Internal Controls 

Accounting is not only recording, paying invoice, receiving money, and preparing financial reports. Accounting system should include internal controls to ensure the financial assertions and reliability of financial reporting. Therefore, we would like to explain the major controls over cash and cash equivalent as follow.

Committee of Sponsoring Organizations of the Treadway Commission (COSO) developed the integrated framework control that consists five interrelated and equally important components:

1)      Control environment

2)      Risk assessment

3)      Control activities

4)      Information & communication

5)      Monitoring

For more detailed explanation of those five components for cash, please see below:


Cash control environment

A control environment is also necessary. It is an environment that supports ethical values and business practices. Management is responsible for "setting the tone" for their areas and encouraging the highest levels of integrity and ethical behavior.

The followings are examples for encouraging ethical behavior:

·         Codes of Conduct exist and are comprehensive

·         Communicate to employees that fraud and conflicts of interest will not be tolerated.

·         Communicate to employees that Company policies and procedures are important and will be followed.

·         Make employees fully aware of their responsibilities, including internal controls.

·         Monitor the internal controls system on an on-going basis.

·         All employees within senior management and the finance function, as well as other employees in certain areas with increased risks for fraud and misconduct are required to sign a Code of Conduct confirmation annually as a part of their annual review.

·         The Code of Conduct is readily available on the Company’s intranet

Determine that management establishes appropriate policies and guidance towards overriding internal controls and communicates this both in words and deeds

Risk Assessment for cash 

 Financial management risk assessments that are related to cash transactions and balances include the following

1)      blank checks, checks to bearer and void checks may be paid to unauthorized person or unauthorized purpose

2)      Fictitious checkbook requests may be printed by bank to issue unauthorized payments

3)      Duplication of payments may be occurred

4)      Payments may be made to unauthorized people.

5)      Cash receipts may be recorded to wrong account.

6)      Cash sales may not be registered.

7)      Bank accounts may be unexpectedly overdrafted

8)      Cash balances may be exposed to lapping, skimming, kiting or larency.

Disability to maintain availability of important supplies or meet cash requirements for purchases


Control Activities

In the component of control activities, we need to select and develop control activities, general controls over technology and deploy through policies and procedures.

Cash Receipt Controls 


1- Cash staff/Cashier should take their vacation mandatory to improves the chances of detecting fraud.

2- For big Companies and large organizational structure, the cash receipt and cash disbursement should be segregated to reduce the risk of fraud.

3- Checks should be deposited into the bank within specific narrow period of time to reduce the risk of altering or stealing the checks.

4- Access to cash receipt should be restricted and authorized to specific people only.

5- Statements of Accounts should be submitted periodically to the customers to confirm the correctness and detecting any error or fraud on time.

6- Sales Department should be responsible in maintaining cash sales register and accounts receivables collections register should be maintained properly.

7- Cash refund must be authorized by specific manager and in specific cases.

8- All cash received should be maintained in company's safe before depositing it to the bank.

9- Company's safe should be visible and monitored by camera 24 hours



1.  Restrictive endorsement of checks immediately on receipt is preventive control to achieve completeness assertion.

2.  Independent check of agreement of remittances advises with bank register is detective control to achieve Existence/Occurrence, Completeness and Valuation/Allocation assertions

3.  Independent agreement of deposit slip with daily cash records is detective control for existence/occurrence, completeness and valuation/allocation assertions.

4.  Computer agreement of amounts journalized and posted with daily cash summary is detective control for completeness, valuation/allocation and  presentation/disclosure

5.  Preparation of periodic independent bank reconciliations is detective control for Existence/occurrence, completeness, ownership, valuation/allocation and presentation/disclosure.

6.  All cash is deposited intact daily is preventive control for completeness and existence/occurrence.

7.  Monthly statements sent to customers to assure the failure of record payments or invoices is detective control to achieve existence/occurrence, completeness, valuation/allocation and presentation/disclosure assertions. 

  Cash Disbursement Controls


1- In large Company, nobody in accounts payable should be authorized to sign checks or approve transfers or authorise payments

2- Authorization limit for authorizing payments should be applied for individual transactions.

3- The checks/transfers should be signed/approved by two person depends on the risk the Company evaluates it and the size of Company.

