Cash, Reconciliation and Internal Control
Cash, Reconciliation and Internal Control
Cash is easy to transfer, conceal and misclassify. A profitable entity therefore needs both liquidity analysis and transaction-level control.
Cash and cash equivalents
Cash equivalents are short-term, highly liquid investments:
- readily convertible to known cash amounts;
- subject to insignificant value-change risk;
- held to meet short-term cash commitments rather than for investment.
Under IAS 7, maturity of three months or less from acquisition normally supports the classification. “Short-term investment” is not enough by itself.
Northstar bank reconciliation
At 31 December:
Bank side
| £ | |
|---|---|
| Bank statement balance | 52,460 |
| Add: deposit in transit | 4,800 |
| Less: outstanding payments | (3,100) |
| Adjusted bank balance | 54,160 |
Book side
| £ | |
|---|---|
| Cash ledger balance | 54,620 |
| Less: bank fee not recorded | (120) |
| Less: customer payment returned | (540) |
| Add: interest credited by bank | 200 |
| Adjusted book balance | 54,160 |
Only book-side items require Northstar journal entries:
Dr Bank fee expense £120
Cr Cash £120
Dr Trade receivables £540
Cr Cash £540
Dr Cash £200
Cr Interest income £200
Deposits in transit and outstanding payments are timing differences already recorded by Northstar. Investigate old items; do not carry them indefinitely.
Design controls from the failure mode
| Risk | Preventive control | Detective control |
|---|---|---|
| Employee creates and pays a fake supplier | Separate supplier setup, invoice approval and payment release | Independent vendor-master and payment review |
| Customer receipt is diverted | Bank lockbox or controlled electronic collection | Daily bank-to-receivables match |
| Payment file is altered | Dual authorisation and protected bank credentials | Bank alert and post-payment exception review |
| Reconciliation is manipulated | Reconciler cannot handle cash or post entries | Independent approval with evidence of follow-up |
| API or spreadsheet duplicates a payment | Unique transaction IDs and validation rules | Duplicate-payment analytics |
Segregation is not “use more people.” It separates authorisation, custody, recording and review so one person cannot both commit and hide an error.
COSO as a diagnostic, not a checklist recital
| Component | Northstar question |
|---|---|
| Control environment | Do leaders reward accurate reporting or only sales targets? |
| Risk assessment | Which cash and cyber risks could prevent objectives? |
| Control activities | Which approvals, access limits and reconciliations address them? |
| Information and communication | Does the reviewer receive complete, timely evidence? |
| Monitoring | Are exceptions investigated and controls changed when they fail? |
Controls provide reasonable, not absolute, assurance. Collusion, override, poor design and changing systems remain limitations.
2026 control frontier: generative AI
COSO's internal-control resources now include 2026 guidance on generative AI. The five components still apply; the evidence changes. If an accounts-payable assistant proposes a supplier-bank change, Northstar should control who can invoke it, preserve the prompt and source record, test the output against authorised vendor data, require independent approval and log exceptions. A human click is not an effective review unless the reviewer can see what was checked.
Current liquidity issue: supplier finance
Supplier-finance arrangements can make a trade payable look operational while a finance provider pays the supplier early. Amendments to IAS 7 and IFRS 7, effective for annual periods beginning on or after 1 January 2024, require added disclosures about supplier finance arrangements.
For analysis ask:
- what obligations are included and where they are presented;
- payment-term ranges;
- non-cash changes and balance roll-forwards;
- whether longer payment timing is masking financing dependence.
Quick check
Why is a two-person payment approval weak if both approvers share one login?