Cash and Internal Controls

Why managers treat cash differently from every other asset

A board member at a mid-size logistics company once asked the chief financial officer (CFO): "We have $14 million in property and equipment on the balance sheet. Why does the audit committee spend more time on the $900,000 cash line?" The answer is not that cash is the largest asset. Often it is not. Cash is the asset most easily stolen, most easily misstated, and most likely to destroy stakeholder trust when controls fail.

Through Units 1 through 3, you built the conceptual and mechanical foundation for reading and recording business activity. In Unit 1, Why Accounting Exists established why verifiable records matter to investors, lenders, and operators. The Accounting Equation taught that A = L + E (assets equal liabilities plus equity) must hold at every moment. The Financial Statements as an Integrated System showed how the balance sheet, income statement, and cash flow statement articulate. Unit 2 taught you to record events: Journal Entries, Posting to the General Ledger, and the critical distinction between general ledger (GL) cash and the bank balance. Unit 3 applied accrual accounting: Revenue Recognition, Expense Recognition and Matching, Adjusting Entries, and Closing the Books. You now know how transactions become numbers on financial statements.

Unit 4 zooms in on major balance-sheet accounts where judgment, controls, and estimates determine whether reported numbers are trustworthy. Cash is the natural starting point because every other account ultimately connects to cash: customers pay in cash, suppliers are paid in cash, loans are funded and repaid in cash, payroll clears through cash. If cash is wrong or unprotected, everything built on top of it is suspect.

This lesson teaches why cash demands the strongest internal controls (policies and procedures designed to safeguard assets, ensure reliable reporting, and promote lawful operations), how segregation of duties and authorization limits reduce fraud opportunity, how bank reconciliation ties GL cash to the bank statement, how petty cash imprest systems work, what cash equivalents include, how common fraud schemes like skimming and lapping operate, and why public companies face additional duties under the Sarbanes-Oxley Act (SOX) (a 2002 U.S. law requiring stronger financial reporting controls and executive accountability for public companies).

Cash is the highest-risk asset on the balance sheet

Cash includes currency, coins, checks received, and funds in demand deposit accounts (checking and savings). On the balance sheet, cash usually appears as the first current asset because it is the most liquid: it can be spent immediately without conversion. That liquidity is exactly why cash attracts theft. Inventory must be sold. Equipment must be fenced or disguised. Cash can be transferred, withdrawn, or redirected with a few keystrokes.

Risk also comes from volume and routine. In a busy company, dozens or hundreds of cash movements occur daily: customer deposits, vendor payments, payroll, expense reimbursements, loan draws, tax remittances. High volume creates hiding places. A $400 duplicate payment buried inside a $2.4 million weekly disbursement run may not surface for months unless someone reconciles systematically.

Cash misstatement is a second major risk. The GL Cash account reflects what the company recorded. The bank statement reflects what cleared through the banking system. Those two numbers often disagree on any given date for legitimate reasons: checks written but not yet cashed, deposits made after the bank's cutoff, bank fees the bookkeeper has not yet entered. They can also disagree because of errors (wrong amount keyed) or fraud (checks redirected). Without monthly reconciliation and review, a manager can present a balanced trial balance while the true spendable cash position is unknown.

From Posting to the General Ledger, remember the managerial rule: GL Cash is not the same as the bank balance. Lesson 4 in Unit 2 introduced bank reconciliation as a detective control after posting. This lesson goes deeper: the full reconciliation mechanics, the journal entries required to correct the books, and the control environment that makes reconciliation meaningful rather than a rubber-stamp exercise.

The internal control framework: environment, activities, and monitoring

Internal control is not a single checklist. It is a system. The Committee of Sponsoring Organizations (COSO) framework, widely used in the U.S. and referenced by auditors, organizes internal control into five components. You do not need to memorize COSO for daily management, but you should understand the logic because boards, auditors, and SOX compliance programs use this language.

Control environment is tone at the top. If the chief executive officer (CEO) treats policy exceptions as personal favors ("just pay this vendor without a purchase order"), controls erode quickly. A strong environment includes ethical hiring, clear accountability, and consequences for override without documentation.

Risk assessment asks what could go wrong and how likely it is. A retail chain with hundreds of store safes faces different cash risks than a software company with one treasury account and no physical cash.

Control activities are the policies people execute daily: approvals, reconciliations, segregation of duties, physical security, system access limits. This lesson focuses heavily here.

Information and communication ensures that the right people see exceptions, aging reconciling items, and fraud indicators in time to act.

Monitoring includes management review, internal audit, and external audit follow-up. Controls that are documented but never tested are wishful thinking.

