone still change the underlying records without management knowing? The answer depends on both system configuration and financial-reporting governance.

Financial statements can be signed while the ledger remains open

A company ledger is comparable to a statement that has already been released. Management needs to know whether internal users can still change material figures after release, and whether every subsequent change can be traced in full.

Whether historical ledgers can continue to change should not depend solely on the professional judgment of finance personnel. The more important questions are whether the accounting period has been locked in the system and whether the authority to reopen it is properly controlled.

In SAP Business One, an accounting period can be assigned a status such as Unlocked, Closing Period, or Locked as the close progresses. Once a period is locked, the system rejects further postings. If a correction is required, the period status should be handled under the company's approval process and the adjustment recorded with a complete audit trail. If historical periods remain unlocked, the data underlying issued financial statements may still change.[2][14]

Management sign-off should cover the figures at a particular point in time, the stability of the underlying ledger version, the clarity of access boundaries, and the ability to review subsequent changes.

Uncontrolled historical changes weaken financial-reporting reliability

Regulatory reports and public cases demonstrate why control over historical data matters.

Listed-company regulatory findings

In 2023, 209 of 5,354 listed companies received modified audit opinions, including 29 disclaimers of opinion. Regulators identified issues including inappropriate classification between prior-period error corrections and changes in accounting policies, as well as inconsistent accounting methods.[4]

IPO review findings

In the same year, 32 of 306 companies reviewed at listing hearings corrected accounting errors during the review and registration stages. For nearly 20% of those companies, the correction affected more than 20% of that year's net profit.[5]

These findings do not mean that every company experienced unauthorized ledger changes. They do show that when historical data lacks stability and traceability, external parties may regard the weakness as evidence about the quality of the accounting foundation and the effectiveness of internal controls. For companies preparing for an IPO or financing, a material accounting correction can also affect the review process and investor judgment.

China's Accounting Law sets explicit requirements for the authenticity and completeness of accounting information and for segregation of duties. Material prior-period errors may also require retrospective restatement under applicable accounting standards. Posting-period management turns the requirements that unauthorized changes be prevented and necessary corrections remain traceable into system controls, rather than leaving them only in policy documents or verbal instructions.[7]

Separate period-reopening authority from routine posting

Locking a period does not by itself complete the control. Management must also establish who may reopen a locked period.

If routine accounting personnel can both change a period's status and reopen it, a clear conflict of duties arises. The same person can enter transactions and alter the system status designed to restrict those entries, which weakens the independence of the period lock.

Public cases illustrate the consequences of ineffective segregation of duties:

Overseas subsidiary of a listed group

For more than two years, a finance executive independently reported financial results and reconciliations to the group without an independent review. False accounting records, reconciliations, and bank-confirmation documents were used to manipulate reported results, leading to overstatements of millions of dollars.[6]

Large listed retailer

An employee responsible for small-package delivery expense accounting worked without timely cross-review. Erroneous accrual entries and falsified supporting documents concealed approximately US$151 million of delivery expenses from the fourth quarter of 2021 through the third quarter of 2024.[8]

These cases should not be reduced to individual ethics. The more important management question is whether segregation of duties, independent review, and system authorization prevent a single role from controlling transaction entry, review, and period reopening.

SAP Business One provides separate authorization controls for changing period status and posting during a Closing Period.[13][14] Operational accounting staff should record transactions using the actual business date. Authority to reopen a period should be limited to the head of finance or another designated control role. Necessary adjustments should follow an approval process and retain the user, time, reason, and supporting basis for the entry.

Article 25 of China's current Accounting Law requires relevant duties and authorities to be separated and mutually restrictive. For an enterprise, segregation of duties should not remain a principle in a job description; it should be implemented as an enforceable boundary in the system.[7]

Multi-entity groups need common close and locking standards

The position becomes more complex in a multi-entity group. Separate legal entities generally use separate company databases and close under local regulations, group reporting requirements, and potentially different accounting standards. If one entity leaves a period unlocked or uses an inconsistent accounting basis, the discrepancy can be amplified in consolidated reporting.

Consolidated financial statements are a primary source of information for investors, boards, and regulators. Their reliability depends on a consistent data foundation across legal entities. In the overseas-subsidiary case above, the local accounts lacked independent review and headquarters could not directly verify local banking data. The cash overstatement continued until the external audit stage.[6]

Under the standard SAP Business One architecture, each legal entity can manage the accounting periods in its own company database. Locking a period in one entity does not prevent another entity from continuing to process its business. This separation supports different local operating schedules, but it also requires the group to establish a separate pre-consolidation review process.[2][9]

The group should establish a common close calendar, locking standard, and reporting conditions while allowing each entity to complete local tasks according to applicable requirements. After local adjustments and review are complete, the entity locks the relevant period. Before consolidation, the group confirms period status, material adjustments, and completion of accounting-standard conversions.

SAP Business One manages period controls within each company database. A group close dashboard that consolidates lock status across company databases can be delivered through integration or BI as part of the project.

Close-control information CEOs should review

A CEO does not need to operate the system directly, but should regularly require the finance leader to provide clear and verifiable information on the following matters.

Through which period has the ledger been locked?

Do not ask only whether the month-end close is complete. Confirm that every period that should be locked has in fact been locked. One useful measure is the lock rate for eligible periods: the number of locked periods divided by the number that should be locked. Any exception should have a stated reason and a target completion date.

Who can reopen a locked period?

Obtain a specific list of authorized users or roles and verify whether any of them also perform routine transaction posting. The authority to change a period status should be separated from routine accounting authority, and its scope should be reviewed periodically.

How many post-close adjustments were made?

Every adjustment should show who performed it, when it was made, which approval supported it, why it was required, and how it was recorded. Management should also distinguish between an adjustment recorded through a traceable entry and a change made after reopening the period and modifying existing data. The latter requires stricter approval and review.

Have overseas entities locked and aligned their periods as required by the group?

Before consolidated reporting begins, confirm that each entity has completed its local close, period lock, reporting of material adjustments, and conversion between accounting standards. For any entity that has not completed these steps, maintain an exception list with an owner and deadline.

These checks confirm whether the controls supporting financial reporting have been established and continue to operate effectively.

Include period control in financial-reporting governance

Statutory reporting deadlines, tax arrangements, and local regulatory requirements constrain the timing of close and filing. Some of those external conditions cannot be changed in the short term.

By contrast, whether historical periods are locked, who may reopen them, whether adjustments retain a complete audit trail, and whether each entity follows the group's alignment requirements are internal governance matters that the enterprise can manage directly.

A CEO does not need to inspect every system setting. These controls should nevertheless form part of operating governance and financial-reporting oversight, supported by periodic metrics, authorization lists, and exception reports.

When management signs the financial statements, it should also confirm three control foundations: period status is effectively managed, critical authorities are segregated, and each legal entity follows the group's close requirements.


References


Source note: this article is based on SAP Business One documentation, public regulatory materials and company filings; public cases are summarized from the cited sources.

Implementation Assessment and Consultation

An MTC consultant can review your current processes, system version and implementation scope and help define practical next steps.