# Internal Control Questionnaire for Cash, Ready to Use

- Author: PreciseBankFlow (https://precisebankflow.com)
- Published: 2026-10-17
- Category: Internal controls over cash
- Canonical: https://precisebankflow.com/blog/internal-control-questionnaire-for-cash

> An internal control questionnaire for cash: questions on receipts, disbursements, bank access and reconciliations, and how to read the answers.
An internal control questionnaire for cash is a list of yes or no questions about how a business receives, pays, holds and reconciles money. Each "yes" describes a control that should exist; each "no" marks a gap to probe. Use it to plan the work, then confirm the answers with documents and a walkthrough before relying on any of them.

## What is an internal control questionnaire for cash used for?

A cash questionnaire is a planning tool. An auditor, an outside accountant or a new controller uses it to learn quickly which controls a business says it has over cash, where the gaps are, and which areas need testing. It records what people say. It does not prove that any control actually works.

### Where it fits

The questionnaire usually comes early: at the start of an audit, during due diligence on an acquisition, or when a new finance lead inherits a team. It is fast, because the person answering can work through it in under an hour. It is also consistent, because every client or location gets the same questions, which makes gaps easy to compare.

### What it cannot do

A "yes" means someone believes the control exists. It does not mean the control ran every month, that the right person performed it, or that it would catch a problem. Turning answers into evidence takes a walkthrough of one real transaction and, for controls you plan to rely on, a test over a sample of periods. [Testing bank reconciliation controls for design and operation](/blog/testing-bank-reconciliation-controls) shows that next step for the most important cash control.

### How to use the tables below

Each section gives questions with a column for the answer and a column for the evidence you would ask to see. Fill in the answer, name the person who gave it and the date. Leave the evidence column for the walkthrough. The questions are written so that "yes" is the controlled answer, which keeps the reading simple.

## Cash receipts questions for the control questionnaire

Cash receipts questions cover how money arrives: by mail, at a counter, through a processor or by electronic transfer. The goal is to learn whether incoming cash is recorded by someone other than the person who handles it, whether it reaches the bank quickly, and whether recorded receipts are later matched to bank credits.

| # | Question | Yes / No | Evidence to request |
| --- | --- | --- | --- |
| R1 | Is mail opened by someone who does not record receipts or reconcile the bank? | | Duty list, observation |
| R2 | Is a log of checks and cash received prepared when the mail is opened? | | Two recent logs |
| R3 | Are checks restrictively endorsed "for deposit only" on receipt? | | Sample check images |
| R4 | Are receipts deposited intact, daily or on a set schedule? | | Deposit slips against logs |
| R5 | Does someone other than the depositor compare the log total with the bank credit? | | Signed comparison |
| R6 | Are customer payments by card or processor reconciled to bank deposits each month? | | Processor reconciliation |
| R7 | Is cash at registers or counters counted by two people and reconciled to sales? | | Count sheets |
| R8 | Are scanned or remote deposits controlled so a check cannot be deposited twice? | | RDC batch reports |
| R9 | Are customer complaints about unrecorded payments handled by someone outside receipts? | | Complaint log |

A business with one office clerk will often answer "no" to R1 and R5. That is a design gap, not a failure of effort, and it calls for a compensating control such as owner review of the deposit log.

## Cash disbursements questions for the control questionnaire

Cash disbursements questions cover how money leaves: checks, ACH, wires, cards and petty cash. They test whether each payment is approved by someone with authority, supported by documents, released by someone other than the person who set it up, and reviewed after it clears.

| # | Question | Yes / No | Evidence to request |
| --- | --- | --- | --- |
| D1 | Is every payment approved before release by a person with written authority? | | Approval policy, sample approvals |
| D2 | Is each payment supported by an invoice, contract or expense report? | | Three paid invoices |
| D3 | Are approval limits set by amount, with higher amounts needing a second approver? | | Limit schedule |
| D4 | Does the person who enters vendor bank details differ from the person who releases payments? | | System user list |
| D5 | Are changes to vendor bank details verified by a callback to a known number? | | Change log with callbacks |
| D6 | Are wires released by a second person after a callback or documented check? | | Wire records |
| D7 | Is blank check stock locked, logged and kept apart from check signers? | | Stock log |
| D8 | Are voided checks retained and defaced? | | Voided check file |
| D9 | Are supporting documents marked paid so they cannot be paid again? | | Sample invoices |
| D10 | Does someone review a list of all payments each month after they clear? | | Signed payment register |

D4 and D5 deserve weight. A changed vendor bank account diverts a real payment for a real invoice, so the other payment controls all pass.

