Cleaning Up Phantom AR After an ERP Cutover and Proving It to Auditors

Executive Summary

Detection has to be systematic and auditor-credible: a customer-level reconciliation between the legacy and NetSuite aging reports, a subledger-to-general-ledger tie-out, and a payment application audit. The Journal of Accountancy recommends standardizing reconciliation policies and templates company-wide ^[1] and setting materiality thresholds so effort concentrates on discrepancies that matter ^[2], while the AICPA issued SAS 150, External Confirmations, on July 13, 2026, amending mainly AU-C 505 guidance ^[3], a standard whose evidentiary bar is defined by AICPA guidance requiring auditors to evaluate the sufficiency of information used as audit evidence ( aicpa via ctfassets.net.

Correction inside NetSuite should match the root cause: for genuinely uncollectible balances, follow the entity-approved bad-debt and allowance policy; where the documented NetSuite workflow applies, create a write-off journal entry and accept a zero-amount customer payment. Reserve credit memos for reversing a charge billed to a customer, such as a return or billing correction. Use reversing entries for GL-only errors, and use period locks and workflow-based approvals to protect the fix once it is made. The work does not end at a corrected balance. Any phantom AR removed from the books must also be removed from the population underlying the allowance for credit losses under ASC 326, which the Financial Accounting Standards Board (FASB) amended in 2025 specifically for accounts receivable and contract assets, effective for fiscal years beginning after December 15, 2025 ^{[4] [5]}. Internal control over financial reporting (ICFR) evidence over the migration itself, and a management representation confirming all transactions are recorded ( aicpa via ctfassets.net, round out the file, informed by SEC guidance that automated-control reliance depends on adequate information technology general controls ^[6].

Companies choose among in-house teams, generalist integrators, Big Four advisory practices, and NetSuite specialist consultancies to lead this work; the Montreal-based consultancy Houseblend is one such specialist option, describing its data migration services as intended to "maintain... data integrity" through the transition ^[7]. Once the cleanup is complete, benchmarking receivables health against a cross-industry Days Sales Outstanding measure, such as APQC's, drawn from over 13,000 companies ^[8], can provide a high-level reasonableness signal but cannot confirm that no residual phantom balance remains; customer-level reconciliation and the subledger-to-GL tie-out provide that evidence. The companies that treat this reconciliation with the same rigor as the cutover itself convert a scare into a documented, one-time adjustment rather than a recurring audit finding.

Introduction and Background

A NetSuite cutover is the moment a company's accounts receivable (AR) subledger stops living in a legacy system and starts living in NetSuite, Oracle's cloud enterprise resource planning (ERP) platform used by more than 43,000 customers across 220 countries and dependent territories as of March 2026 ^[9].

Migration planning can address field mapping, conversion methods, cutoff timing, and balance handling. Panorama Consulting Group's 2026 ERP Report, based on 170 organizations surveyed between January 2025 and January 2026, found a median enterprise software project timeline of 9 months ^[10], and more than a quarter of respondents reported going over budget ^[11], a window in which AR cleanup work routinely gets compressed.

This report is a practitioner's guide to reconciliation, audit evidence, and control documentation for migration work. For accounts receivable arising from the transfer of goods or services to a customer or a financial institution's loans, PCAOB AS 2310 requires the auditor to perform confirmation procedures or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source ( PCAOB AS 2310.

Migration Reconciliation Considerations

Migration Mapping, Duplicate Keys, and Subsidiary Assignment

NetSuite's own CSV import documentation is explicit that using a customer's name as the matching key for record updates is unreliable, since name formatting is inconsistent and error-prone as a matching mechanism; teams should use stable identifiers for record updates. NetSuite's transaction-import guidance separately requires that every imported record carry an External ID, Internal ID, or transaction number, and that omitting this identifier gets the import rejected outright, a control that exists specifically to stop silent duplication. For multi-entity companies running NetSuite OneWorld, the subsidiary field is not optional: "If you try to import or update records without a subsidiary, the import will fail" ^[12], which forces an all-or-nothing outcome rather than a partially posted, half-mapped batch. NetSuite's SOAP web services documentation states plainly that "to prevent duplicate records, you should use external IDs and the upsert and upsertList operations" ^[13], which is precisely the discipline that migration teams skip when they are racing a go-live date.

