# How do I catch backdated entries posted into a closed month after month-end close?

**Short answer:** A lock date stops casual edits, but an admin can lift it, post an entry dated inside the closed month, and put the lock back. The report totals change and nothing in the closed period looks new. To catch that, every entry needs two dates: the date it says it happened and the date it was actually recorded, from a clock the business doesn't control. A Rightshold mirror ledger gives each sealed entry both: occurred_at (the date you give) and sealed_at (Rightshold's clock), plus a sequence number and a hash chain. At close, write down the last entry's seq and entry_hash for the month and give that close head to your accountant. Later, any entry with an occurred_at inside the closed month but a seq after the close head is a post-close entry, and it shows. Any edit to an entry at or before the close head breaks the chain against the hash the accountant already holds. This page is about finding backdated and post-close entries. Locking the period and hashing month-end reports is covered on the page about proving books weren't edited after the fact.

## Checklist
1. Lock the month in the accounting software once it's reconciled (QuickBooks Online Close the books with a password, or a Xero lock date) and keep the password or administrator role away from day-to-day entry.
2. Seal the business's records into a mirror ledger as they happen (invoice, payment, adjustment, tip_allocation, tip_payout, dispute_note), with occurred_at set to the business date. Don't batch-seal a whole month at close, or every entry will look post-close.
3. At close, record the close head: the seq and entry_hash of the last entry sealed for that month, and the time you recorded them. Send it to your accountant or put it in the close memo, so a copy sits outside the business.
4. Book corrections to a closed month as new adjustment entries dated in the open month, with a note pointing at the original entry id. The mirror has no edit or delete route, so a correction is always a new entry.
5. At review time, list the entries (owner key) and flag every entry whose occurred_at falls inside a closed month but whose seq is after that month's close head. Those are the backdated or post-close entries to explain.
6. Check that the close head still holds: the entry at that seq must still have the same entry_hash, and GET /v1/mirror-entries/{id} must report chain_valid true. A different hash means history up to the close was changed.
7. Compare with the accounting software: pull the QuickBooks Online audit log (or Xero History and notes) for changes made after the close date to transactions dated in the closed month, and match each one to a mirror adjustment entry.
8. Keep the close heads, the mirror entry ids and the exported reports for as long as your tax records. QuickBooks Online's audit log only keeps events for two years.

## Why doesn't a lock date alone catch backdated entries in a closed month?
- QuickBooks Online's Close the books setting protects transactions dated on or before the closing date with a warning or a password. In Xero, only an administrator can set lock dates, and administrators can remove them to make changes. Both are controls run by someone inside the business.
- A backdated entry carries a transaction date inside the closed month, so a report run for that month includes it as if it had always been there. What gives it away is when it was recorded, and that time has to come from somewhere the person posting it can't change.
- PCAOB AS 2401 lists entries recorded at the end of the period or as post-closing entries with little or no explanation among the typical marks of inappropriate journal entries, and says fraudulent entries are often made at the end of a reporting period. It's written for audits of public companies, but it's a useful checklist for any reviewer of a small business's books.

## How do two dates and a close head expose entries posted after month-end close?
- Each mirror entry stores occurred_at, the date the business gives, and sealed_at, which Rightshold sets when the entry arrives. Entries are numbered in order (seq). Each entry_hash covers the ledger id, seq, type, occurred_at, a SHA-256 of the content and the previous entry's hash, so changing any earlier entry changes every hash after it.
- Each entry is also written to Rightshold's append-only public ledger, whose blocks are timestamped in Bitcoin through OpenTimestamps. That ties sealed_at to a block anyone can check with ledger_verify and ledger_anchor, without an account.
- The close head (seq plus entry_hash at close) is the line in the sand. Entries after it were recorded after close, whatever date they claim. Entries before it can't be changed without the chain failing against the hash your accountant already holds.

