SOX controls for cash are the internal controls a public company relies on to keep its cash balance and cash transactions correctly reported. The key ones are usually the bank reconciliation and its review, payment approval, bank access and treasury administration. Each needs a precise description and evidence that it ran every period.
What does SOX require for internal control over cash?
Section 404 of the Sarbanes-Oxley Act requires management of a public company to report each year on the effectiveness of its internal control over financial reporting. For larger filers, the auditor must also attest to that assessment. Cash is in scope like any other account, and usually in every company's scope because it is material.
Management's report and the auditor's attestation
The statute, codified at 15 U.S.C. 7262, management assessment of internal controls, asks for a report that states management's responsibility for establishing and maintaining adequate internal control, and gives management's assessment of its effectiveness as of the fiscal year end. Subsection (b) requires the registered audit firm to attest to that assessment. Subsection (c) removes the attestation requirement for issuers that are neither accelerated nor large accelerated filers, and emerging growth companies are excluded too, so many smaller public companies have management's assessment without an auditor's opinion on controls.
What that means for the cash team
In practice, the cash team must be able to show, for each key control, what the control is, who performs it, how often, and the evidence that it ran. Management's testers, internal audit or an outside provider then test it during the year. The external auditor may rely on that work or test directly.
Key SOX cash controls in a risk and control matrix
A risk and control matrix lists each risk to the cash balance and the control that answers it. For cash, the key controls usually cover the bank reconciliation and its review, approval of disbursements, segregation in the treasury platform, user access to bank systems, and the posting of cash receipts.
The table below is an example of the cash section of a matrix at a mid-sized company. Your risks and controls will differ.
| Risk (example) | Key control | Type | Frequency |
|---|---|---|---|
| Cash balance misstated or unrecorded transactions | Bank reconciliation prepared and independently reviewed for every account | Detective, manual | Monthly |
| Unauthorized or duplicate payments | Disbursement batch approved by an authorized approver against support before release | Preventive, manual | Each batch |
| One user can create and release a payment | Dual approval enforced in the treasury platform | Preventive, automated | Continuous |
| Unauthorized bank access | Quarterly review of bank platform users and rights | Detective, manual | Quarterly |
| Receipts not recorded or misapplied | Daily cash application reviewed against bank receipts | Detective, manual | Daily or weekly |
| Bank accounts outside the books | Bank account listing agreed to the general ledger | Detective, manual | Quarterly |
Choosing which are key
A key control is one the company relies on to address a risk of material misstatement. Not every control in the cash process needs to be key. The bank reconciliation review is almost always key because it detects errors from many upstream controls at once. Supporting controls, such as daily cash positioning, may stay out of the testing scope.
Writing a SOX control description for the bank reconciliation
A testable SOX control description names who performs the control, what they do, how often, what threshold triggers follow-up, and what evidence is kept. A vague description such as "bank reconciliations are reviewed monthly" cannot be tested, because a tester cannot tell what a reviewer was supposed to look for.
A worked description
Below is an example description for a bank reconciliation review. Adapt the titles, days and thresholds to your company.
The Assistant Controller reviews the monthly bank reconciliation for each operating, payroll and disbursement account by business day 8 after month-end. The reviewer agrees the bank balance to the bank statement and the book balance to the general ledger trial balance, confirms the reconciliation has no unexplained difference, and investigates reconciling items over 5,000 or older than 60 days. The reviewer documents follow-up in the reconciliation tool and signs off electronically. The preparer and reviewer are different people.
Why each part is there
- Who. A title, not a name, so the description survives staff changes.
- When. A deadline that matches the close calendar. Late reviews are a common finding.
- Precision. The thresholds, 5,000 and 60 days in this example, tell the tester what level of error the review would catch.
- Follow-up. What happens to items above the threshold, and where that is recorded.
- Evidence. The sign-off and its date. What a sign-off has to show, and how to make it hold up, is covered in bank reconciliation sign-off.
