Cash, Bank Reconciliation and Internal Control

Introduction

Cash is the most liquid asset and the resource most immediately exposed to error, theft, misuse, and cyberattack. For this reason, accounting for cash involves more than recording receipts and payments. It requires clear definitions, appropriate classification, periodic reconciliation, physical and digital safeguards, and a system of internal control that assigns responsibility and creates reliable evidence.

In banking, finance, and insurance organizations, cash management is especially important. A bank must maintain liquidity while protecting depositors’ funds; an insurer must be able to settle claims; and every organization must ensure that recorded cash agrees with independent evidence such as bank statements, payment-platform records, and cash counts.

This chapter explains cash and cash equivalents, accounting for bank transactions, bank reconciliation, petty cash, internal control, fraud risk, cybersecurity, and relevant control frameworks.

Learning Objectives

By the end of this chapter, you should be able to:

1. Define and classify cash and cash equivalents.
2. Record common cash and bank transactions.
3. Prepare and interpret a bank reconciliation.
4. Establish and account for a petty-cash fund.
5. Explain authorization, segregation of duties, custody, and documentation.
6. Evaluate fraud, cyber, and operational risks affecting cash.
7. Apply internal-control frameworks to cash-management processes.
8. Recommend improvements to a weak cash-control system.

1. Meaning and Classification of Cash

Cash includes currency, coins, notes, demand deposits, and other funds immediately available for payment. A bank balance is normally an asset when the entity has a positive balance. A bank overdraft may be a liability, although accounting treatment can depend on the applicable reporting framework and whether the overdraft is repayable on demand and forms an integral part of cash management.

Cash equivalents are short-term, highly liquid investments that can be readily converted into known amounts of cash and are subject to an insignificant risk of changes in value. Normally, an investment qualifies only when acquired with a very short remaining maturity, commonly about three months or less, although the governing accounting standard must be consulted.

Examples may include treasury bills or money-market instruments meeting the required criteria. Shares and longer-term investments generally do not qualify merely because they can be sold quickly. Liquidity alone is insufficient; the investment must also have a stable and predictable cash value and minimal market-risk exposure.

Restricted cash should be separately identified when it cannot be used for normal operating purposes, such as a deposit pledged to a lender or held for a particular regulatory requirement. Classification affects liquidity analysis and the interpretation of the statement of financial position and cash-flow statement.

2. The Cash-Recording System

Cash transactions enter the accounting system through several channels: cash receipts, bank transfers, card settlements, electronic payment systems, cheques, standing orders, direct debits, and automated clearing systems. A sound system records transactions promptly and preserves an audit trail.

The basic accounting identity is:

Here, beginning cash and ending cash are balances for a specified period, while receipts, payments, and adjustments are measured in the same currency and period. The identity is a control relationship, not a substitute for detailed transaction records. It should reconcile to the ledger and, after adjustments, to independent bank evidence.

Typical entries include:

• Receipt from a customer: debit Cash and credit Accounts Receivable or Revenue, depending on the transaction.
• Payment to a supplier: debit Accounts Payable or an expense/asset account and credit Cash.
• Bank charges: debit Bank Charges Expense and credit Cash.
• Interest credited by the bank: debit Cash and credit Interest Income.
• Dishonoured customer cheque: debit Accounts Receivable and credit Cash.

The correct debit or credit depends on whether the transaction increases or decreases the entity’s cash. A cash-receipts journal and cash-payments journal may be used in a manual system, while an enterprise resource planning system may integrate cash with sales, purchasing, payroll, and treasury modules.

3. Bank Reconciliation

A bank reconciliation compares the balance in the entity’s cash ledger with the balance shown on the bank statement and explains differences. It is usually prepared monthly, but high-risk or high-volume organizations may reconcile daily.

Differences arise because:

• deposits recorded by the entity have not yet been credited by the bank;
• cheques or electronic payments issued by the entity have not yet cleared;
• the bank has recorded charges, interest, or direct debits not yet entered in the ledger;
• the entity has recorded an error;
• the bank has made an error; or
• a transaction is fraudulent or unauthorized.

A reconciliation is not merely a clerical exercise. It is an independent review of the completeness, accuracy, existence, and authorization of cash transactions.

3.1 Two Reconciliation Perspectives

The bank-statement balance is adjusted for timing differences and bank errors. The ledger balance is adjusted for items known by the bank but not yet recorded by the entity, together with entity errors. After all valid adjustments, both adjusted balances should agree.

