A cash and bank internal audit programme tests bank account governance, mandates, receipts, payments, bank reconciliation, petty cash, deposits, cut-off and bank-portal access controls.
Cash and bank controls are direct loss-prevention controls. Weak mandates, stale BRS items and bank-portal access gaps can create immediate fraud and misstatement exposure.
Objective: Bank accounts and signatories are approved and current.
Bank master, mandates, board approvals, confirmations, GL mapping.
All bank accounts and mandate changes.
Objective: Payments are authorised and released to valid beneficiaries.
Payment file, voucher, bank portal log, UTR, beneficiary master.
High-value, manual, urgent and changed-beneficiary payments.
Objective: Collections are recorded and deposited completely.
Receipt register, bank statement, deposit slips, petty-cash register, count sheet.
Selected locations/months plus surprise-count evidence.
Objective: Reconciling items and bank access are reviewed.
BRS, bank statement, cash book, stale-item tracker, bank portal user list.
All bank accounts for selected months; all stale items above threshold.
ICAI IASB lists the Compendium of Standards on Internal Audit as on February 2026 as applicable from 1 April 2026. Use this page as a practical workpaper starter, then verify the latest standard, law, regulation, ERP report and client fact pattern before concluding.
It should cover bank accounts, mandates, receipts, payments, bank reconciliation, petty cash, deposits, bank confirmations and bank-portal access.
No. It is a fieldwork starter. The internal auditor must tailor it to the approved scope, ERP, delegation matrix, locations, volumes, materiality, prior findings and current legal position.
Yes. Use the linked CORAA workbook for the cycle. It contains editable RCM, testing, evidence and monitoring sheets that can be used as a fieldwork base.
