Testing Bank Reconciliation Controls: Design and Operation

Testing bank reconciliation controls takes two passes. A design walkthrough follows one month from statement to sign-off to see whether the control, done as described, would catch an error. An operating effectiveness test then samples months across the period to show it was done that way every time, by the right people, with evidence a reviewer actually looked.

What a bank reconciliation control claims to do

A bank reconciliation control is a written statement of who reconciles which accounts, how often, by when, and who reviews the result. You cannot test a control that only says "bank accounts are reconciled monthly," because there is nothing specific to check. Rewrite it first so each part can be observed.

A testable control description answers six questions:

1. Which accounts? All operating, payroll, savings and merchant accounts, listed by name or number.
2. How often? Monthly, or more often for high-volume accounts.
3. By when? For example, within ten business days of month end.
4. Who prepares? A named role that has no authority to release payments.
5. Who reviews, and what do they look at? The reviewer's checks, such as agreeing the bank balance to the statement and investigating items older than 60 days.
6. What evidence is left? Preparer and reviewer sign-off with dates, and notes on items followed up.

An example control statement

"The staff accountant reconciles each bank account listed in the account inventory within ten business days of month end. The controller reviews each reconciliation, agrees the bank balance to the statement and the book balance to the general ledger, investigates reconciling items older than 60 days, and signs and dates the reconciliation." The figures in that statement are examples. Each clause is now something a tester can look for.

Write down the risk the control addresses next to it. For a bank reconciliation, the risk is usually that cash in the ledger does not exist or is misstated, and that errors or unauthorized transactions go undetected. That link decides how strict the test needs to be.

Savings and reserve accounts are often left off the control because they rarely move. Include them. Low-activity accounts are where an unreviewed withdrawal can sit unnoticed, and reconciling a savings account each month covers what that short reconciliation should still check.

Walkthrough: testing the design of a bank reconciliation control

A walkthrough tests design by following one actual reconciliation from start to finish. Pick a recent month and one account, then trace the bank statement, the ledger report, the reconciliation and the review, asking the preparer and reviewer what they did at each point. The question is whether the steps, done as described, would catch a real error.

Walkthrough steps

1. Obtain the bank statement directly from the bank portal or the bank, not only the copy in the reconciliation file.
2. Agree the statement balance on the reconciliation to the statement.
3. Agree the book balance to the general ledger trial balance for the same date.
4. Read the list of reconciling items. Note any that are old, round, unusual or unexplained.
5. Ask the preparer how they built the list and what they do with items they cannot explain.
6. Ask the reviewer what they checked before signing, and look at the evidence that they did it.
7. Check timing. Compare the sign-off dates with the deadline in the control description.
8. Check access. Confirm the preparer cannot release payments in the bank portal.

Design weaknesses walkthroughs often find

• The preparer can also initiate or release payments, so the reconciliation can conceal what the preparer did.
• The reconciliation starts from a statement balance typed in by the preparer, with no check against an independent copy.
• No rule says what happens to old reconciling items, so they roll forward forever.
• The reviewer only checks that the reconciliation balances, not what the reconciling items are.

A design weakness means there is no point testing operation yet. Report it and test again once the control is fixed.

How many bank reconciliations should an operating effectiveness sample include?

An operating effectiveness sample is a set of reconciliations from across the period that you check against every part of the control description. Your firm's methodology sets the number. Because a monthly control has only twelve occurrences per account per year, samples are small, and they should spread across the year and across accounts.

Choose the sample to cover the risk, not just the count:

• Spread across the period, including at least one month from each quarter and the year-end month.
• Include more than one account if the entity has several, with weight on the highest-volume or highest-risk ones.
• Include a month when the usual preparer or reviewer was away, since cover periods are when controls often break.
• Pick the months yourself, rather than letting the client hand you the files they choose.

Attributes to test for each sampled reconciliation

Each part of the control description becomes an attribute that passes or fails. The test sheet below is an example for one account over twelve months, with four months sampled. The results are made up.

May and August each contain a deviation. Write each one up separately: what the attribute required, what you found, and who you discussed it with. In this example, August is the more serious finding, because a review signed before preparation cannot be a real review.

Review evidence that shows a bank reconciliation was actually checked

Review evidence is what separates a review that happened from a signature on a page. A reviewer's initials prove only that someone initialled. Stronger evidence shows the reviewer engaged with the content: questions asked, items followed up, corrections made, or tickmarks against the statement and ledger.

Look for signs that the reviewer read the reconciliation:

• Notes or queries on specific reconciling items, with the preparer's response.
• Tickmarks against the bank balance and ledger balance showing they were agreed.
• Follow-up on old items, such as a note that an old outstanding check was voided or researched.
• Sign-off dates after preparation, and within the deadline.
• Changes made after review, which show the review found something.

A reviewer who has signed every reconciliation for a year without a single note may be doing a thorough job, or may not be looking. Ask the reviewer to walk you through one reconciliation they signed and explain what they checked. The answer usually settles it.

What a sign-off must contain to count as evidence, and how it should be recorded on paper and in software, is the subject of bank reconciliation sign off: evidence that counts. Reconciliations produced by software can carry better evidence than paper, because an exception report lists each difference with its source line. PreciseBankFlow produces that kind of report for each bank statement; the features list shows what it records.

How do you grade a bank reconciliation control that failed?

Grading a failed bank reconciliation control means deciding how serious the deviation is. Ask what could go wrong because the control did not work, how large it could be, and whether another control would catch it. The answer places the failure on a scale from deficiency to material weakness.

For SEC registrants, the scale has formal definitions. The SEC's definitions in 17 CFR 240.12b-2, published by Cornell's Legal Information Institute, describe a material weakness as a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. The significant deficiency below it, and the findings that most often earn each grade, are covered under SOX cash control deficiencies testers find most often. Private companies and nonprofits often borrow the same terms when reporting to a board.

Questions to grade the example deviations

Using the example test sheet above:

• What could the failure miss? In August, a review signed before preparation means nobody checked that month's reconciling items. Any error or unauthorized payment that month would have passed.
• How large could it be? Look at the account's activity. A payroll account moving large sums each month carries more potential misstatement than a petty cash account.
• Is there a compensating control? An owner who reviews every bank statement line, or a separate review of payments, may reduce the severity.
• Is it isolated or a pattern? One late reconciliation in a year differs from reviews routinely signed in advance.

In May, two old items had no note, but the rest of the review was evidenced. That points to a deficiency in how thoroughly old items are followed up. In August, the review evidence is not credible, which calls into question every review the same person signed. Expand the sample for that reviewer before you decide the grade.

Smaller organizations often rely on a volunteer treasurer or board member as reviewer, which changes what is realistic. Nonprofit cash controls with volunteers and a board covers how the review can still be evidenced.

When re-performing bank reconciliations beats testing the control

Re-performing a bank reconciliation means building it yourself from the bank statement and ledger, without relying on the client's work. It is the better route when the control has failed, when the entity is small and the control is informal, or when you need evidence about the cash balance rather than about the control.

Re-perform instead of, or as well as, testing the control when:

• The control failed design testing, so operating effectiveness cannot be relied on.
• The entity has only a few accounts, and rebuilding each year-end reconciliation takes less time than sampling and documenting a control test.
• Fraud is suspected, because you need to see the transactions, not whether a review took place.
• The year-end month is unusual, such as a month with a system change or many large reconciling items.

Re-performance tests the balance, not the process. It shows that cash was right at a date, but it says nothing about whether the same control will work next month. When the audit relies on controls, keep both: test the control across the year, and re-perform the year-end reconciliation as a substantive check.