Open-Item Versus Balance-Forward Conversion

Oracle's own documentation on receivables accounting defines the open-item method as one where "payments are matched against 'open items' (i.e., unpaid bills and adjustments)" ^[14], so only unmatched invoices ever show as aged debt. The alternative, balance-forward accounting, works differently: "payments are not matched to bills. Rather, payments implicitly relieve a customer's oldest debt" ^[15].

Unapplied Cash, Deposits, and Intercompany Loose Ends

NetSuite treats a customer deposit as a general ledger liability, not as an offset to AR, until it is applied: "these payments go into your general ledger as a liability until you deliver the goods" ^[16]. A dated technical migration guide from OptimalData Consulting, published January 14, 2026, warns that "leaving unapplied offsets almost always results in overstated AR or customer-level discrepancies in NetSuite" ^[17]; and separately that "mixing posting periods almost always complicates reconciliation later" ^[18], which is why disciplined migration methodology confines the opening AR load to a single go-live period rather than spreading it across several.

Multi-subsidiary companies face a fourth failure mode. NetSuite's intercompany documentation states that "NetSuite requires an intercompany customer or intercompany vendor for intercompany A/R and A/P accounts" ^[19];

Reconciliation and Documentation

Detection has to happen before correction, and it has to be defensible to a third party, which means it should track methodology an external auditor already trusts rather than an ad hoc spreadsheet.

Aging Reconciliation and Subledger-to-GL Tie-Out

The starting point is a side-by-side reconciliation of the legacy AR aging report against the NetSuite AR aging report at the cutover date, customer by customer, followed by a subledger-to-general-ledger (GL) tie-out confirming that the sum of open AR transactions equals the AR control account balance. A Journal of Accountancy best-practices article recommends that "organizations should standardize account reconciliation policies, processes, and templates across the entire company" ^[1] rather than letting each preparer follow a different approach, which matters enormously in a cutover where multiple people may be touching AR simultaneously. The same article recommends setting "tolerances and materiality thresholds across the organization" ^[2] so effort concentrates on discrepancies large enough to matter, rather than chasing every one-cent rounding difference to zero, and tracking "overdue reconciliations, material reconciling items, and completeness by person or department" ^[20] as ongoing management metrics during the cleanup itself.

Payment Application Audits and Customer Confirmation

A payment application audit can review whether cash receipts and credits were matched to the intended invoices. It is an internal control procedure, not external confirmation. Under PCAOB AS 2310, if the auditor determines that obtaining evidence directly from a knowledgeable external source is not feasible based on the auditor's experience and expectation of similar results, the auditor should obtain external information indirectly through other substantive procedures, including tests of details; for selected AR items, these may include examining subsequent cash receipts and comparing them with the respective invoices being paid ( PCAOB AS 2310. A well-run detection phase produces, at minimum: a customer-level variance report (legacy balance versus system balance), a No Customer / unassigned balance report, an unapplied cash and deposit report, and an intercompany elimination exception report, each dated and tied to a specific reconciliation owner.

Correction Methods and Documentation

Once phantom AR is quantified, the correction method matters as much as the correction itself, because an auditor will want to see not just that the balance is now right, but how it got there.

Credit Memos, Write-Offs, and Refunds

For a balance confirmed uncollectible, NetSuite describes bad debt as an amount owed that is written off as a loss; it is an expense because the debt cannot be collected after reasonable collection efforts are exhausted ^[21]. Where the customer is actually owed cash back rather than a credit against future invoices, NetSuite's customer refund transaction exists for exactly that situation, and must be issued in the same payment method as the original transaction. Choosing correctly among these three (credit memo, write-off journal entry, refund) is itself part of the audit story: each implies a different root cause, and mixing them up (for example, writing off a balance that was actually a duplicate load, rather than reversing the duplicate) creates a second layer of misstatement on top of the first.

