Internal controls over cash are the rules that decide who can receive, record, pay out and reconcile money, and who checks each of those people. A small team needs four groups of them: receipt handling, payment approval, bank access and an independent review of the bank reconciliation. That last control catches what the others miss.
What do internal controls over cash have to stop?
Cash controls exist to stop three things: theft, payments that should never have been made, and honest errors that sit unnoticed in the books. Cash is the asset most easily moved and spent, so a gap here costs money directly, not just a misstated balance.
Theft and diversion
Theft is the obvious target. A receipt can be pocketed before it is recorded. A check can be written to a fake supplier. An online payment can go to a personal account. Each scheme needs one person to control two steps that should belong to different people, for example receiving money and recording it, or approving a payment and reconciling the account it came out of.
Unauthorized or mistaken payments
Not every bad payment is fraud. A supplier invoice gets paid twice. A payment goes out on a forged instruction that looked like it came from the owner. A wire is sent to an old account number. Approval controls exist to put a second pair of eyes on each payment before it leaves, while it can still be stopped.
Errors that hide in the ledger
The third target is the quiet one. A deposit is posted to the wrong account, a bank fee is never recorded, or a transfer is booked twice. None of these is theft, but each makes the cash figure in the books wrong. A reconciliation that is prepared and reviewed on time finds them while the trail is short.
Keep those three targets in mind when you design the controls. A control that does not stop or detect at least one of them is paperwork.
Cash receipt controls from the mailroom to the deposit
Cash receipt controls protect money from the moment it arrives until it shows on the bank statement. The goal is a record of each receipt made by someone other than the person who posts it to customer accounts, and a deposit that matches that record in full and on time.
Record the receipt at the door
Whoever opens the mail or takes payment at the counter lists each check and cash receipt before anything else happens. The list shows the payer, the amount, the check number and the date. That list is the independent record. Later, it is compared with what reached the bank and what was posted to customer accounts.
Endorse and deposit quickly
Checks are stamped "for deposit only" to the business account as soon as they are listed. A restrictive endorsement makes a stolen check much harder to cash. Deposits go to the bank daily, or as often as volume allows, so the amount on hand is small. Remote deposit capture helps here, though it brings its own risks, such as a scanned check being deposited a second time somewhere else.
Keep posting separate from handling
The person who records payments against customer balances should not be the person who handled the money. When one person does both, receipts can be stolen and the customer account credited with a later payment, a scheme known as lapping. The detail of this split, and what to do when you cannot make it, is in segregation of duties for cash.
Disbursement approval before cash leaves the account
Disbursement controls make sure every payment is real, approved and paid once. The minimum is an approval by someone who did not prepare the payment, given against a supporting document such as an invoice, before the money is released. After that, the payment record should be locked against edits.
Approval against support
An approver should see the invoice or the request, not just a list of amounts. The approval is worth little if the approver cannot tell what the payment is for. Approval limits help: small payments can be approved by a manager, while larger ones need the owner or a second signer.
Separate the people who set up and the people who pay
Supplier records are a common point of attack. Whoever can add a new supplier or change bank details should not also be able to release payments. Otherwise, one person can create a payee and pay it. Changes to supplier bank details need a call to the supplier on a phone number already on file, never one taken from the email asking for the change.
Checks need extra care
Paper checks add risks of their own: blank stock can be stolen, signatures forged, payee lines altered. Lock blank check stock, log check numbers and review the sequence for gaps each month. Use a second signature on checks above a set amount. Signature stamps should be locked up with the same care as the stock.
Bank access controls: signers, logins and tokens
Bank access controls limit who can move money directly at the bank. A business should know every person who can sign checks, log in to online banking, approve a payment or add a new user, and each of those lists should be as short as the work allows. Most losses that get past the books start with bank access.
Signers
Authorized signers are set on the bank's signature card or resolution. Remove people promptly when they leave or change role. Banks act on the signer list they have, not the one in your policy manual.
Online banking roles
Online banking usually separates viewing, initiating, approving and administering. Give each person only the role they need. Turn on dual approval for wires and ACH payments, so one login cannot both create and release a payment. Bookkeepers often need view access only.
Tokens and passwords
Each user should have their own login and their own token or authenticator. Shared logins destroy the audit trail, because the bank's log can no longer say who did what. Review the user list at least quarterly, and remove access on the same day someone leaves.
