# Cash Control Deficiencies Auditors Report Most - Author: PreciseBankFlow (https://www.precisebankflow.com) - Published: 2025-11-23 - Updated: 2025-11-23 - Category: Internal controls over cash - Canonical: https://www.precisebankflow.com/blog/cash-control-deficiencies > The cash control deficiencies auditors report most: late reconciliations, missing review, shared logins, unsigned checks, and how to fix each one. The cash control deficiencies auditors report most often are late bank reconciliations, reconciliations with no real evidence of review, shared or excessive online banking access, and signature shortcuts such as pre-signed or stamped checks. Each has a direct fix: a deadline with a backlog plan, a documented review, individual logins, and approval before payment. ## What makes a cash control weakness a reportable deficiency? A cash control weakness becomes a reportable deficiency when a control is missing or does not work in a way that lets an error or theft go unprevented or undetected in time. Auditors then grade it by how likely and how large the resulting misstatement could be: an ordinary deficiency, a significant deficiency, or a material weakness. ### The grades For public companies, the SEC's definitions in [Regulation S-X rule 210.1-02](https://www.law.cornell.edu/cfr/text/17/210.1-02) set the terms, with a material weakness at the top: a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. The full wording of each grade, and how several small cash findings can combine into a higher one, is under [SOX cash control deficiencies testers find most often](/blog/sox-controls-for-cash#sox-cash-control-deficiencies-testers-find-most-often). Many auditors of private companies and nonprofits use the same three labels when they grade cash findings. ### Why cash findings are common Cash moves every day, touches almost every process and can be taken directly. A small weakness in cash has a direct path to loss, so auditors look harder and report more readily. They also find cash weaknesses easily, because bank statements, reconciliations and user lists leave a clear paper trail. ### Severity depends on what else exists A late reconciliation in a company where the owner reads every statement may stay an ordinary deficiency. The same late reconciliation in a company where one person handles all cash, and nobody else looks, can be graded higher. The broader set of controls is described in [internal controls over cash for small finance teams](/blog/internal-controls-over-cash). ### The deficiencies at a glance The table below is an example summary. The finding wording is typical of management letters, not quoted from any one. | Deficiency | Typical finding wording | Usual root cause | Fix | | --- | --- | --- | --- | | Late reconciliations | "Bank reconciliations were not prepared timely for several months of the year" | No deadline, staff turnover, backlog | Written deadline, catch-up plan, monthly tracking | | Missing review | "Reconciliations lacked evidence of review" | Reviewer initials without checking, or no reviewer | Named reviewer, review notes, dated sign-off | | Shared logins | "Online banking credentials were shared among staff" | Convenience, single token | Individual users and tokens, role limits | | Excess access | "Users had both initiate and approve rights" | Default setup never changed | Split roles, dual approval | | Signature shortcuts | "Checks were signed in advance" or "a signature stamp was used without control" | Signer unavailable | Online approval, stamp in locked custody | | Unreconciled accounts | "Certain accounts were not reconciled" | Account missing from the list | Account inventory and monthly checklist | ## Late bank reconciliations as a cash control deficiency A bank reconciliation is late when it is finished long after the statement date, so errors and unauthorized items sit unnoticed for months. Auditors report it because detection after the fact may be too late to recover the money or correct the books before reporting. The fix is a written deadline plus a plan to clear any backlog. ### Why timing matters Timing affects more than tidiness. Under [UCC section 4-406](https://www.law.cornell.edu/ucc/4/4-406), a bank customer must examine statements with reasonable promptness, and a customer who fails to report an unauthorized signature or alteration within one year after the statement is made available is barred from asserting it against the bank. The same section can bar claims on later items forged by the same wrongdoer if the customer did not report within a reasonable period of not more than 30 days. A reconciliation six months behind can leave a company with a forgery it can no longer recover. ### How to fix it 1. **Set a deadline in writing**, such as ten business days after month end, for every account. 2. **Track it.** A short table of accounts and months, with the date each was done, shows the controller and the auditor the status at a glance. 3. **Clear the backlog in order**, oldest month first, so each month starts from a correct opening balance. 4. **Read the old statements for unusual items first**, before the reconciling work, so anything that needs a bank claim goes out quickly. 