Bank account master and mandates
Risk: Bank accounts, authorised signatories, portal users or transaction limits are incomplete, unauthorised or not updated for leavers.
Controls
- Bank master approval
- Mandate review
- Portal user review
- Dormant account monitoring
Tests
- Agree bank list to confirmations and GL
- Match mandates to approvals
- Review leavers and portal users
- Inspect dormant accounts
Evidence
Bank confirmations, bank master, board resolutions, mandate letters, portal user list and leaver report.
Receipts and customer collections
Risk: Receipts, UPI/card settlements, cash collections or customer remittances are not deposited, matched or recorded correctly.
Controls
- Daily receipt matching
- Settlement reconciliation
- Cash deposit review
- Unidentified receipt ageing
Tests
- Match receipts to bank and customer ledger
- Reconcile gateway/card settlements
- Review cash deposit delays
- Age unidentified receipts
Evidence
Receipt register, customer ledger, bank statement, settlement file, cash deposit slip and unidentified receipt tracker.
Payments and bank transfers
Risk: Vendor payments, refunds, payroll payments or inter-bank transfers are duplicated, unauthorised or released outside maker-checker workflow.
Controls
- Payment run approval
- Beneficiary validation
- Maker-checker release
- Duplicate payment check
Tests
- Sample payments to invoice/support
- Check beneficiary changes
- Review approval trail
- Scan duplicate UTR/reference numbers
Evidence
Payment file, bank statement, UTR, invoice/support, approval trail, beneficiary master and exception log.
Bank reconciliation statements
Risk: BRS items are stale, unsupported, repeated, manually adjusted or not independently reviewed.
Controls
- Periodic BRS preparation
- Independent review
- Stale item ageing
- Manual adjustment approval
Tests
- Reperform selected BRS
- Age open items
- Trace reconciling items to clearance
- Review manual entries and reviewer sign-off
Evidence
BRS, bank statement, cash/bank GL, stale item tracker, journal support and reviewer evidence.
Petty cash and imprest
Risk: Petty cash is used without limits, approvals, vouchers, physical count or timely replenishment review.
Controls
- Imprest limit
- Voucher approval
- Surprise cash count
- Replenishment review
Tests
- Perform cash count
- Sample vouchers
- Check splitting/round sums
- Review replenishment frequency
Evidence
Cash book, vouchers, approval slips, cash count sheet, replenishment statement and exception log.
Deposits, FD maturity and interest
Risk: Fixed deposits, margin money or interest income are omitted, pledged without tracking or not reconciled to bank confirmations.
Controls
- Deposit register
- Maturity tracker
- Interest recomputation
- Lien/pledge review
Tests
- Agree deposits to confirmations
- Recompute interest
- Review matured/unrenewed items
- Check lien and margin classification
Evidence
FD receipts, bank confirmations, deposit register, interest working, lien letters and GL.
Bank charges, interest and fees
Risk: Bank charges, cash-credit interest, gateway charges or loan-related fees are not reviewed against bank terms.
Controls
- Bank charge review
- Interest recomputation
- Fee approval
- Exception reporting
Tests
- Sample charges to bank advices
- Recompute interest where applicable
- Review unusual charges
- Check accounting classification
Evidence
Bank advices, statements, sanction terms, interest working, GL and approval notes.
Cheque, DD and instrument controls
Risk: Cheque books, demand drafts, cancelled cheques or physical instruments are not safeguarded or tracked.
Controls
- Instrument custody
- Cheque sequence control
- Cancelled cheque review
- Stop-payment tracking
Tests
- Inspect unused cheque custody
- Review sequence gaps
- Test cancelled instruments
- Check stale/stop-payment items
Evidence
Cheque register, instrument inventory, cancelled cheques, stop-payment letters and bank statement.
Cut-off and period-end cash bank
Risk: Receipts, payments, transfers or bank entries around period end are recorded in the wrong period.
Controls
- Cut-off review
- Period-end bank confirmation
- Post-period clearance review
- Journal approval
Tests
- Test pre/post period entries
- Trace outstanding cheques/deposits
- Review post-period clearances
- Inspect manual journals
Evidence
Bank statements, BRS, GL, receipt/payment register, post-period bank statement and journal support.
ERP and bank portal access
Risk: Users can create beneficiaries, post bank journals, approve payments, change limits or release funds without segregation or audit-log review.
Controls
- Role-based access
- SoD review
- Beneficiary-change approval
- Audit-log monitoring
Tests
- Review users and roles
- Test SoD conflicts
- Inspect beneficiary changes
- Check leavers/shared IDs and privileged actions
Evidence
ERP users, bank portal users, role matrix, audit logs, beneficiary change log, leaver list and access review.