A common format is:

The signs depend on the nature of the item. A deposit in transit increases the bank-side balance because the bank has not yet included a deposit already recorded by the entity. An outstanding payment decreases the bank-side balance because the entity has recorded a payment that the bank has not yet processed. Bank charges reduce the book-side balance and require a journal entry.

3.2 Worked Example: Bank Reconciliation

Illustrative facts for 31 March:

• Balance per bank statement: CU 18,420.
• Deposits in transit: CU 2,750.
• Outstanding cheques and electronic payments: CU 3,180.
• Bank service charge not recorded in the ledger: CU 95.
• Interest credited by the bank but not recorded: CU 40.
• A customer cheque of CU 600 was dishonoured and not yet recorded.
• The ledger cash balance before adjustment: CU 17,995.

The bank-side calculation is:

The book-side calculation is:

The two sides do not agree. Investigation identifies a bank error: the bank incorrectly charged the entity’s account CU 650 for another customer’s payment. Because the bank-side balance is therefore understated by CU 650:

This still does not agree with CU 17,340, so the reconciliation must not be accepted. Further investigation is required. This example illustrates an essential professional principle: a reconciliation is complete only when both adjusted balances agree; unexplained differences must never be forced into a suspense account without investigation.

Suppose instead that the bank error was CU 650 in the opposite direction and the ledger included an omitted payment of CU 1,300. The adjusted ledger would become CU 16,040, and the bank-side balance would need to be corrected appropriately. The exact resolution depends on documentary evidence. A preparer must inspect deposit slips, payment confirmations, returned items, bank correspondence, and transaction-level records rather than manipulate figures to produce agreement.

3.3 Reconciliation Procedure

A robust monthly procedure is:

1. Obtain the bank statement directly from the bank or a secure system.
2. Confirm the opening balance agrees with the prior approved reconciliation.
3. Match deposits and payments from the ledger to bank transactions.
4. List legitimate timing differences.
5. Identify bank-originated transactions not in the ledger.
6. Investigate unusual, duplicate, reversed, or unauthorized items.
7. Record required journal entries.
8. Recalculate the reconciliation independently.
9. Obtain review and approval from a responsible person.
10. Retain the reconciliation and supporting evidence.

The preparer should not be the sole person able to create, approve, and release payments. Independent review is particularly important where reconciliations are prepared using spreadsheets, because formula changes, hidden rows, and overwritten balances can conceal errors.

4. Petty Cash

Petty cash is a small fund used for minor, frequent payments such as local transport, postage, or low-value office supplies. It should not be used to bypass normal procurement or approval procedures.

4.1 Imprest System

Under an imprest system, the fund is established at a fixed amount. A custodian holds cash and supporting vouchers. At replenishment, the amount paid back normally equals the total of authorized vouchers and documented expenses, adjusted for any shortage or overage.

A simpler control equation, when there is no shortage or overage, is:

Each term must be measured in the same currency at the time of the count. The fund should be counted unexpectedly from time to time.

4.2 Example

A petty-cash fund is CU 500. At month-end, the custodian has CU 142 in cash and vouchers for office supplies CU 210, transport CU 96, and postage CU 48.

The difference is CU 4. Since the total is less than the authorized fund, there is a CU 4 shortage. Replenishment to restore the fund to CU 500 is CU 358, comprising CU 354 of documented expenses and CU 4 charged to cash shortage expense. If the total had exceeded CU 500, the excess would be recorded as a cash overage or other appropriate account according to policy.

Petty-cash vouchers should show date, purpose, amount, recipient, account classification, authorization, and evidence such as a receipt. The custodian should not approve their own claims.

5. Internal Control over Cash

Internal control is the process designed and operated by those charged with governance, management, and employees to provide reasonable—not absolute—assurance regarding reliable reporting, effective operations, safeguarding of assets, and compliance with laws and policies.

A widely used framework is the COSO model, which organizes internal control into five interrelated components:

1. Control environment.
2. Risk assessment.
3. Control activities.
4. Information and communication.
5. Monitoring activities.

The framework does not guarantee that fraud will never occur. Controls can fail because of collusion, management override, human error, poor design, or technological compromise.

5.1 Core Cash-Control Principles

Authorization. Payments should be approved by persons with appropriate authority. Approval limits should reflect risk and position. A transaction should not be approved solely because it is urgent.

Segregation of duties. Different individuals should, where practicable, authorize transactions, record them, hold cash or payment credentials, and reconcile accounts. In a small organization, compensating controls such as owner review, independent bank alerts, and frequent surprise counts are necessary.