Reconciling items in the description
The description should say how outstanding checks and deposits in transit are handled, because those items are where errors hide. A deposit in transit that never clears is one of the oldest ways to cover a shortage; the treatment of each type, and when one becomes a warning, is explained in outstanding checks and deposits in transit.
What evidence do SOX testers request for cash controls?
SOX testers ask for evidence that each control ran as described, for each sampled period. For a bank reconciliation, that means the reconciliation, the bank statement, the general ledger balance, support for reconciling items, the reviewer's sign-off with its date, and evidence that follow-up happened on items above the threshold.
The evidence list for the reconciliation control
- The completed reconciliation for the sampled month and account.
- The bank statement, from the bank or the bank's portal, not a retyped copy.
- A general ledger report showing the book balance at the same date.
- Support for reconciling items above the threshold, such as the later bank statement showing a deposit in transit cleared.
- The reviewer's sign-off, with a date inside the deadline.
- Notes or tickets showing items over the threshold were investigated.
- For system-generated reports, evidence the report is complete and accurate, sometimes called information produced by the entity.
Evidence for other cash controls
For disbursement approval, testers pick payments and look for the approval before the release date. For dual approval in a treasury platform, they look at the system configuration and test that it cannot be bypassed. For user access reviews, they want the user list as reviewed, the reviewer's sign-off and proof that changes were made. How testers pick samples and reperform a reconciliation review is covered in testing bank reconciliation controls.
When bank statements arrive as PDFs, PreciseBankFlow checks that each statement foots and exports the reconciliation and its exceptions as an Excel or PDF workpaper. That gives the reviewer something to sign and the tester something to inspect; the judgment remains with the reviewer.
SOX cash control deficiencies testers find most often
The deficiencies that recur in cash are late reviews, reviews with no evidence of what was checked, old reconciling items left unexplained, missing reconciliations for small accounts, and bank users whose rights were never reviewed. Most are failures of operation, not design: the control is sound on paper but was not performed as written.
How deficiencies are graded
The SEC's definitions in 17 CFR 210.1-02, definitions of internal control terms set the scale. A material weakness is a deficiency, or a combination of them, such that there is a reasonable possibility a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe than a material weakness, yet important enough to merit the attention of those overseeing financial reporting. Anything below that is a control deficiency.
Findings that come up
- Rubber-stamp review. The sign-off exists, but nothing shows the reviewer looked at the statement or the items.
- Signed after the deadline. The review happened, but weeks after the close.
- Stale reconciling items. Items over the threshold sat for months without the follow-up the description promises.
- Accounts missing from the population. A dormant account, a petty account or one at a second bank was never reconciled.
- Preparer and reviewer the same. Often after a staff departure.
- Access not removed. Former employees still active in the treasury platform.
- Unvalidated reports. A system report used in the control without evidence it was complete.
Each finding is assessed alone and with others. Several deficiencies in cash together can rise to a significant deficiency even if each is minor alone.
When a SOX cash control does not need to be key
A cash control does not need to be key when another tested control already covers the same risk at the same or better precision, or when the account it covers cannot be material even combined with others. Removing redundant key controls saves testing effort without weakening the assessment.
Examples
- Daily cash positioning. A treasury analyst's daily balance check is useful, but if the monthly reconciliation review is key and precise, the daily check can be supporting.
- Very small accounts. A petty cash fund or a dormant account may not need its own key control, provided the population of accounts is complete and the combined balance is clearly immaterial.
- Manual approval behind an automated control. If dual approval is enforced in the platform and tested, a manual sign-off on the same payment may be redundant.
When not to drop a control
Do not drop a control because it failed testing. A failed key control must be remediated and retested, and dropping it to avoid a deficiency is the kind of decision auditors look for. Do not drop the reconciliation review for any account where fraud risk is high, such as a payroll or disbursement account, however small its balance. When in doubt, get started with PreciseBankFlow on one account and see whether the exception report gives your reviewers what they need.