Duplicate Loads and Reversing Journal Entries

For GL-only corrections that do not need to touch the AR subledger directly, NetSuite supports reversing journal entries with an automatic reversal date, which avoids a second manual entry and keeps the correction traceable to the original posting.

Period Locks, System Notes, and Segregation of Duties

The controls that protect a cleanup's integrity are largely NetSuite's period-close and audit-log features. Accounting period locks exist specifically "to prevent users from posting transactions that affect the general ledger" ^[22], including a targeted lock on A/R transactions alone once that ledger has been reconciled and tied out. Every change NetSuite makes to a record is captured in System Notes, which "can't be edited by any system user, script, or application" ^[23], and the Transaction Audit Trail report "provides a detailed history of all transactions entered into NetSuite" ^[24], filterable by user, date, and transaction type. Preventing any one person from both proposing and approving a cleanup adjustment is a workflow control, not just a role setting: NetSuite states that "workflows provide additional segregation of duties controls beyond logical security" ^[25], meaning approval limits and self-approval blocks have to be deliberately configured rather than assumed.

Table 2 below maps the most common correction scenarios to the NetSuite mechanism used and what an auditor should expect to see as the resulting audit-trail evidence.

The pattern in Table 2 is that NetSuite's native controls, used deliberately, generate most of the evidence an auditor will eventually ask for. The mistake to avoid is treating the cleanup as a purely accounting exercise and skipping the system-configuration steps (period locks, workflow-based approvals) that turn a correct balance into a defensible one.

Proving the Cleanup to External Auditors

Fixing the number is necessary but not sufficient. An external auditor's job is to obtain sufficient appropriate evidence that the corrected balance is right, and the standards that govern that evidence are specific about what counts.

The Assertions Auditors Test

PCAOB Auditing Standard AS 1105 (Audit Evidence) enumerates the financial-statement assertions auditors test, starting with "existence or occurrence" ^[26], meaning the receivable actually exists at the balance sheet date, alongside completeness, valuation, and cutoff. Where a company relies on system-generated reports as evidence for its own cleanup, AS 1105 requires the auditor to "test the accuracy and completeness of the information" ^[27] underlying it, including the information technology (IT) general controls and automated application controls that produced the report, which is exactly why a NetSuite-generated aging report used as remediation evidence has to be paired with evidence about the migration controls that fed it, not just the report itself.

Confirmation, Substantive Procedures, and Sufficiency of Evidence

PCAOB AS 2301 (The Auditor's Responses to the Risks of Material Misstatement) frames the auditor's core objective as addressing "the risks of material misstatement through appropriate overall audit responses" ^[28], and requires the auditor to perform substantive procedures for each relevant assertion of each significant account and disclosure, regardless of how strong the company's controls appear. Where a company's control environment shows weaknesses, such as a poorly controlled data migration, AS 2301 directs the auditor to "obtain more persuasive audit evidence from substantive procedures due to the identification of pervasive weaknesses" ^[29], Confirmation practice changed materially in 2025: the PCAOB "replaced AS 2310, The Confirmation Process, in its entirety with AS 2310, The Auditor's Use of Confirmation" ^[30], effective "for audits of fiscal years ending on or after June 15, 2025" ^[31], so any 2025 or 2026 AR cleanup that reaches an audit sits under the modernized standard.

On the AICPA side, SAS No. 142, codified as AU-C 500 (Audit Evidence), states that "the objective of the auditor is to evaluate information to be used as audit evidence" ( aicpa via ctfassets.net and defines sufficiency as "the measure of the quantity of audit evidence" ( aicpa via ctfassets.net required to support a conclusion, restating that AU-C 330 "requires the auditor to obtain more persuasive audit evidence the higher" the assessed risk ( aicpa via ctfassets.net. The AICPA issued SAS 150, External Confirmations, on July 13, 2026; it amends various sections of the auditing professional literature, mainly AU-C 505 guidance ^[3]. Confirmation conclusions and valuation evidence should be evaluated under the final standard and the engagement's applicable requirements.

