# Fraud Risk Assessment for Cash and Bank Accounts

- Author: PreciseBankFlow (https://www.precisebankflow.com)
- Published: 2026-05-07
- Updated: 2026-05-07
- Category: Fraud and forensic review
- Canonical: https://www.precisebankflow.com/blog/fraud-risk-assessment

> How to run a fraud risk assessment for cash and bank accounts: list the schemes, rate likelihood and impact, map controls and plan the tests that follow.
A fraud risk assessment for cash and bank accounts lists the ways money could be stolen or misreported, rates each scheme for likelihood and impact, checks which controls actually stop it, and turns the risks that remain into specific tests. The output is a short register that tells you where to look first, not a policy document.

## Setting the scope of a fraud risk assessment for cash

The scope of a fraud risk assessment for cash covers every bank account the business controls, every way money enters or leaves those accounts, and every person who can move it. Start with an inventory: accounts, signers, online banking users, card holders and payment channels such as checks, ACH, wires and cards.

Most gaps in an assessment come from accounts or channels nobody listed. A savings account opened years ago, a payroll account run by an outside provider, or a card issued to a manager who left all belong on the list. Ask the bank for a list of accounts under the business's tax ID if you are unsure the list is complete.

### Who should take part

A fraud risk assessment works best with people from different roles: the owner or a director, whoever approves payments, whoever records them and whoever reconciles the bank. The US Government Accountability Office's [Fraud Risk Management Framework](https://www.gao.gov/assets/gao-15-593sp.pdf) recommends involving the people responsible for designing and running fraud controls, and repeating the assessment at regular intervals and when the operation changes. It was written for federal programs, but the same steps fit a business's cash.

Leave out anyone whose conduct is already in question. An assessment that the main suspect helps write will miss the scheme they are running.

## Listing the cash fraud schemes each bank account is exposed to

Listing the schemes means writing down, account by account, the specific ways someone could take money or hide a loss. Name the scheme, the channel and the person who could carry it out. "Theft" is too broad to test. "Bookkeeper adds a vendor with her own bank details and pays it by ACH" is something you can look for.

Start with the channels the account uses and ask, for each one, how it could be abused:

- **Checks.** Altered payees or amounts, checks written to cash, forged signatures, stolen stock, voided checks that clear anyway.
- **ACH and wires.** Fake vendors, changed vendor bank details, payments approved by the person who set them up, business email compromise requests.
- **Payroll.** Ghost employees, inflated hours, a payroll account the reconciler never sees.
- **Cards.** Personal purchases, split purchases to stay under approval limits.
- **Cash receipts.** Skimming before deposit, lapping customer receipts, structured cash deposits.
- **Records.** A reconciliation that is forged or plugged, bank statements edited before review, fake statements supplied to a lender.

The last group matters more each year. Fabricated statements are easier to make than they were, as [AI-generated fake bank statements](/blog/ai-generated-fake-bank-statements) explains, and a scheme that relies on the reviewer seeing an edited statement can hide all the others. Payment schemes on the supplier side are covered in more depth in [accounts payable fraud](/blog/accounts-payable-fraud).

## How do you rate likelihood and impact in a fraud risk assessment?

Rate likelihood and impact on a simple scale, such as 1 to 3 or 1 to 5, and record why each rating was given. Likelihood reflects opportunity: how easily one person could carry out the scheme without detection. Impact reflects how much money could be lost before it was noticed, plus damage that is not financial.

The GAO framework asks for both, and adds two points worth borrowing: consider non-financial impact, such as reputation and compliance, and decide on a risk tolerance, which is the level of risk the business is willing to accept.

A three-point scale is enough for most small businesses:

| Rating | Likelihood | Impact |
| --- | --- | --- |
| 1, low | Needs two or more people acting together, or access few people have | Under one month's normal outflow, noticed within a month |
| 2, medium | One person could do it, but a regular review would probably catch it | Could reach several months of outflow before discovery |
| 3, high | One person could do it and no one reviews the result | Could threaten the business, a loan covenant or a license |

Write a sentence beside every rating. "Likelihood 3: the bookkeeper sets up vendors, approves ACH batches and reconciles the bank" is useful. "Likelihood 3" on its own is not, because nobody can check or update it next year.

Rate the inherent risk first, meaning the risk before any control, then come back for the residual risk after the controls are mapped. Rating both shows which controls carry the most weight.

