An internal audit of bank reconciliation practice tests whether every bank account is reconciled completely, on time and with a real review. Internal audit scopes the accounts and months, re-performs a sample of reconciliations from the bank statements, tests preparation and sign-off dates, chases old reconciling items, and reports findings with a cause and a fix.
Scoping an internal audit of bank reconciliation practice
Scope starts with the full list of bank accounts, because the biggest risk is an account nobody reconciles at all. Agree the finance team's account list to the general ledger, to the bank relationship list held by treasury, and to bank confirmations or online banking access. Then choose the period, the months to sample and the risks to cover.
The account inventory
Build one list that shows, for every account, the bank, the ledger account, the preparer, the reviewer and the reconciliation frequency. Ask treasury or the controller for the bank's own list of accounts in the organization's name. Gaps on either side are findings. A ledger account with no bank behind it is a cleanup item. A bank account with no ledger account, or no one assigned to reconcile it, is a control failure.
Risk-based coverage
Not every account deserves the same depth. Rank accounts by activity, balance and who can move money out of them. A payroll account with heavy weekly activity and a high-volume operating account need more months tested than a dormant savings account. Payroll carries its own risks, such as duplicate or ghost payees; auditing payroll bank account activity covers those tests.
Engagement criteria
Write down the standard the practice is measured against before testing begins. That is usually the organization's own close policy: the deadline for each reconciliation, who may prepare and who may review, how old a reconciling item may get and what evidence must be attached. Where the policy is silent, agree criteria with management at the planning meeting so findings are not disputed later.
Re-performing a sample of bank reconciliations
Re-performance means rebuilding a reconciliation independently from the bank statement and the general ledger, then comparing your result with the one finance prepared. Start from the statement's closing balance and the ledger balance at the same date. Work through the reconciling items yourself, and see whether you reach the same adjusted balances with the same list.
Steps for each selected reconciliation
- Get the bank statement for the month directly, through online banking access you control or from the bank.
- Foot the statement: opening balance plus credits less debits should equal the closing balance.
- Agree the closing balance to the bank balance on the reconciliation.
- Agree the book balance to the general ledger at the same date.
- Match statement lines to ledger entries and list what does not match.
- Compare your unmatched list with finance's reconciling items. Every difference needs an explanation.
- Trace each reconciling item to the next month's statement or to a correcting entry.
What differences mean
A difference between your list and the preparer's has three common causes. The preparer may have netted items, such as one line for "deposits in transit" without detail. The preparer may have carried an item forward that has already cleared. Or the reconciliation may contain a balancing figure that no transaction supports. The first is a documentation weakness. The second and third mean the reconciliation does not prove what it claims.
Matching hundreds of lines by hand is the slow part of re-performance. PreciseBankFlow extracts lines from the statement PDFs, foots each statement and matches lines to the ledger, so the internal auditor starts from a list of unmatched items rather than a blank sheet. Deciding whether each one is a finding stays with the auditor.
How do you test bank reconciliation timeliness and review?
Test timeliness by comparing the date each reconciliation was completed with the policy deadline, using evidence that cannot be backdated easily, such as system timestamps or file metadata. Test review by checking that a different person signed off, on a later date, and that the reviewer's questions or marks show the review actually happened.
Evidence of timing
A typed date on the face of a reconciliation is weak evidence, because anyone can type any date. Stronger evidence includes the completion timestamp in the close-management or accounting system, the document's saved date in a controlled file share, or the email that sent it for review. Where the only evidence is a typed date, say so in the workpaper.
Evidence of review
A reviewer's initials alone do not prove a review. Look for signs that the reviewer engaged with the content: a question about an old item, a tickmark on the ledger balance, a follow-up note. A batch of reconciliations for several months all signed by the reviewer on the same afternoon suggests the review was done to catch up rather than to check.
Segregation of duties
Check that the preparer of each reconciliation is not someone who can also initiate payments from that account or record cash receipts. Where staff numbers make that impossible, look for a compensating control, such as a manager reviewing the bank statement directly. Small organizations, including many nonprofits, face this often; the nonprofit cash audit guide covers restricted gifts and grant accounts that add to the burden.
