Treasury policy and delegation matrix
Risk: Treasury transactions are executed without approved policy, authority limits, instrument rules or exception reporting.
Controls
- Board-approved treasury policy
- Delegation matrix
- Instrument whitelist
- Exception reporting
Tests
- Review policy currency and approvals
- Map limits to transactions
- Inspect exceptions and ratifications
- Check segregation between dealing, recording and settlement
Evidence
Treasury policy, delegation matrix, board/audit committee minutes, exception log and user role matrix.
Bank accounts, mandates and signatories
Risk: Bank accounts, signatories, portals or payment limits remain active without approval or timely leaver removal.
Controls
- Bank account opening/closure approval
- Mandate review
- Bank portal access review
- Dormant account monitoring
Tests
- Confirm complete bank account list
- Match signatories to board approvals
- Review leavers and portal users
- Inspect dormant/low-use accounts
Evidence
Bank confirmations, account master, board resolutions, mandate letters, bank portal user list and leaver report.
Cash-flow forecasting and liquidity monitoring
Risk: Cash shortages, idle balances or funding decisions are missed because forecasts are unsupported or not refreshed.
Controls
- Rolling cash forecast
- Variance review
- Liquidity dashboard
- Funding escalation
Tests
- Compare forecast to actual cash movement
- Review assumptions and variance explanations
- Check shortfall escalations
- Inspect surplus deployment approvals
Evidence
Cash forecast, bank balances, AP/AR ageing, variance file, funding note and treasury MIS.
Borrowings, limits and drawdowns
Risk: Loans, working-capital lines, overdrafts or intercompany borrowings are unauthorised, wrongly classified or used outside sanction terms.
Controls
- Sanction-letter register
- Drawdown approval
- Limit monitoring
- Charge/security register tie-out
Tests
- Agree borrowing register to lender confirmations
- Trace drawdowns to approvals
- Check utilisation against sanction terms
- Review security/charge records
Evidence
Borrowing register, sanction letters, lender confirmations, drawdown notices, bank statements, charge register and covenant tracker.
Interest, fees and covenant compliance
Risk: Interest, processing fees, bank charges or covenants are misstated, missed or reported late to lenders.
Controls
- Interest recomputation
- Bank charge review
- Covenant calendar
- Lender reporting sign-off
Tests
- Recompute interest and fees
- Agree bank charges to sanction terms
- Test covenant ratios and submission dates
- Review breach waivers/escalations
Evidence
Interest workings, bank advices, sanction terms, covenant working, lender submissions, waiver letters and management review.
Investments and surplus-fund deployment
Risk: Surplus funds are invested outside policy, without approval, wrong valuation, wrong custody evidence or incomplete income recognition.
Controls
- Investment policy
- Deal approval
- Custody confirmation
- Valuation and income review
Tests
- Trace investments to policy and approval
- Agree holdings to confirmations
- Review valuation/income recognition
- Check maturity and reinvestment controls
Evidence
Investment register, approval note, FD/deposit receipts, demat/custody statement, valuation working and interest/dividend income support.
Bank guarantees, letters of credit and commitments
Risk: BGs, LCs or comfort letters are issued, renewed, expired or invoked without tracking exposure and approvals.
Controls
- BG/LC register
- Issuance approval
- Expiry monitoring
- Margin/collateral review
Tests
- Agree register to bank confirmation
- Sample issuance/renewal approvals
- Review expired/open items
- Check commission and margin accounting
Evidence
BG/LC register, bank confirmations, application forms, approval notes, margin records, commission advices and expiry tracker.
Forex exposure and hedging
Risk: Foreign-currency exposure, forwards/options or imports/exports are not identified, valued, documented or monitored against policy/RBI-FEMA requirements.
Controls
- Exposure register
- Hedge approval
- MTM review
- FEMA/RBI compliance checklist
Tests
- Tie exposure register to invoices/orders/loans
- Review hedge designation and approvals
- Inspect MTM/revaluation entries
- Check AD bank and RBI/FEMA documentation where applicable
Evidence
Exposure register, forward contracts, option confirmations, MTM statement, import/export documents, ECB/TC files and AD bank correspondence.
Payments, fund transfers and bank reconciliations
Risk: Fund transfers, high-value payments or bank reconciliations are unauthorised, duplicated, stale or unsupported.
Controls
- Maker-checker payment release
- Treasury transfer approval
- Daily/weekly BRS
- Stale item review
Tests
- Trace transfers to approval
- Review high-value and round-sum payments
- Age unreconciled items
- Check duplicate UTR/reference numbers
Evidence
Payment run, bank statements, UTRs, transfer notes, BRS, stale item tracker and approval trail.
Treasury system access and audit trail
Risk: Users can create counterparties, edit bank details, execute deals, approve settlements or override limits without segregation or audit-log review.
Controls
- Role-based access
- SoD conflict review
- Audit-log monitoring
- Leaver access review
Tests
- Review treasury/bank portal users
- Test counterparty/bank changes
- Inspect overrides and privileged actions
- Check leaver and shared-user access
Evidence
Treasury system users, bank portal users, role matrix, audit logs, override reports, leaver list and access review.