ASC 326 and the Allowance for Credit Losses

Any post-cutover AR cleanup eventually intersects with the allowance for credit losses under ASC Topic 326, the current expected credit losses (CECL) framework. The Financial Accounting Standards Board (FASB) issued ASU 2025-05 specifically to "improve guidance on the measurement of credit losses for accounts receivable and contract assets" ^[5], effective "for annual reporting periods beginning after December 15, 2025" ^[4]. A separate update, ASU 2025-08, addresses purchased seasoned loans and is not addressed further in this trade-receivables discussion ( FASB ASU 2025-08. The practical implication for a cutover cleanup is that a phantom receivable removed from the aging report also has to be removed from the population against which the credit-loss allowance is calculated; leaving it in the allowance base after it has been written off understates the true collectibility rate on the remaining, real balances.

SOX and ICFR Controls Over the Migration

For companies subject to Sarbanes-Oxley (SOX) internal control over financial reporting (ICFR) requirements, PCAOB AS 2201 frames the objective of an ICFR audit as being "to express an opinion" ^[32] on control effectiveness, and PCAOB risk-assessment guidance specifically flags "unauthorized changes to data in master files" ^[33] as an IT-driven control risk. The U.S. Securities and Exchange Commission's (SEC) 2007 interpretive guidance on management's ICFR evaluation likewise recognizes that reliance on automated controls depends "when adequate information technology" general controls exist ^[6], meaning a company cannot simply assert its NetSuite reports are reliable; it has to evaluate the IT general controls (access, change management, segregation of duties) that produced them, which is exactly what a cutover often disrupts.

Management Representations

At the close of fieldwork, AU-C 580 (Written Representations) requires management to represent that it has "fulfilled its responsibility" ( aicpa via ctfassets.net for fair presentation of the financial statements, and separately that "all transactions have been recorded and are reflected in the financial statements" ( aicpa via ctfassets.net. A CFO signing that representation after a messy cutover needs the reconciliation workpapers, roll-forward schedules, and correction logs described above to actually stand behind that language, not merely to hope the auditor does not ask.

Implementation Considerations and Process Changes

A reconciliation workflow can include baseline documentation, reconciliation, classification, correction, and supporting workpapers.

A practical cleanup checklist should include:

• Customer-level variance report comparing legacy and NetSuite AR balances at the cutover date, with a documented explanation for every variance above the company's materiality threshold.
• No Customer / unassigned balance report, reviewed and cleared before the first post-cutover close.
• Unapplied cash and customer deposit report, matched against outstanding invoices or refunded.
• Intercompany elimination exception report, confirming every intercompany invoice sits on an intercompany-flagged customer record.
• Duplicate detection pass, using external ID and internal ID counts to find records loaded more than once.
• Correction log, recording which NetSuite mechanism (credit memo, write-off journal entry, refund, reversing entry, or voiding) resolved each variance, and who approved it.
• Period lock confirmation, verifying that reconciled periods are locked before the next close begins.
• Roll-forward schedule, reconciling the beginning phantom AR balance, corrections made, and ending balance for the audit file.
• Management representation draft, prepared early enough that the CFO can review the underlying evidence before signing.

Panorama's 2026 ERP Report found that among organizations that went over budget, "the most common reason was the unexpected need for additional technology" ^[34], and among those that went over schedule ("almost a quarter of organizations" ^[35]), "the most common reason was organizational issues" rather than data problems specifically. No public research firm has yet published a figure isolating the typical duration or cost of AR-specific post-cutover cleanup work; the estimates above are derived from the mechanics of the correction process itself, not from a named survey, and should be treated as planning guidance rather than a benchmark.