4- Check signers should be insured for the fidelity

5- Check signers must not sign on blank checks or blank tranfer documents

6- Invalid checks should be voided properly by crossing X on checks or stamp "Invalid" on it.

7- In large Company, the cash disbursement function and bank reconciliation should be segregated.

8- Manual approval and signatures should be on checks/payment vouchers/Invoices if the payment exceed specific amount.

9- Electronic payments should be protected by proper system security such as password access, authorized access, recording the transaction orginator and date of orignating, and history of login.

10- Payments through cash should be authorized for expenditures up to specific amount. And Any payment exceed that amount, it should be paid through bank transfer or check.



1.     Checking prenumbered check series is detective control for completeness

2.     Comparing the total on the bank register with the total vouchers submitted for payment is preventive control for completeness

3.     Comparing the total on invoices with the total voucher submitted for payment is detective control for completeness

4.     Blank check is maintained in the safe is preventive control for completeness

5.     Generating report for outstanding invoices and outstanding PO is detective control over completeness

6.     Run-to-Run totals compare beginning cash, less cash disbursements, with ending cash balance as well as beginning accounts payable less disbursements with ending accounts payable is detective control for completeness

7.     Comparing check information with purchase order issued prior to receipt of goods or service and receiving information or other authorization is detective control for existence/occurrence and ownership

8.     Payment voucher has unique number that cannot be reused (Prenumbered) is detective control for existence

9.     Comparing check information with related voucher information is detective control for existence/occurrence and ownership

10.   Computer identifying any discrepancies between vendor’s payment details in vendor master and payment voucher before printing payment voucher is preventive control for valuation assertion

11.   Bank reconciliation is prepared by independent person is detective control for Existence/occurrence, completeness, valuation/allocation and presentation/disclosure.

12.   Computer system maintained automatic record for each transaction which identifies the person who entered the transactions and the time of the transactions is detective control

13.   Computer system is restricted by password and device authorization tables is preventive control that achieve completeness and valuation

14.   Segregation of duties designed between several duties as the below segregation of duties matrix is preventive control for completeness, existence/occurrence, valuation/allocation and presentation/disclosure.

15.   Treasury Department/Cash Disbursement Department ascertains that proper support exists for the voucher and check before signing the check is detective control for achieving existence/occurrence and ownership assertions

16.   Two signatures may be required for checks is preventive controls for existence/occurrence and valuation/allocation assertions

17.   Treasury/Cash Disbursements Department cancels payment documents to prevent their use as support for duplicate vouchers and checks is preventive control to achieve existence/occurrence and valuation/allocation assertions

Cash Balances Controls 

1.       Performing physical count for cash on hand on frequent basis is detective control for existence assertion

2.       Performing surprise physical cash count for cash Performing physical count for cash on hand on frequent basis is detective control for existence assertion

3.      Investigation on and reconcile the variances identified between cash count and amount recorded in the books and Identifying the type of discrepancies of cash either it is normal or abnormal is detective control for existence.

4.      Preparing the proper adjustment for the discrepancies of cash based on Company’s policy is detective control for existence, completeness, ownership, valuation and presentation.

5.      Cashier should take vacation during the year or jobs should be temporary rotated between employees during the year is detective control for existence assertion.

The below table is an example documents that should a company have to be in compliance with COSO framework, it is to link between the financial assertions and type of control that is prevent or detect the risk and whether the error/omission is intentional or unintentional and the internal audit tests

Control Matrix in word document


The accounting system should allow relevant information of cash to be easily and economically communicated to internal and external information users. 

Management should determine which frequent information its need to obtain and in which format, this information is covered in management accounting, the below example of cash information are used internally for different purposes.

- Cash Forecasting Sheet which is used by the controller and it is important to predict the liquidity of the company and to enable the management to take the proper decision to fund this operating or investments and to enable the management to change several policies (such as credit sales, prompt payment/cash discount, receivables collections, credit purchases)

- bank reconciliation, is used to identify the different between bank's records and company's records and detect any error or fraud which is reviewed internal audit or external audit.

- physical count sheet, is used to prove the physical availability of cash to detect any error of fraud, this sheet can be communicated to internal auditors, external auditors, accountant or accounting managers.