Bank reconciliation review as the backstop cash control
The bank reconciliation is the control that detects what the other controls missed. It compares the bank's record with the books line by line. When someone independent of cash handling reviews it promptly, an unauthorized payment, a missing deposit or a recording error shows up within weeks instead of years.
What makes the review independent
The reviewer should not have prepared the reconciliation, and ideally has no access to receive or pay out cash. The reviewer looks at the bank statement itself, not just the reconciliation summary. A reconciliation prepared by the person who also writes the checks can be made to balance while hiding a theft, for example by listing a stolen check as outstanding forever.
What the reviewer looks at
- The statement closing balance on the reconciliation agrees to the bank statement.
- The book balance agrees to the general ledger at the same date.
- Outstanding checks and deposits in transit are listed by date and amount, and none is old without an explanation.
- Payees on the statement are recognized, especially new ones.
- The reviewer signs and dates the page.
Timing
A review that happens three months late lets a problem run for three months. Set a deadline for preparation and review within the close. The schedule in monthly bank reconciliation deadlines is a workable starting point, and the case for keeping preparer and reviewer apart is set out under who should prepare and who should review a bank reconciliation.
For the reviewer, PreciseBankFlow checks that the statement foots and lists unmatched, duplicate and missing items as exceptions, so the review time goes to the lines that need a judgment.
What is the minimum set of cash controls for a two-person team?
A two-person team cannot separate every duty, so the minimum set leans on review by the owner or a manager who does not handle cash. Keep receipt logging, payment approval, dual approval at the bank and an independent monthly review of the bank statement and reconciliation. Those four cover most of the risk.
The table below is an example of how a small company with one bookkeeper and one owner might assign the work. Adjust the frequency and the evidence to your volume.
| Control | Performed by (example) | Evidence | Frequency |
|---|---|---|---|
| List checks and cash received before deposit | Office manager or owner | Signed receipt log | Each day money arrives |
| Deposit all receipts intact | Bookkeeper | Bank deposit receipt matched to log | Daily or each banking day |
| Approve each payment against an invoice | Owner | Initials or approval in the payment system | Each payment run |
| Release online payments under dual approval | Bookkeeper initiates, owner approves | Bank approval log | Each payment |
| Verify supplier bank detail changes by phone | Owner | Note of call, number used, date | Each change |
| Lock check stock and log numbers | Owner holds the key | Check stock log | Each use, reviewed monthly |
| Prepare bank reconciliation | Bookkeeper | Reconciliation with statement attached | Monthly |
| Review statement and reconciliation | Owner | Signature and date on the reconciliation | Monthly, within the close |
| Review online banking users | Owner | Printed user list, initialed | Quarterly |
The owner's review does the heavy lifting in this set. It works because the owner looks at the bank statement itself, asks about anything unfamiliar, and signs the page. How to share duties when there are only two or three people, and which compensating checks to add, is covered in segregation of duties in a small business.
What you can drop, and what you cannot
You can drop formality. A spreadsheet log is as good as a bound book, and an email approval is as good as a stamp, as long as it can be found later. You cannot drop the independent look at the bank statement. Every other control in the table depends on someone eventually checking that the bank agrees.
Signs a cash control exists only on paper
A cash control exists only on paper when its evidence is missing, produced late or produced in bulk. A policy that says the owner reviews the reconciliation monthly means little if twelve reconciliations carry the same signing date. Look for the evidence, not the policy.
Warning signs to check
- Signatures in batches. Several months of reconciliations signed on one day suggest the review happened only when someone asked.
- Approvals after payment. An invoice approved two days after the payment cleared was not approved before it left.
- Shared tokens. If two people use one bank token, dual approval is one person approving twice.
- Old reconciling items. Outstanding checks or deposits in transit older than a few months, with no notes, mean nobody is reading the list.
- Users who left. Former staff still on the online banking user list or the signature card.
- Unexplained overrides. Payments released by the administrator role outside the normal approval path.
Testing your own controls
Pick one month and follow it through. Take three deposits from the bank statement and trace each to the receipt log. Take three payments and find the approval that came before them. Open the bank's user list and compare it to staff. If any step fails, the control needs fixing before it needs documenting.
When to ask for help
If the tests turn up a payment nobody can explain, stop treating it as a control question. Preserve the statements and records, limit who knows, and get an accountant who does this work to look at it before anyone confronts the person involved.
When you are ready to put the bank side of this review on a steady footing, you can get started with PreciseBankFlow and bring a month of statements to test.