Companies facing this kind of cleanup generally choose among four engagement models, summarized in Table 3.

Data Analysis and Evidence

Quantitative benchmarks specific to post-cutover AR cleanup are scarce; most available data describes ERP implementation projects broadly, not the narrower phantom-AR problem. That gap is itself informative, and the adjacent data that does exist provides useful context for scale and prioritization.

Panorama Consulting Group's 2026 ERP Report, drawing on 170 respondent organizations with a median annual revenue of $200.5 million and 56.5% operating as multinationals ^[36], found a median project timeline of 9 months, with more than a quarter of organizations exceeding budget and almost a quarter exceeding schedule. A majority of respondent organizations also deployed business intelligence tooling significantly alongside their ERP project, which is relevant context because AR aging and reconciliation reporting is frequently rebuilt as part of that same effort, sometimes exposing phantom balances that the ERP's native reports had not surfaced.

For benchmarking the health of a receivables portfolio once cleanup is complete, the nonprofit benchmarking organization APQC maintains a cross-industry Days Sales Outstanding (DSO) measure drawn from a sample of 13,195 companies ^[8], calculated using the "average of gross accounts receivable (AR)" ^[37] divided by daily sales. A company whose post-cleanup DSO diverges sharply from its own pre-cutover trend, independent of the APQC cross-industry figure, is a useful internal signal that residual phantom balances may remain uncorrected.

For current accounts receivable and current contract assets arising from Topic 606 transactions, ASU 2025-05 provides a practical expedient for all entities and an accounting policy election for entities other than public business entities when estimating expected credit losses. The amendments are effective for annual reporting periods beginning after December 15, 2025. Widely cited claims that a large majority of ERP data migrations fail or exceed budget specifically because of data issues could not be traced to a still-live, originating research-firm page during this review and are therefore omitted rather than repeated secondhand; readers should treat any such figure encountered elsewhere with caution unless it links to the originating study.

Implications and Future Directions

For CFOs and controllers, the practical implication is to treat AR reconciliation not as a one-time cutover task but as a control that needs to be exercised, tested, and documented for at least one full audit cycle after go-live, and to decide early which of the four engagement models in Table 3 fits the specific root causes uncovered, rather than defaulting to whichever team happened to run the original implementation.

Frequently Asked Questions (FAQs)

How should a company explain AR discrepancies to auditors after a system migration? Prepare a customer-level variance report and roll-forward schedule with the supporting audit evidence.

What is the difference between a journal entry correction and a transaction-level correction for phantom AR? For an uncollectible invoice, NetSuite directs users to create a journal entry and accept a zero-amount customer payment to remove the invoice from open invoices and A/R aging reports ( Oracle: Creating a Journal Entry to Write Off Bad Debt. Accounting treatment for other discrepancies should reflect the underlying transaction and be reviewed under the entity's accounting policies.

How long does an AR cleanup after an ERP cutover typically take? No public research firm has published a figure specific to post-cutover AR cleanup; organizations should establish a timeline based on their own transaction volume, root causes, control requirements, and close calendar.

Does the allowance for credit losses need to be recalculated after fixing phantom AR? Yes. Once a phantom balance is removed from the AR population, it must also be removed from the population against which the ASC 326 credit-loss allowance is calculated, particularly given FASB's 2025 amendment aimed specifically at accounts receivable and contract assets ^[5].

Should we hire a NetSuite consultant for financial close cleanup, or handle it internally? The appropriate engagement model depends on the organization’s accounting, systems, and control needs.

What does an auditor actually test when reviewing accounts receivable after a system migration? Existence (does the receivable exist), completeness (are all real receivables recorded), cutoff (recorded in the correct period), and valuation (is it collectible at the recorded amount), per the assertion framework described earlier in this report, typically combining external confirmation with the alternative procedures discussed above.

Conclusion

A documented reconciliation process can support financial-close and audit-evidence needs after a system migration.