Cash and Bank Internal Audit Checklist: BRS, Payments and Receipts RCM
Cash and bank internal audit tests whether money movement in bank and cash accounts is complete, authorised, reconciled and correctly recorded. This cycle is narrower than Treasury: Treasury covers borrowing, investments, covenants, guarantees and forex; Cash and Bank focuses on operating receipts, operating payments, bank reconciliation, petty cash, mandates and stale reconciling items.
The audit question is simple: can the company prove that every bank and cash movement is genuine, approved, recorded in the right period and reconciled without long-outstanding unexplained items? The RCM below is illustrative and should be tailored to the entity's bank-account structure, payment modes, petty-cash usage and internal-audit scope.
Cash and bank RCM: core risks and controls
| Sub-process | Risk | Control | Internal audit test |
|---|---|---|---|
| Bank-account master | Unrecorded or unauthorised account exists | Bank accounts should be approved and reconciled to confirmations | Compare bank confirmations, books and account master |
| Bank mandates | Unauthorised signatory remains active | Bank mandates should be reviewed after exit/transfer and at fixed cadence | Match mandate list to HR exit/transfer records |
| Receipts | Customer receipt not recorded or misapplied | Receipt allocation should be customer/invoice-wise with reviewer check | Match bank credits to customer ledger and ageing |
| Payments | Payment made without approval | Payment workflow should require maker-checker and source document | Match bank debits to approved payment request or invoice |
| Bank reconciliation | Stale items hide errors or fraud | BRS should be prepared and reviewed within close timeline | Age unreconciled receipts/payments and test old items |
| Petty cash | Cash leakage or unsupported expense | Petty cash should have imprest limit, vouchers and surprise count | Reconcile cash book, vouchers and physical cash |
| Bank charges | Charges/interest not reviewed | Bank charges should be reviewed against bank terms | Test unusual charges, reversals and interest entries |
| Period cut-off | Receipt/payment recorded in wrong period | Cut-off review should compare bank date, book date and instrument date | Test entries around month-end and year-end |
Cash and bank audit data fields to request
| Data table | Minimum fields |
|---|---|
| Bank master | Bank, branch, account number masked, account type, GL code, status, authorised signatories |
| Bank statements | Date, narration, reference, debit, credit, balance |
| Cash book | Date, voucher, receipt/payment, narration, custodian, approval |
| Receipt allocation | Customer, invoice reference, receipt date, amount, unapplied balance |
| Payment register | Vendor/employee, invoice/request reference, amount, maker, checker, payment date |
| BRS tracker | Account, reconciling item, debit/credit, ageing, owner, clearance date, reviewer |
Fieldwork checklist
- Bank accounts appearing in confirmations but not in books
- Books carrying bank accounts that are closed or dormant
- Bank signatories who resigned or moved roles
- Bank debits without invoice, expense claim or payment request
- Customer receipts kept unapplied for long periods
- BRS items older than 30/60/90 days
- Cheques issued but stale or repeatedly revalidated
- Petty cash vouchers without approval or business purpose
- Cash withdrawals just below approval thresholds
- Month-end receipts or payments recorded in a different period from bank date
Cash and bank audit programme
| Step | Procedure | Evidence expected |
|---|---|---|
| 1 | Obtain the bank master, bank confirmations and GL bank ledgers | Complete bank-account population |
| 2 | Reconcile every active and dormant bank account to the books | Account-wise BRS and balance confirmation |
| 3 | Age all unreconciled BRS items | Ageing report with owner and clearance status |
| 4 | Test high-value bank debits to approved source documents | Invoice/payment request, approval trail and bank debit |
| 5 | Test high-value and unusual bank credits to customer or other source records | Receipt allocation, customer ledger or explanation |
| 6 | Match bank signatories to current HR records | Mandate list, exit/transfer records and update evidence |
| 7 | Perform surprise cash count where petty cash is material | Physical count sheet, cash book and voucher file |
Sample and population guidance
Use full-population tests for BRS ageing, duplicate payment references, bank accounts, bank signatories and payments without source reference. Use samples for document-quality review, petty-cash vouchers and root-cause walkthroughs. The sample should be biased toward old, high-value and unusual items rather than selected randomly from the whole cash book.
What to report
- Condition: 31 BRS reconciling items older than 90 days remained open, including 8 unpresented cheques and 6 unidentified bank credits.
- Criteria: Finance SOP requires BRS preparation within five working days of month-end and clearance/escalation of items older than 30 days.
- Cause: BRS is prepared but old items are not assigned to owners for closure.
- Effect: Cash balance may include stale or invalid items, and unidentified receipts may not be applied to customer accounts.
- Recommendation: Add ageing buckets and owner assignment to BRS review, with controller escalation for items older than 30 days.
Cash and bank internal audit FAQ
What is cash and bank internal audit?
Cash and bank internal audit reviews controls over bank accounts, operating receipts, operating payments, bank reconciliation, petty cash, mandates, bank charges and period cut-off.
How is Cash and Bank different from Treasury audit?
Cash and Bank focuses on day-to-day cash movement and reconciliation. Treasury covers financing and financial-risk activities such as borrowings, investments, covenants, bank guarantees, letters of credit and forex exposure.
What is the best BRS audit test?
Age every reconciling item and test old, high-value and unusual items. A BRS prepared on time but carrying stale unexplained entries is not an effective control.
Related CORAA Resources
Sources
- ICAI Internal Audit Standards Board, Compendium of Standards on Internal Audit - as on February 2026 and listed by ICAI as applicable from 1 April 2026
- Companies Act, 2013, Section 138 and Section 143(3)(i)
- Company bank mandates, delegated-authority matrix and finance SOP should be treated as entity-specific criteria for testing