Custody. Physical cash should be secured in a locked location with restricted access. Digital payment credentials, tokens, encryption keys, and administrator privileges are also forms of custody.

Documentation. Every receipt and payment should be supported by an invoice, receipt, contract, approval, or electronic confirmation. Missing documentation is a warning sign, not a minor administrative defect.

Independent reconciliation. The person who handles daily receipts or releases payments should not be the only person reconciling the bank account.

Rotation and leave. Mandatory leave and rotation can expose concealed irregularities because another employee performs the process.

Physical verification. Cash counts, deposit verification, and confirmation of bank balances provide evidence independent of the ledger.

5.2 Preventive, Detective, and Corrective Controls

A strong control system combines all three. For example, payment authorization prevents some unauthorized payments; bank reconciliation detects payments that escaped authorization; and incident response, recovery, and disciplinary action correct the consequences.

6. Fraud and Misappropriation Risks

Cash fraud may involve theft of physical cash, fictitious suppliers, altered payment instructions, duplicate invoices, unauthorized refunds, payroll manipulation, cheque interception, or diversion of customer receipts. The fraud triangle identifies three common conditions: pressure, opportunity, and rationalization. A fourth factor often discussed in practice is capability—the ability to exploit a weakness.

Warning indicators include unexplained reconciling items, frequent voids, excessive refunds, payments just below approval thresholds, changes to supplier bank details, missing receipts, unusual activity outside normal hours, and employees resisting leave or independent review.

A fraud-risk assessment should identify:

• the asset or process at risk;
• possible fraud schemes;
• people and systems with access;
• likelihood and impact;
• existing controls;
• residual risk; and
• actions, owners, and deadlines.

Controls must be proportionate. Excessive approval layers may encourage employees to bypass procedures, while weak controls expose the organization to preventable loss. A whistleblowing channel, protection against retaliation, investigation protocols, and clear consequences support an ethical control environment.

7. Cybersecurity and Digital Cash Controls

Modern cash management depends heavily on online banking, enterprise systems, mobile devices, payment gateways, application programming interfaces, and cloud services. Consequently, cash controls must address both accounting risk and information-security risk.

Important safeguards include:

• multi-factor authentication;
• least-privilege access;
• separate user accounts rather than shared credentials;
• dual control for beneficiary creation and payment release;
• independent verification of changes to supplier bank details;
• transaction and velocity limits;
• encryption in transit and at rest;
• secure backups and tested recovery procedures;
• patching and endpoint protection;
• monitoring of privileged-user activity;
• phishing awareness and simulated exercises; and
• formal incident-response procedures.

Business email compromise is particularly dangerous. An attacker may impersonate an executive or supplier and request an urgent change to payment details. The correct control is not merely to inspect the email address. Staff should verify the request through a trusted, independently obtained telephone number or secure channel, and sensitive changes should require separate approval.

Artificial intelligence can assist with anomaly detection, duplicate-payment analysis, unusual timing analysis, and prioritization of transactions for review. However, AI outputs are not proof of fraud. Models may produce false positives, miss novel schemes, reflect biased training data, or be manipulated by contaminated data. Human review, explainability, access governance, and documented escalation remain necessary.

8. Application to Banking, Finance, and Insurance

In a bank, cash control extends beyond physical notes to teller balances, vault cash, ATM cash, settlement accounts, nostro and vostro accounts, central-bank balances, and payment-system positions. Reconciliations may occur several times per day. Exceptions should be aged, assigned, and escalated.

In insurance, premiums received, claims payments, broker balances, and trust or client monies require clear segregation. Mixing customer funds with operating cash can create legal, regulatory, and reputational consequences.

In finance companies and investment businesses, client-money rules may require separate bank accounts, daily reconciliations, independent confirmations, and restrictions on withdrawals. The institution must understand applicable laws and regulator-specific requirements rather than rely solely on general accounting practice.

Liquidity management also matters. An organization can report a positive accounting cash balance and still be unable to meet immediate obligations if funds are restricted, concentrated in one institution, or unavailable in the required currency. Cash-flow forecasts, stress testing, counterparty limits, and contingency funding plans complement accounting controls.

9. Illustrative Case: Meridian Insurance Services

Background. Meridian Insurance Services receives premiums through bank transfers, card settlements, brokers, and cash at three branches. The finance officer prepares monthly bank reconciliations, creates suppliers, and can release payments after a manager’s email approval.

Problem. An internal review found that reconciliations were two months late. Several deposits were recorded as “unidentified receipts.” A claims payment was sent to a bank account changed through an email request. The organization had no independent review of supplier-master changes.