Managers at private companies may never utter the word "COSO," but they still design the same pieces when they require two signatures on checks, lock the safe, and review bank statements personally. Public companies must formalize and document these elements under SOX Section 404, which requires management to assess and report on internal control over financial reporting (ICFR). External auditors opine on the effectiveness of those controls for accelerated filers. A material weakness in cash controls can become a public disclosure that moves the stock price and invites regulatory scrutiny.

Segregation of duties: the most important cash control

Segregation of duties (SoD) means no single person should control all critical steps of a transaction cycle. For cash disbursements, the ideal separation splits four functions:

1. Authorization: someone with authority approves the payment (purchase order, contract, expense report).
2. Custody: someone holds or can move cash (treasury, cashier).
3. Recording: someone posts the transaction to the GL (accountant).
4. Reconciliation: someone compares records to external evidence (bank statement, independent reviewer).

When one person can approve a fake vendor, record the invoice, and send payment without a second pair of eyes, fraud becomes a spreadsheet exercise. Real cases often involve an accounts payable clerk who creates a vendor with a similar name to a legitimate supplier, submits invoices, and approves them because the company never separated vendor master setup from invoice approval.

Perfect segregation is rare in small businesses. A 12-person company may have one office manager who signs checks, makes deposits, and reconciles the bank. Compensating controls then become essential:

• Owner or external accountant reviews bank statements and cleared checks monthly before the reconciler's work is accepted.
• Positive pay: the company sends the bank a list of issued checks; the bank pays only matching checks, flagging exceptions.
• Automated payment limits in the enterprise resource planning (ERP) system (integrated software that runs accounting, payroll, inventory, and other operations).
• Surprise cash counts for petty cash and retail drawers.

Segregation is preventive control: it stops problems before cash leaves. It pairs with detective controls like reconciliation and analytics, covered later in this lesson.

Authorization controls: who is allowed to move money?

Authorization controls define who may commit the company to spend cash, up to what dollar limit, and with what documentation. Authorization is not bureaucracy for its own sake. It is how a company ensures that cash outflows match legitimate business purpose.

Strong authorization typically includes:

Written policies stating approval thresholds. Example: department managers may approve expenses up to $2,500; vice presidents up to $25,000; CEO and CFO jointly above that.

Purchase order (PO) or contract requirement before goods and services are ordered. A PO is not the same as a vendor invoice; it is the internal commitment that procurement was approved.

Three-way match for vendor payments: compare purchase order, receiving report (proof goods arrived), and vendor invoice before payment. This blocks payment for goods never received or invoices that do not match agreed price.

Dual approval for electronic payments above threshold. Many treasury teams require two separate users to initiate and release a wire transfer.

Documented exceptions when policy is overridden. Emergency repairs may skip a PO, but the override should name the approver, reason, and date.

Authorization connects directly to Unit 3's accrual logic. Approving an expense does not always mean cash leaves immediately. A manager might approve December consulting work that is invoiced in January and paid in February. The approval supports the expense recognition decision; treasury execution is a separate step. Weak authorization corrupts both the income statement (wrong expenses) and cash (wrong payees).

A common managerial mistake is conflating "budget approval" with "payment authorization." A project may be budgeted without each individual vendor payment being reviewed. Budget control is planning; authorization is execution. Both matter.

Cash equivalents, petty cash, and restricted cash

Cash equivalents are short-term, highly liquid investments that are readily convertible to known amounts of cash and have insignificant risk of value change. Under U.S. GAAP (Generally Accepted Accounting Principles, the official U.S. accounting rulebook), typical examples include money market funds and U.S. Treasury bills with original maturities of three months or less. Companies often report "Cash and cash equivalents" as a single balance sheet line because both are available for immediate operational needs.

Cash equivalents are not long-term bonds, equity securities, or certificates of deposit with penalties. Those may be investments, but they are not equivalents. The distinction matters for liquidity analysis: a lender calculating whether the company can meet next quarter's obligations wants to know what is truly spendable without sale delays or market risk.

Petty cash is a small on-hand fund for minor expenditures where writing a check or initiating a wire is impractical: courier tips, small office supplies, employee reimbursements under a floor limit. The standard approach is the imprest system: petty cash is established at a fixed amount (the imprest balance). When someone spends from the fund, they leave receipts in the box. The cash plus receipts should always equal the imprest amount. When receipts accumulate, the company writes a check to replenish petty cash back to the full imprest balance, debiting expense accounts for the receipts and crediting Cash (bank).

Petty cash is a frequent fraud point because it feels "too small to matter." A $400 imprest fund misused for twelve months is $4,800. More importantly, petty cash habits train staff to treat documentation casually. Controls include locked boxes, limited custodians, surprise counts, and requiring original receipts.

