Treasury Internal Audit Checklist: Borrowings, Investments, Covenants and Forex RCM
Treasury internal audit tests whether the company controls borrowings, investments, bank guarantees, letters of credit, foreign-exchange exposure, covenant compliance and surplus-fund deployment. It is a high-risk cycle because a single weak control can create financing, liquidity or market-risk exposure immediately.
The audit should not stop at bank reconciliation. Treasury control depends on who can open accounts, approve payments, change beneficiaries, draw loans, place deposits, enter forex contracts and report covenant positions. The RCM below is illustrative and should be tailored to the entity's banking structure, delegated-authority matrix, ERP/payment-bank integration and treasury policy.
Treasury RCM: core risks and controls
| Sub-process | Risk | Control | Internal audit test |
|---|---|---|---|
| Bank accounts | Unauthorised bank account opened or retained | Bank-account opening/closure should require board or authorised committee approval | Compare bank confirmations to approved account master |
| Bank mandates | Dormant or ex-employee signatory remains active | Signatory master should be reviewed after every role change and at fixed cadence | Test bank mandate to HR exit/transfer records |
| Payments | Unauthorised or duplicate payment | Payment file should require maker-checker approval and beneficiary validation | Match bank debits to approved invoices/payment requests |
| Bank reconciliation | Stale unreconciled items hide errors | BRS should be prepared and reviewed within defined close timeline | Age unreconciled items and test high-value stale items |
| Borrowings | Loan drawn without authority or wrong accounting | Borrowing should follow approved limits and sanction terms | Test loan agreements, board approval, interest recomputation and ledger posting |
| Covenants | Breach not identified or reported late | Covenant tracker should be maintained with owner and due date | Recompute covenants from books and compare to lender reporting |
| Investments | Surplus funds placed outside policy | Investment policy should define approved instruments, limits and approvals | Test FD/mutual fund placements against policy and approvals |
| Forex | Unhedged or unauthorised exposure | Forex exposure and hedge register should be reviewed periodically | Match open imports/exports/loans to hedge contracts and MTM |
| Bank guarantees | Expired or unnecessary BGs not released | BG register should track purpose, expiry, margin and release status | Test expired BGs, margin money and confirmations |
Treasury audit data fields to request
| Data table | Minimum fields |
|---|---|
| Bank master | Bank name, account number masked, account type, status, opening approval, signatories |
| Bank statement | Date, narration, debit, credit, balance, instrument/reference number |
| Payment file | Beneficiary, account number masked, amount, maker, checker, approval timestamp |
| BRS tracker | Account, month, preparer, reviewer, unreconciled item, ageing, clearance date |
| Borrowing register | Lender, facility, limit, interest rate, security, covenant, sanction terms |
| Investment register | Instrument, counterparty, placement date, maturity, rate, approval, accounting ledger |
| Forex register | Exposure, currency, due date, hedge reference, rate, MTM, settlement status |
Fieldwork checklist
- Bank accounts in confirmations but not in the books
- Bank accounts in books but not independently confirmed
- Signatories who have resigned, transferred or changed roles
- Bank-account changes made before high-value vendor payments
- Payments processed outside ERP workflow
- BRS items older than 30/60/90 days
- Interest expense not matching sanction terms
- Covenant computations not tied to final trial balance
- Investments placed with unapproved counterparties
- Expired bank guarantees not released
Treasury audit programme
| Step | Procedure | Evidence expected |
|---|---|---|
| 1 | Obtain treasury policy, delegated-authority matrix and bank/lender confirmations | Approved criteria and complete treasury population |
| 2 | Reconcile borrowing register to GL and sanction letters | Facility-wise limits, utilisation, rate and security details |
| 3 | Recompute interest for selected loans and deposits | Agreement terms, working file and ledger posting |
| 4 | Test covenant computations and submission dates | Covenant workings tied to books and lender correspondence |
| 5 | Review investment placements and maturities | Approval, counterparty, instrument, maturity and accounting entry |
| 6 | Review BG/LC register | Purpose, margin, expiry, renewal/release and bank confirmation |
| 7 | Compare open forex exposure to hedge register | Exposure list, hedge contract, MTM and settlement evidence |
Sample and population guidance
Use full-population testing for facilities, covenants, bank guarantees, letters of credit, investment placements and matured instruments. Use samples for interest recomputation, approval-file review and hedge documentation. Treasury samples should be risk-weighted toward high-value, near-covenant, overdue, renewed or manually adjusted items.
What to report
- Condition: 6 bank mandate signatories remained active after role change or exit. Two had payment-authorisation rights on operating accounts.
- Criteria: Treasury policy requires mandate changes within seven working days of role change or exit.
- Cause: HR exit/transfer workflow does not trigger treasury mandate review.
- Effect: Ex-employees or unauthorised users may retain payment authority with banks.
- Recommendation: Create monthly HR-to-bank-mandate reconciliation and require CFO sign-off for unresolved exceptions.
Treasury internal audit FAQ
What is treasury internal audit?
Treasury internal audit reviews controls over bank accounts, payments, borrowings, investments, forex exposure, bank guarantees, covenants and cash reporting.
What is the most important treasury audit test?
Start with bank-account completeness and signatory validity. If the bank master, confirmations and mandates do not reconcile, downstream payment testing is built on a weak base.
Should treasury audit include bank reconciliation?
Yes, but BRS is only one control. Internal audit should also test payment approval, beneficiary changes, borrowing authority, covenant reporting, investment compliance and dormant account closure.
Related CORAA resources
- Internal Audit Software for India
- Bank Reconciliation Automation
- Enterprise Intelligence and Money Flow Analysis
Sources
- ICAI Internal Audit Standards Board, Compendium of Standards on Internal Audit - as on February 2026 and listed by ICAI as applicable from 1 April 2026
- Companies Act, 2013, Section 138 and Section 143(3)(i)
- Company treasury policy, bank sanction letters and delegated-authority matrix should be treated as entity-specific criteria for testing