Analysis. The arrangement created excessive concentration of duties. The finance officer could record receipts, create or alter beneficiary information, prepare reconciliations, and influence payment release. Late reconciliations weakened the detective control, while email-only approval created a cyber-fraud vulnerability. Unidentified receipts also risked inaccurate premium records and customer disputes.

Approach. Meridian introduced the following measures:

1. Daily automated import of bank transactions.
2. Independent review of reconciliations within five working days.
3. Separate roles for supplier creation, payment preparation, approval, and release.
4. Dual approval for changes to bank details.
5. Call-back verification using existing customer or broker records.
6. Aged exception reports for unidentified receipts.
7. Mandatory leave and quarterly surprise reviews.
8. Multi-factor authentication and privileged-access monitoring.
9. Staff training on phishing and social engineering.

Outcome. The new process reduced unreconciled items, improved the allocation of premiums, and prevented payment-detail changes based solely on email. More importantly, management obtained evidence that controls were operating rather than merely existing in policy documents.

Learning points. Effective control is a system. A strong password cannot compensate for poor segregation of duties, and a bank reconciliation cannot compensate for missing authorization. Accounting accuracy, operational design, cybersecurity, and ethical culture must work together.

10. Limitations and Professional Judgment

No control system is perfect. Small entities may lack sufficient staff for complete segregation. Automated controls may be incorrectly configured. Bank feeds may omit transactions during outages. Reconciliations may create false confidence if reviewers merely sign them without examining evidence. Cash equivalents may be misclassified when management focuses on liquidity but ignores maturity and market-risk criteria.

Professional judgment is therefore required. Accountants should document assumptions, consult the applicable financial-reporting standards, evaluate materiality and risk, and escalate unresolved issues. A reconciling item that is small in amount may still be significant if it indicates fraud, a systemic error, or regulatory noncompliance.

Best-Practice Checklist

• Define cash, cash equivalents, and restricted cash consistently.
• Record receipts and payments promptly.
• Deposit collections intact and without unauthorized deductions.
• Use documented approval limits.
• Separate authorization, recording, custody, and reconciliation.
• Reconcile bank accounts promptly and independently.
• Investigate every unexplained difference.
• Maintain a controlled petty-cash imprest fund.
• Protect physical cash and digital payment credentials.
• Verify changes to beneficiary details independently.
• Monitor exceptions, reversals, refunds, and unusual transactions.
• Test controls periodically and remediate weaknesses.
• Align procedures with applicable accounting, legal, regulatory, and data-protection requirements.

Chapter Summary

Cash is the most liquid asset and requires especially strong safeguards. Cash equivalents are short-term, highly liquid investments that can be converted into known amounts of cash with insignificant risk of value change. Bank reconciliations compare the ledger with independent bank evidence, distinguish timing differences from errors, generate journal entries for bank-originated items, and require investigation of all unexplained differences.

Petty cash is best managed through a fixed imprest system supported by vouchers, authorization, custody, and surprise counts. Internal control over cash depends on authorization, segregation of duties, documentation, independent reconciliation, physical security, and monitoring. COSO’s five components—control environment, risk assessment, control activities, information and communication, and monitoring—provide a useful framework for evaluating control design and operation.

Modern cash control must include cybersecurity. Multi-factor authentication, least privilege, dual authorization, independent verification of payment-detail changes, anomaly monitoring, and tested incident response reduce digital-payment risk. In banking, finance, and insurance, cash control also includes customer funds, settlement accounts, liquidity, regulatory compliance, and reliable exception management.

Key Terms

Cash: Currency, coins, and funds immediately available for payment.

Cash equivalent: A short-term, highly liquid investment meeting the required low-risk and maturity criteria.

Restricted cash: Cash unavailable for ordinary use because of legal, contractual, or operational restrictions.

Bank reconciliation: A comparison of the cash ledger with a bank statement to explain differences.

Deposit in transit: A deposit recorded by the entity but not yet credited by the bank.

Outstanding payment: A payment recorded by the entity but not yet cleared by the bank.

Imprest system: A system that maintains a petty-cash fund at a fixed authorized amount.

Petty-cash custodian: The person responsible for holding and administering petty cash.

Segregation of duties: Division of authorization, recording, custody, and review among different people.

Authorization: Approval by a person with appropriate authority.

Custody: Physical or digital control over an asset or access credential.

Control environment: The ethical, governance, and organizational foundation of internal control.

Preventive control: A control designed to stop an error or fraud before it occurs.