## Mapping existing controls to each cash fraud risk

Mapping controls means writing, for each scheme, the control that would prevent or detect it, and then asking whether that control actually works. A control that exists only on paper, or that the same person who could commit the fraud performs, does not reduce the risk. What remains after honest mapping is the residual risk.

Test each control against three questions:

1. **Does it address this scheme?** Dual signatures on checks do nothing about ACH payments.
2. **Is it independent?** A bank reconciliation done by the person who also records payments can be used to hide the payments.
3. **Is there evidence it ran?** A reviewed reconciliation should carry a reviewer's name and date. If nobody can show that, treat the control as missing.

Common controls for cash include positive pay on checks, ACH debit blocks, two-person approval for new vendors and changed bank details, segregation between payment entry and approval, an owner's direct review of statements, and a monthly reconciliation reviewed by someone who cannot move money.

## An example fraud risk register for one operating account

A fraud risk register is the finished assessment in one table: each scheme, its ratings, the control that addresses it, the residual rating and the test planned for it. The example below is for one operating account at a small distributor. All entries are invented for illustration.

| Scheme | L | I | Existing control | Residual | Planned test |
| --- | --- | --- | --- | --- | --- |
| Bookkeeper creates a fake vendor and pays it by ACH | 3 | 3 | None: bookkeeper sets up and approves vendors | High | Match vendor bank details to employee payroll accounts |
| Vendor bank details changed after an email request | 2 | 3 | Call-back required, but no log kept | High | Review all bank detail changes for the year and evidence of call-back |
| Check payee altered after signing | 2 | 2 | Positive pay on issued amount and number, not payee | Medium | Compare cleared check images with register payees |
| Duplicate invoice paid twice | 2 | 1 | System warns on same invoice number | Low | Duplicate test on vendor, amount and date window |
| Reconciliation plugged to hide a shortfall | 2 | 3 | Owner signs the reconciliation without reading it | High | Re-perform two months' reconciliations from statements obtained from the bank |
| Cash receipts skimmed before deposit | 1 | 1 | Few cash sales; deposits matched to invoices weekly | Low | None this year |

Three schemes come out high. Two share a cause: one person controls vendors and payments. That points to a control change as well as a test.

## Which tests should follow a cash fraud risk assessment?

The tests that follow a fraud risk assessment target the high and medium residual risks, one test per scheme, written so the result answers "did this happen?" A good test looks at all transactions in the period, not a sample, and names the data it needs: bank statements, the vendor master file, payroll records or check images.

Typical tests for cash schemes:

- **Vendor to employee match.** Compare vendor bank accounts, addresses and phone numbers with employee records.
- **Duplicate payments.** Same vendor, same or similar amount, close dates.
- **Check sequence gaps and out-of-range numbers.** A missing or unexpected number points to stolen or voided stock.
- **Round amounts and unusual size.** Payments much larger than a vendor's usual amount deserve a look.
- **Re-performance.** Rebuild the bank reconciliation from statements obtained directly from the bank, not from client copies.
- **Image review.** Compare cleared check payees and endorsements with the register.

Most of these can be built in a spreadsheet, as shown in [forensic accounting in Excel](/blog/forensic-accounting-in-excel). Tools that run them across many accounts, and what to expect of them, are discussed in [what forensic accounting software should prove](/blog/forensic-accounting-software).

PreciseBankFlow handles the statement side of this work: it reads each statement, proves it foots, and flags duplicates and check-sequence gaps in an exception report you can file with the assessment. Choosing which schemes to test is still the assessor's call. To try it, [request a place in the early group](/get-started).

## Fraud risk ratings that understate the real exposure

Fraud risk ratings understate exposure when they score the control as designed rather than as performed, rate impact by a single transaction instead of the total over time, or average risks together. Each habit makes a dangerous scheme look medium. Check a finished register against these patterns before anyone signs it.

Habits to look for:

- **Trusting the person instead of the process.** "She's been here twenty years" lowers likelihood in many registers. Long tenure often raises it, because the person knows where nobody looks.
- **Rating impact per transaction.** A 2,000 theft looks low. Twice a month for three years is 144,000.
- **Counting a control that is never evidenced.** If nobody can show the review happened, it did not reduce the risk.
- **Averaging.** A register that shows an overall cash risk of "medium" hides the one high scheme inside it.
- **Leaving out the records schemes.** If the reviewer relies on statements the bookkeeper downloads, every other control depends on those statements being genuine.
- **Never updating.** An assessment from before a new payment system, a new bank or a staff change describes a business that no longer exists. The GAO framework calls the process iterative for that reason.