A test plan for one engagement
The table shows an example plan for a mid-sized organization with twelve bank accounts. The sample sizes and results are illustrative only.
| Test | Sample | Evidence | Example result |
|---|---|---|---|
| Account inventory complete | All accounts | Ledger, bank list, online access | 1 bank account had no ledger account |
| Re-perform reconciliation | 3 accounts, 2 months each | Statements, ledger, reconciliations | 1 of 6 had an unsupported 412.18 difference |
| Prepared by deadline | 12 accounts, 4 months each | System timestamps | 9 of 48 late, by 6 to 31 days |
| Independent review | Same 48 | Sign-off, review notes | 7 of 48 reviewed by the preparer's manager on one day |
| Preparer cannot pay from the account | All preparers | User access listing | 1 preparer had payment rights |
| Reconciling items over 90 days | All open items | Aging of reconciling items | 14 items over 90 days, 3 over a year |
Old reconciling items an internal audit should escalate
Reconciling items that stay open for months are the clearest sign that a reconciliation is not doing its job. Escalate deposits in transit older than a few days, outstanding checks past the organization's void period, unexplained differences carried forward, and adjustments with no supporting document. Each one either hides an error or could hide a theft.
Items worth asking about first
- Old deposits in transit. A deposit recorded in the books that never reaches the bank is the classic sign of receipts being diverted.
- Customer payments applied late. Receipts that consistently post to a customer's account days after the bank received them can mean one customer's payment is covering another's. That pattern is lapping, and spotting delayed customer payments in lapping fraud explains how to trace it.
- Stale outstanding checks. These may be lost checks, vendors never paid or unclaimed property the organization must report.
- Round adjustments. A recurring adjustment of an even amount with a vague label is often a plug.
What escalation means
Escalate in proportion. Most old items are housekeeping. Where an item suggests concealment, tell the chief audit executive before raising it with the preparer, and consider whether the matter needs a separate investigation rather than a finding in the routine report.
Mistake: auditing the bank reconciliation template instead of the work
A common mistake is to test the reconciliation as a form: check that it uses the approved template, has both signatures and balances to zero, and conclude the control works. A reconciliation can pass all of that and still be wrong, because the bank balance was typed in or a difference was forced to zero.
How the mistake happens
Internal auditors under time pressure often test attributes they can see on the page. A completed template looks like evidence. But the template proves only that someone filled it in. Unless the auditor goes back to the bank statement and the ledger, the test cannot detect a reconciliation that agrees with itself and nothing else.
How to avoid it
Always take the bank balance from a source finance did not prepare, foot the statement, and re-perform at least part of the matching. Check that the reconciling items carry detail, not totals. The assertions a bank reconciliation can test, from existence to cutoff, are a useful checklist for whether a procedure tests the numbers or just the paperwork.
How should internal audit findings on bank reconciliation be written?
Write each finding with five parts: the condition you observed, the criteria it falls short of, the cause, the effect, and a recommendation that fixes the cause. Management acts on findings that are specific, quantified and agreed with the process owner. Ranking findings by significance helps them decide what to fix first.
The IIA's Global Internal Audit Standards set the professional framework for this reporting. The IIA's announcement that the Global Internal Audit Standards took effect on January 9, 2025 is the starting point for checking which edition your function follows.
A finding written out
The example below is invented to show the form.
- Condition. Nine of 48 reconciliations tested were completed between 6 and 31 days after the deadline. Three reconciling items on the operating account were more than a year old.
- Criteria. The close policy requires each bank reconciliation within ten business days of month end, and investigation of any reconciling item older than 60 days.
- Cause. One staff member prepares all twelve reconciliations, and close-week priorities push them back. No report shows aging of reconciling items.
- Effect. Errors and misappropriation could go undetected for over a month. The year-old items may be misstated cash.
- Recommendation. Spread preparation across two staff, add an aging column to the reconciliation template, and have the controller review aging monthly. Management to clear the three old items by the next quarter end.
Getting agreement
Share the draft with the controller before issuing it. Agree the facts first, then the cause. A finding management helped word is one it is more likely to fix. Record the agreed action, the owner and the date, and schedule a follow-up test.
To give the next engagement a footed, matched starting point for each account, request early access to PreciseBankFlow.