Accounting system should predict the needs of external users (lenders, creditors, investors) to communicate cash information easily and economically, cash analysis and cash budget and cash disclosures in financial statements can be used externally.


Internal Audit should evaluate the internal controls systems and communicate the deficiencies to the appropriate levels of Company. Also, when the external auditors evaluate the internal controls and communicate the deficiencies in the management letter with recommendations. The management should take the evaluation and recommendations seriously. 
If there is no internal audit department, the accountant of the Company should evaluate and communicate the deficiencies to the appropriate level of management.

Management should evaluate the risk of ignoring the deficiencies, establishing compensating  controls or redesigning the internal controls because not all the deficiency has significant risks, the more the risk is, the more serious action should the management take to mitigate the risks. Petty Cash may not have significant total risks but some Companies may use the petty cash as minibank which contain huge amount of dollars that are paid through petty cash or huge amount of transactions which change the total risk from low level to high level.

Internal Controls Checklist for cash transactions and balances 

 The following questions reflect common internal controls over cash transactions and balances. Our readers may wish to use this list to review or evaluate their own internal controls and determine which areas require further action.

  1. Are all disbursements, except those from petty cash, made by pre-numbered checks?
  2. Are all disbursements, except those from petty cash, made by pre-numbered Payment Vouchers?
  3. Are voided checks preserved and filed after appropriate mutilation?
  4. Is there a written prohibition against drawing checks payable to bearer?
  5. Is there a written prohibition against signing checks in advance without receiving invoice, signing contract or PO stated that payment should be in advance?
  6. Is a Payment voucher prepared for each invoice or request for reimbursement that details the date of check, check number, payee, amount of check, description of expense account amount to be charged, authorization signature, and accompanying receipts?
  7. Are all expenditures approved in advance by authorized persons before typing or writing on checks?
  8. Are signed checks submitted to supplier promptly?
  9. Does the check signer review the payment voucher for the proper approved authorization and supporting documentation of expenses?
  10. Are invoices and supporting documents marked Paid after signing the checks?
  11. Are requests for payments and other invoices checked for mathematical accuracy and reasonableness before approval?
  12. Is a payment journal prepared monthly that details the date of check, check number, payee, amount of check, and columnar description of expense account?
  13. Is check-signing authority vested in persons at appropriately high levels in the organization?
  14. Are the numbers of authorized signatures limited to the minimum practical number?
  15. Are duties of AP invoice process, AP payments, custody of cash, PO releasing or updating and AP invoices and payments posting are properly segregated?
  16. Do checks require two signatures?
  17. Are bank statements and canceled checks received and reconciled by a person independent of the authorization and check signing function?
  18. Are unpaid invoices maintained in an unpaid invoice file or invoices tracking register?
  19. Is a list of unpaid or outstanding invoices regularly prepared and periodically reviewed?
  20. Are invoices from unfamiliar or unusual vendors reviewed and approved for payment by authorized personnel who are independent of the invoice processing function?
  21. Is the vendor setup by independent person other than the person who process the payment?
  22. Is vendor master file not accessible to any person? And any changes in vendor master file should be documented and made by authorized person and reviewed by another?
  23. Is the vendor verified per OFAC regulations?
  24. If the organization keeps an accounts payable register, are payments promptly recorded in the register to avoid double payment?
  25. If purchase orders are used, are pre-numbered purchase orders?
  26. If the purchase orders are issued in-facts or prior to receipt of the goods or service?
  27. Are advance payments to vendors and/or employees recorded as receivables and controlled in a manner which assures that they will be offset against invoices or expense vouchers?
  28. Are employees required to submit expense reports for all travel related expenses on a timely basis?
  29. Is cash count performed frequently?
  30. Is surprise cash count performed during a year?
  31. Does cashier take vacation or Is there job rotation from time to time in your department?
  32. Is there any discrepancies identified in cash balances during cashier’s vacation or rotation?

If most of your answer of the above checklist is “Yes” means that your organizations have effective internal controls over cash transactions and balances, but if most of your answers are “No”, and your organization is medium or large, means, that your organizations need to be improved.


Back                                                                                                                                                              Next