## Bank access and reconciliation questions for the cash questionnaire

Bank access and reconciliation questions cover who can act on the accounts and how the monthly reconciliation is done and reviewed. They find whether the company knows every account it holds, whether bank access matches approved roles, and whether the reconciliation is timely, independent and actually reviewed.

| # | Question | Yes / No | Evidence to request |
| --- | --- | --- | --- |
| B1 | Is there a complete, current list of every bank account? | | Account list, bank confirmations |
| B2 | Do the bank's signer records match a current board or owner resolution? | | Resolution, bank signer list |
| B3 | Is each online banking user's access limited to their role? | | Bank user report |
| B4 | Does every online user have their own login and token? | | Bank user report |
| B5 | Are signers and online users removed promptly when people leave? | | Last departure record |
| B6 | Is every bank account reconciled each month within a set deadline? | | Reconciliation file with dates |
| B7 | Is the reconciliation prepared by someone who does not handle cash or approve payments? | | Duty list |
| B8 | Is the reconciliation reviewed and signed by a second person? | | Signed reconciliations |
| B9 | Are old reconciling items followed up and cleared? | | Aged item list |
| B10 | Does someone outside finance see the bank statements each month? | | Statement review sign-off |

Public companies document these same areas as key controls under section 404. [SOX controls for cash and the evidence testers ask for](/blog/sox-controls-for-cash) shows how the answers to B6 through B8 are written as formal control descriptions.

## How do you read a "no" on a cash control questionnaire?

A "no" on a cash questionnaire identifies a risk, not a conclusion. For each one, ask what could go wrong because the control is missing, whether another control covers the same risk, and what test would show whether loss or error has already happened. Then decide whether the gap needs a fix, a compensating control, or more substantive work.

### Three questions for each "no"

1. **What could go wrong?** State the error or theft the missing control would have caught, in one sentence.
2. **Does something else catch it?** Look for a later control that would detect the same problem, such as an independent reconciliation or an owner's statement review.
3. **What would show it already happened?** Name the record you would search.

### A worked example

The example below uses made-up answers from a twelve-person distributor.

| Question | Answer | What could go wrong | Compensating control | Follow-up |
| --- | --- | --- | --- | --- |
| R1 | No: the office manager opens mail and posts receipts | A check is kept and the customer's balance written off | Owner reviews customer credit memos monthly | Compare twelve months of write-offs with customer correspondence |
| D5 | No: vendor bank changes accepted by email | A fake email diverts a payment | None found | Confirm bank details for the top twenty vendors by phone; recommend a callback rule |
| B7 | No: the bookkeeper both pays bills and reconciles | An improper payment is hidden in the reconciliation | Owner signs the reconciliation | Check whether the owner's review is real: ask what was questioned last quarter |

The first gap has a partial compensating control, so the follow-up targets the area the control does not cover. The second has nothing, so the work becomes a substantive check plus a recommendation. The third depends on how good the owner's review is, which the questionnaire cannot tell you. Only a conversation and the file can.

### When "no" answers cluster

Several "no" answers in the same area, such as receipts, point to a person who controls a whole flow of cash. Extend testing in that area beyond the usual sample. When gaps cluster around one person and there are unexplained transfers between accounts, the pattern sometimes matches what investigators look for in [bank records behind a Ponzi scheme](/blog/ponzi-scheme-bank-records), such as new money paying earlier investors.

## When a cash questionnaire answer should not be trusted

A questionnaire answer should not be trusted when the person answering performs the control, when the answer contradicts what documents show, or when every answer is "yes" in a business too small to have that many people. In each case, corroborate with a walkthrough, records and a second person before relying on it.

### Who answered

Ask the controller and the owner to answer separately, and compare. The person who performs a control often describes how it is supposed to work. The person who reviews it may know where it is skipped.

### Walk one transaction through

Pick one recent deposit and one recent payment. Follow each from the first document to the bank statement and the reconciliation. If the questionnaire says receipts are logged, the log for that day should exist and list that check. If it says payments get a second approval, the approval should be on file with a date before the release.

### Look at the statements yourself

Bank statements are third-party evidence, and they do not depend on anyone's answer. Reading three months of statements for unusual payees, round transfers and gaps in check numbers takes little time and often tests several questionnaire answers at once. [PreciseBankFlow](/) can do the mechanical part of that: it checks that each statement foots from opening to closing balance, flags possible duplicates and missing checks, and lists the exceptions for you to decide on.

### Too good to be true

A five-person company that answers "yes" to every segregation question probably misunderstood them. Ask who, by name, does each step. The names usually tell you more than the yes or no.