Detective control: A control designed to identify an error or fraud after it occurs.

Corrective control: A control designed to remedy consequences and restore proper operation.

Business email compromise: Fraud involving impersonated or compromised email instructions.

Least privilege: Granting users only the access necessary for their duties.

Reconciliation exception: An unexplained or unresolved difference identified during reconciliation.

Cash shortage: A deficiency when verified cash and authorized evidence are less than the fund or recorded amount.

COSO framework: A widely used framework for evaluating internal control through five interrelated components.

Review Questions

Short Answer Questions

1. What characteristics must an investment generally have to qualify as a cash equivalent?
2. Distinguish a deposit in transit from an outstanding payment.
3. Why should bank-originated charges be recorded in the entity’s ledger?
4. What is the purpose of an imprest petty-cash system?
5. State two reasons why segregation of duties reduces cash-fraud risk.

Long Answer Questions

1. Explain the purpose, procedure, and limitations of a bank reconciliation.
2. Discuss the five COSO components and apply each to cash management.
3. Explain how authorization, custody, documentation, and independent review work together.
4. Describe major cybersecurity threats to digital cash management and appropriate controls.
5. Evaluate the advantages and limitations of petty cash in a modern organization.

Analytical / Application Questions

1. A company’s ledger shows CU 25,600. The bank statement shows CU 27,100. Deposits in transit are CU 3,400 and outstanding payments are CU 2,900. Bank charges of CU 120 and interest of CU 70 are not recorded in the ledger. Prepare both adjusted balances and identify any unexplained difference.
2. A finance officer creates suppliers, changes bank details, prepares payments, and performs reconciliations. Evaluate the control weaknesses and design a revised process.
3. An employee receives an urgent email apparently from the chief executive requesting a payment to a new account. Explain the steps required before the payment is released and identify the controls involved.

Multiple Choice Questions with Answers

Question 1

Which item most appropriately qualifies as cash?

A. Ordinary shares held for trading

B. A demand deposit available for withdrawal

C. A six-year corporate bond

D. A restricted deposit pledged to a lender

Correct Answer: B. A demand deposit available for withdrawal

Question 2

A deposit in transit is generally added to which balance in a bank reconciliation?

A. The bank-statement balance

B. The petty-cash balance

C. The expense balance

D. The accounts-receivable balance

Correct Answer: A. The bank-statement balance

Question 3

Which item normally requires an entry in the entity’s accounting records during reconciliation?

A. An outstanding cheque

B. A deposit in transit

C. A bank service charge not yet recorded

D. A timing difference already recorded

Correct Answer: C. A bank service charge not yet recorded

Question 4

A petty-cash fund is CU 300. Cash on hand is CU 84 and authorized vouchers total CU 211. What is the shortage?

A. CU 5

B. CU 11

C. CU 16

D. CU 295

Correct Answer: A. CU 5

Question 5

Which control best represents segregation of duties?

A. One employee approves, records, pays, and reconciles a transaction

B. The cashier keeps all receipts in an unlocked drawer

C. One employee prepares payments while another approves and releases them

D. All employees use one shared banking password

Correct Answer: C. One employee prepares payments while another approves and releases them

Question 6

Which is primarily a detective control?

A. Dual approval before payment release

B. A monthly bank reconciliation

C. A password policy

D. A locked cash safe

Correct Answer: B. A monthly bank reconciliation

Question 7

Which action best addresses a request to change a supplier’s bank details received by email?

A. Accept it if the email uses the executive’s name

B. Verify it through an independently obtained trusted channel

C. Process it immediately if marked urgent

D. Forward it to the supplier using the same email thread only

Correct Answer: B. Verify it through an independently obtained trusted channel

Question 8

Under the basic petty-cash imprest relationship, which equality applies when there is no shortage or overage?

A. Cash on hand minus vouchers equals the fund

B. Cash on hand plus vouchers equals the fund

C. Vouchers minus cash on hand equals revenue

D. Cash on hand plus revenue equals the fund

Correct Answer: B. Cash on hand plus vouchers equals the fund

Question 9

Which COSO component concerns identifying and analyzing threats to achieving objectives?

A. Risk assessment

B. Information and communication

C. Monitoring activities

D. Control environment

Correct Answer: A. Risk assessment

Question 10

Why should an unexplained reconciliation difference not simply be forced into agreement?

A. It may conceal an error, fraud, or systemic control failure

B. It always represents a cash equivalent

C. It automatically increases revenue

D. It eliminates the need for independent review

Correct Answer: A. It may conceal an error, fraud, or systemic control failure