## What can an accountant check about post-close entries without logging into the books?
- With an entry id, anyone can call GET /v1/mirror-entries/{id} for free: the record as sealed, occurred_at and sealed_at, its chain check and its anchor status. GET /v1/mirror-ledgers/{id} shows the neutral label, the entry count by type and the first and last seal times.
- Given the close head and the owner's entry list, the reviewer can test three things: the close-head entry still has the recorded hash, the chain is valid, and every entry dated in the closed month with a later seq has a matching, explained adjustment.
- This finds post-close entries that were sealed. It can't see an entry that was posted in the accounting software and never sealed, so match the software's audit log against the mirror in both directions.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Verify the Rightshold ledger my mirror-ledger entries are written to, so my accountant can trust the close head I recorded for October."

```json
{
  "tool": "ledger_verify",
  "arguments": {}
}
```
- Free, no key (MCP toolset=ledger). It recomputes every payload, leaf and block hash, Merkle root, chain link and signature on Rightshold's ledger.
- ledger_anchor (free, no key) returns the OpenTimestamps anchor status and .ots proof for the block that holds a mirror entry (anchor.block_height from GET /v1/mirror-entries/{id}).
- The mirror ledger itself is a REST API with an API key: POST /v1/mirror-ledgers opens one under a neutral label, POST /v1/mirror-ledgers/{id}/entries seals an entry (integer cents, optional occurred_at), and GET /v1/mirror-ledgers/{id}/entries lists your entries with seq, occurred_at, sealed_at and entry_hash.
- GET /v1/mirror-entries/{id} is free and needs no account: the sealed record, chain_valid and anchor status. Use it on the close-head entry at every review.
- Content with names, emails, phone numbers, addresses or tax ids is refused. Use your own references (customer_ref, worker_ref).

_Rightshold doesn't connect to QuickBooks or Xero, lock periods or check your numbers. The mirror proves what was sealed and when. It can't stop you posting a backdated entry in your own software, and it can't see entries that were never sealed. Recording close heads and matching the audit log against the mirror are steps you and your accountant run. Not legal, tax, audit or accounting advice._

## Sources
- [PCAOB AS 2401: Consideration of Fraud in a Financial Statement Audit (.58, .61, .62: journal entries, post-closing entries)](https://pcaobus.org/oversight/standards/auditing-standards/details/AS2401)
- [QuickBooks Online: Lock your books (closing date, warning or password)](https://quickbooks.intuit.com/learn-support/en-us/help-article/close-books/close-books-quickbooks-online/L59LelyPM_US_en_US)
- [QuickBooks Online: Use the audit log (can't be turned off, events available for two years)](https://quickbooks.intuit.com/learn-support/en-us/help-article/audit-log/use-audit-log-quickbooks-online/L2WoVnW6I_US_en_US)
- [Xero Central: Set up or remove lock dates](https://central.xero.com/0/article/Set-up-and-work-with-lock-dates)
- [IRS: How long should I keep records?](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records)
- [OpenTimestamps: calendar-anchored timestamp proofs](https://opentimestamps.org/)
- [Ledger verify on Rightshold](https://www.rightshold.com/witness/verify)

## Related
- [How to prove small business books weren't edited after the fact](https://www.rightshold.com/answers/how-to-prove-small-business-books-werent-edited-after-the-fact)
- [How can a CPA audit what an AI agent did in the books?](https://www.rightshold.com/answers/how-can-a-cpa-audit-what-an-ai-agent-did-in-the-books)
- [How to export a period-locked signed agent spend pack for an external auditor](https://www.rightshold.com/answers/how-to-export-a-period-locked-signed-agent-spend-pack-for-an-external-auditor)
- [How to keep segregation of duties when an AI agent pays bills](https://www.rightshold.com/answers/how-to-keep-segregation-of-duties-when-an-ai-agent-pays-bills)

_Not legal advice. Updated 2026-11-07. JSON: https://www.rightshold.com/answers/how-to-catch-backdated-entries-posted-into-a-closed-month-after-month-end-close.json_