5. **Assign a backup preparer**, so one absence does not start a new backlog. Savings, reserve and money market accounts are easy to skip because they move little. [How to reconcile a savings account](/blog/reconcile-a-savings-account) shows the short monthly routine that keeps them current. ## Missing or rubber-stamp review of reconciliations A rubber-stamp review is a sign-off without evidence that the reviewer checked anything. Auditors report it when initials appear on every reconciliation but the reviewer cannot explain a reconciling item, unexplained differences were accepted, or the review was dated before the reconciliation was finished. The fix is a review that leaves a trail. ### What auditors see - Reviewer initials in the same pen and on the same day for twelve months of reconciliations. - Unexplained "other" or "difference" lines that were signed off anyway. - Reconciling items that grew for months with no question noted. - A reviewer who is also the preparer. ### How to fix it Name the reviewer for each account and write down what the review covers: agreeing the balances to source, testing reconciling items, and reading the statement for unusual activity. Ask reviewers to leave a short note of what they checked and what they questioned. A dated note that says "traced deposits in transit to October statement; asked about check 2207" is far stronger evidence than initials alone. ### The role of separation The reviewer should be someone who does not handle cash or record cash transactions. When that is impossible in a small team, the owner or a board member can take the reviewer role. [Segregation of duties for cash](/blog/segregation-of-duties-for-cash) shows how to divide custody, recording, approval and reconciliation, with a duty matrix to fill in. ## Shared bank logins and excess online access Shared logins mean several people use one set of online banking credentials or one security token. Auditors report it because the bank's records can no longer show who did what, and because whoever holds the login has every permission it carries. Excess access is the related finding: users who can both initiate and approve payments. ### Why it matters A shared login defeats dual approval, since one person can play both roles. It also weakens a company's position after a fraud, because the bank's log points to a user, not to a person. ### How to fix it 1. **Pull the bank's user list** for every account and compare it with current staff. 2. **Give every person their own login and token.** Most business online banking services allow several users. 3. **Separate initiate and approve rights**, and require a second approver for wires, ACH batches and new payees. 4. **Remove users the day they leave**, and review the list quarterly. 5. **Keep administrator rights with someone who does not make payments**, or require two administrators to change user settings. ## Unsigned, pre-signed and stamped checks Signature shortcuts include checks signed in blank before payees are known, signature stamps kept by the person who prepares checks, checks paid without a required second signature, and stored signature images in check printing software. Auditors report these because the signature no longer shows that an authorized person approved the payment. ### What these look like in a file - A stack of signed blank checks in a desk drawer for "when the owner is traveling". - A signature stamp in an unlocked cabinet next to the check stock. - Checks above the dual-signature limit with one signature. - Check images on the statement with signatures that do not match the signer list. ### How to fix it Replace pre-signed checks with online payments that the signer approves remotely. If a stamp or signature image must exist, keep it in locked custody of someone who does not prepare checks, log every use, and have the signer review the log. For dual-signature rules, treat the second signature as an internal approval step, not as something the bank will police, and use positive pay or a monthly review of check images to catch exceptions. ## Which cash deficiencies are not worth a costly fix? Some cash deficiencies cost more to fix than the risk they carry. A tiny petty cash fund, a dormant account with a small balance and no access, or perfect separation in a three-person office may not justify a large change. In those cases, a compensating control or a documented decision to accept the risk can be the right answer. ### When a compensating control is enough A compensating control is a different control that covers the same risk. In a small business, an owner who receives bank statements directly and reads them monthly can compensate for a bookkeeper who both pays bills and reconciles. Document the compensating control so the auditor can test it. ### When to accept the risk Management may decide a risk is small enough to live with. Write that decision down: the deficiency, the amount at risk, why the fix is not worth it, and who approved the decision. An auditor may still report the deficiency, but a documented choice reads very differently from neglect. ### When not to accept it Do not accept risk where one person controls a large flow of cash end to end, where online access lets one user send wires alone, or where reconciliations are not done at all. Those deficiencies sit on the direct path to a large loss. ### Making the fix cheaper Many cash fixes are slow because the reconciliation work is slow. Reading statements into a structured file, proving each one foots, and listing duplicates and gaps for the reviewer cuts the time a monthly reconciliation and review takes. [PreciseBankFlow](/) handles that mechanical layer and produces an exception report ready for the reviewer's sign-off.