Cash and internal control

Cash is the most liquid asset and the easiest to steal, lose or misrecord. Every business needs to know exactly how much cash it has, to protect it, and to make sure every receipt and payment is recorded. This lesson introduces internal control, the policies and procedures that protect assets and make records reliable; applies it to cash receipts and payments; explains how cash and cash equivalents are reported; and works through the two classic cash procedures, the bank reconciliation and the petty cash fund. ACCT-240 and ACCT-331 go much deeper into controls and auditing; BUS-310 discusses fraud from a governance perspective.

What internal control is

Internal control is a process, designed and carried out by a business's owners, managers and staff, to provide reasonable assurance that the business achieves its objectives in three areas: effective and efficient operations, reliable reporting, and compliance with laws and regulations. The most widely used framework is the Internal Control—Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), most recently updated in 2013. It describes five components: the control environment (the tone at the top, integrity and competence), risk assessment, control activities, information and communication, and monitoring.

In the United States, the Sarbanes-Oxley Act of 2002, passed after the Enron and WorldCom failures, requires public company management to assess and report on internal control over financial reporting (section 404), and larger public companies must have their auditor attest to that assessment. Private companies have no such requirement, but lenders, insurers and owners still expect sound controls, and auditors assess them.

Control activities

Control activities are the specific practices that prevent or detect errors and fraud. The most important for a small business are these. Establish responsibility: each task, such as handling a cash drawer, is assigned to one person, so problems can be traced. Segregate duties: no single person should both handle an asset and record it, or authorize a transaction and record it, because that combination allows theft to be concealed. Document procedures: use pre-numbered sales receipts, invoices and purchase orders so missing documents are noticed. Apply physical and digital controls: safes, locked cash registers, passwords, two-factor authentication and backups. Perform independent checks: someone who does not handle cash reconciles the bank account, counts petty cash and reviews unusual entries. Rotate duties and require vacations, which brings concealed schemes to light. Bond and screen employees who handle cash.

Every control has a cost, and controls can only give reasonable, not absolute, assurance. Two or more employees can collude to defeat segregation of duties; managers can override controls; and people make mistakes. A tiny business with one or two people cannot fully segregate duties, so the owner's personal involvement, especially reviewing bank statements and signing or approving payments, becomes the key control.

The fraud triangle, developed from the work of criminologist Donald Cressey, explains why fraud happens: a person feels pressure (financial trouble, targets to meet), sees an opportunity (weak controls), and rationalizes the act ('I'll pay it back'). Internal control attacks the opportunity side. Surveys by the Association of Certified Fraud Examiners consistently find that tips from employees, customers and suppliers detect more frauds than any other method, which is why many organizations set up confidential reporting lines.

Controls over cash receipts and payments

For cash receipts, the goal is to record every receipt and deposit it intact. Customers should receive a receipt from a register or point-of-sale system that records the sale; registers are counted against their records at shift end by someone other than the cashier; mail and electronic receipts are listed by one person and recorded by another; and deposits are made daily. Card and electronic payments reduce the risks of handling notes and coins but introduce others, such as refunds processed to an employee's own card, so refunds should require a supervisor's approval.

For cash payments, the goal is to make sure every payment is authorized, for goods or services actually received, and recorded. Payments are made by ACH transfer or check rather than in cash, except small petty cash amounts. A voucher system matches the purchase order, the receiving report and the supplier's invoice before payment is approved (a three-way match). The person who approves payment should not be the person who records it or the one who reconciles the bank. Online banking should require two people to release large payments, and many businesses use the bank's positive pay service, which rejects checks that do not match the business's list of issued checks. Common electronic methods in the US include ACH transfers, wires and services such as Zelle.

Reporting cash

On the balance sheet, cash includes currency, coins, balances in bank accounts and amounts in transit from card processors. Cash equivalents are short-term, highly liquid investments that are readily convertible to known amounts of cash and subject to an insignificant risk of changes in value, generally with maturities of three months or less from the date acquired: treasury bills, money market funds and short-term deposits. Cash and cash equivalents are usually reported as one line. Bank overdrafts that are repayable on demand and form part of cash management may be netted against cash under IFRS and ASPE; otherwise they are reported as liabilities. Cash that is restricted, such as a deposit held as security, is reported separately.

The bank reconciliation

The bank statement and the business's Cash account record the same cash, but rarely show the same balance on a given day. Timing differences arise because the business records some items before the bank does, and the bank records some items before the business knows about them. Errors can also occur on either side. A bank reconciliation explains the difference and identifies entries the business must make. It is one of the most effective controls a small business has, and should be done monthly by someone who does not record cash receipts or payments.

Only the items on the book side require journal entries, because they are things the business has not yet recorded. Items on the bank side will clear on their own when the bank catches up; bank errors are reported to the bank.

# Bank reconciliation for June (illustrative)
bank = 18420
deposits_in_transit = [2150]
outstanding = [1300, 860]
book = 17995
book_adjustments = {
    "Collection by bank (courier)": 1200,
    "Interest earned": 8,
    "Service charge": -45,
    "NSF customer payment": -310,
    "Error: payment recorded 530, actual 350": 180,
    "Duplicate deposit entry": -618,
}
adj_bank = bank + sum(deposits_in_transit) - sum(outstanding)
adj_book = book + sum(book_adjustments.values())
print(f"Adjusted bank balance {adj_bank:,}")
print(f"Adjusted book balance {adj_book:,}")
print("Reconciled" if adj_bank == adj_book else f"Difference {adj_bank - adj_book:,}")
print("Entries needed:")
for item, amt in book_adjustments.items():
    print(f"  {'Dr Cash' if amt > 0 else 'Cr Cash'} {abs(amt):>5,}  {item}")

Adjusted bank balance 18,410
Adjusted book balance 18,410
Reconciled
Entries needed:
  Dr Cash 1,200  Collection by bank (courier)
  Dr Cash     8  Interest earned
  Cr Cash    45  Service charge
  Cr Cash   310  NSF customer payment
  Dr Cash   180  Error: payment recorded 530, actual 350
  Cr Cash   618  Duplicate deposit entry

Look at the NSF (not sufficient funds) entry: the customer's payment bounced, so the receivable is reinstated and the business tries to collect again. Note also that the courier's payment clears the receivable that was accrued in May (lesson 6); no revenue is recorded now.

Petty cash

Small payments such as postage, a courier fee or coffee for a customer event are impractical to pay electronically. A petty cash fund is a small amount of cash, often $100 to $500, kept in a locked box under the responsibility of one custodian. When the fund is set up, Cash is credited and Petty cash debited. Payments are made from the box in exchange for signed receipts. When the fund runs low, and always at period end, it is replenished: the receipts are totaled, expenses are debited, and a payment to the custodian brings the fund back to its set amount. The Petty cash account itself changes only when the fund size is changed. Any shortage or overage is recorded in a Cash over and short account.