Cash is the asset every scheme eventually touches. Treasury controls are few, and the loss from one failure can be large and immediate. This post lays out a treasury and cash RCM, tests for each control, and a worked wire fraud scenario. Two statutory anchors apply to issuers: Section 13(b)(2)(B)(iii) of the Exchange Act (access to assets only with management's authorization) and 13(b)(2)(B)(iv) (recorded accountability for assets compared with existing assets at reasonable intervals, with action on differences). Bank reconciliation is the standard way to meet the second one for cash.
The RCM
| ID | Risk | Control | Type | Assertion | Test step |
|---|---|---|---|---|---|
| T-01 | Unauthorized bank accounts opened | Account opening and closing require board-approved resolution and two officers; master list of accounts maintained and reviewed quarterly | Preventive, detective | Existence, completeness | Obtain bank confirmations of all accounts; agree to the master list and resolutions |
| T-02 | Unauthorized access to the bank portal | Portal users and entitlements reviewed quarterly by someone outside treasury; leavers removed within one business day | Detective | Occurrence | Obtain the bank's user report directly; compare to the HR roster and approved entitlements |
| T-03 | Unauthorized payment release | Payments created by one person and released by a second; limits by role enforced at the bank | Preventive | Occurrence | Obtain release log; test for same-user create and release; inspect limits |
| T-04 | Fraudulent change to wire instructions | Wire templates locked; changes verified by callback to a known number and approved by a second person | Preventive | Occurrence | Test change logs; inspect callback evidence |
| T-05 | Cash balances misstated | Monthly bank reconciliation prepared and reviewed by different people; items older than 30 days investigated | Detective | Existence, accuracy | Reperform for sample of accounts and months |
| T-06 | Check stock or ACH files misused | Check stock locked, numbered and logged; ACH files transmitted only from locked templates | Preventive | Occurrence | Observe storage; account for sequence; compare ACH file to approved batch |
| T-07 | Cash shortfall or covenant breach | Weekly cash forecast reviewed by CFO; covenant compliance computed monthly | Detective | Valuation, presentation | Compare forecast to actual; reperform covenant calculation |
| T-08 | Counterparty concentration | Policy limits for balances per institution reviewed monthly | Detective | Valuation | Compare balances to policy |
| T-09 | Intercompany or sweep transfers misrecorded | Intercompany transfers matched and eliminated; sweep entries reviewed | Detective | Accuracy | Agree transfers to both sides |
| T-10 | Petty cash or cash on hand misappropriated | Imprest fund counted by someone independent at least quarterly | Detective | Existence | Count a fund unannounced |
Balance concentration
The FDIC's standard maximum deposit insurance amount is $250,000 per depositor, per FDIC-insured bank, for each account ownership category. A company with $6 million in operating cash at one bank holds a very large uninsured balance. The control question is not whether to eliminate it, but whether management has decided the exposure on purpose. A policy that sets limits by institution, a sweep or other arrangement, and a monthly report of balances by bank give T-08 something to test. Disclosure of concentrations is a separate accounting question.
Testing the reconciliation
Bank reconciliations are a classic detective control and a classic check-the-box. Strong tests:
- Obtain the bank statement directly from the bank or portal and agree balances on the reconciliation.
- Confirm that outstanding checks are valid by examining subsequent clearing in the following statement.
- Check reconciling items older than 30 days and the explanations.
- Confirm the preparer cannot create payments or access check stock.
- Confirm the reviewer's evidence includes what was reviewed, not just a signature.
For a full discussion see /us/blog/bank-reconciliation and /us/glossary/bank-reconciliation-review. For the compensating control logic when the review is missing, see /us/blog/compensating-controls-precision-and-when-they-reduce-deficiency-severity.
Worked scenario: wire fraud through a changed vendor instruction
A treasury analyst receives an email, apparently from a long-standing supplier, asking to update bank details for the next payment of $480,000. The analyst edits the vendor record and the wire template and sends the payment for release. The second approver sees the same name, amount and reference as the prior payment and releases it.
Where the controls failed, using the RCM:
- T-04: the callback to a known number did not occur. The template was not locked, so the analyst could edit it.
- T-03: the second approver's review was a comparison of name and amount, with no prompt to see that the account number had changed.
- T-02: the portal allowed the analyst to edit templates, an entitlement the quarterly review had not flagged because the report listed users and not their permissions.
Standard 14.4 Recommendations and Action Plans lists addressing the root cause of the finding as a purpose of recommendations, so the redesign targets the missing callback and the editable template. Redesign: lock templates; require a callback with logged evidence and a second person for any change; have the bank's release screen highlight changed account numbers; and include entitlements in the portal review. Test the redesigned controls by attempting a template change in a test environment with auditors watching and by examining the log for each change in the year.
Recording and presentation
Cash items belong on the lead schedule and in the audit file with confirmations. See /us/blog/audit-confirmations-au-c-505 and /us/blog/embezzlement-detection-guide-for-auditors.
Cybersecurity link
Portal access control is also an access management question. NIST CSF 2.0 subcategory PR.AA-05 expects access permissions to be defined, managed, enforced and reviewed, incorporating least privilege and separation of duties. See /us/blog/user-access-provisioning-and-quarterly-access-review-itgc-testing.
Mistakes to avoid
- Reviewing the portal user list without entitlements.
- Callback to the number in the email.
- Same person prepares the reconciliation and handles incoming checks.
- No independent count of petty cash.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- Securities Exchange Act of 1934, section 13(b)(2)(B)(iii) and (iv), 15 U.S.C. 78m(b)(2)(B): https://www.law.cornell.edu/uscode/text/15/78m
- FDIC, Understanding Deposit Insurance: https://www.fdic.gov/resources/deposit-insurance/understanding-deposit-insurance/index.html
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024), PR.AA-05: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
- The IIA, Global Internal Audit Standards (2024), Standard 14.4 Recommendations and Action Plans: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error