Restricted cash is cash held for a specific purpose and not available for general operations: collateral for a loan, escrow for a legal settlement, amounts required by debt covenants. It may appear as a separate balance sheet line or as a disclosure. Analysts and lenders often subtract restricted cash when assessing free liquidity. A company showing $10 million in cash with $6 million restricted has $4 million operationally available, not $10 million.

Bank reconciliation: tying the GL to the bank statement

Bank reconciliation is the monthly (sometimes daily for active treasury teams) comparison of the GL Cash account to the bank statement. Its purpose is twofold: explain legitimate timing differences and identify errors or fraud requiring journal entries.

The bank statement shows transactions that cleared the bank through the statement date. The GL shows all transactions the company recorded, whether or not they cleared. On the last day of a month, a company might mail $200,000 of vendor checks at 4 p.m. and record them that day. The bank balance will still be high until recipients deposit checks. Meanwhile, a store might deposit $50,000 after the bank's cutoff on March 31; the company records the deposit on March 31, but the bank statement shows it on April 1.

Standard reconciliation format:

Bank side (start with bank statement ending balance)

• Subtract outstanding checks (checks the company recorded as issued but the payee has not yet deposited or the bank has not yet paid).
• Add deposits in transit (cash receipts recorded by the company before the bank statement cutoff but not yet appearing on the statement).

Result: adjusted bank balance.

Book side (start with GL Cash per books)

• Subtract bank charges not recorded (service fees, wire fees).
• Subtract NSF checks (non-sufficient funds checks, customer checks that bounced because the customer's account lacked funds).
• Add or subtract book errors (wrong amount recorded).

Result: adjusted book balance.

The two adjusted balances must agree. If they do not, the reconciler has missed an item or made an arithmetic error.

NSF checks require a specific accounting response. Suppose the company recorded a $1,500 customer collection in March. In April, the bank returns the check as NSF. The company must reverse the original receipt: debit accounts receivable (AR) (amounts customers owe the company) and credit Cash, re-establishing the customer balance and reducing cash. The company may also charge the customer an NSF fee per contract.

Book errors are independent of timing. If the company recorded check #8821 as $2,800 but the bank cleared $3,300, cash was overstated by $500. The correcting entry debits the appropriate expense (or accounts payable if a vendor payment) and credits Cash for $500.

From Unit 2's posting lesson, reconciliation is the detective control that proves whether posted cash is defensible. A balanced trial balance does not prove cash is correct. Only reconciliation, plus timely adjusting entries for bank-side discoveries, aligns the GL with economic reality.

Unreconciled differences should not age casually. Many companies escalate items open more than 30 days. Persistent small differences are sometimes fraud "testing": a thief skims modest amounts to see whether anyone notices.

Fraud schemes: skimming, lapping, and the red flags managers miss

Cash fraud divides roughly into theft of incoming cash (skimming), theft of incoming payments after they are recorded (lapping), and theft of outgoing payments (bogus vendors, ghost employees). Controls and reconciliation target each differently.

Skimming steals cash before it is recorded. Examples: a retail cashier does not ring a sale and pockets the cash; a billing clerk accepts a customer payment but never records it. Skimming leaves no obvious GL trail because the revenue and receivable were never recorded. Detection relies on non-financial evidence: inventory shrinkage, customer complaints that their payment was not credited, statistical sales per register versus industry norms, video monitoring.

Lapping steals cash after recording, then covers the hole with later receipts. Suppose a collections clerk receives $5,000 from Customer A on Monday and records it. On Tuesday, the clerk steals $5,000 from Customer B's payment. Customer B's account still shows open balance. On Wednesday, the clerk applies part of Customer C's payment to hide B's shortage. The scheme rolls forward like a wave until one customer insists on a statement that does not match. Lapping requires access to both cash and AR subledger applications, which is why SoD between custody and recording matters.

Fraud red flags managers should treat as investigation triggers, not noise:

• One employee never takes vacation (fear that coverage will expose manipulation).
• Unexplained declines in cash sales per location while foot traffic is steady.
• Vendors without tax identification (W-9 forms in the U.S.) or with post office box addresses only.
• Checks made payable to generic entities ("Cash," employee names) for vendor expenses.
• Bank reconciliations completed late or always without exceptions (rubber-stamping).
• Round-dollar adjustments repeatedly posted to reconcile cash.
• Customer complaints about payment application while one clerk "owns" that customer set.

Mandatory vacation and job rotation are classic detective controls. So is requiring that customer-facing AR statements be mailed by someone not involved in cash application.

SOX, public company context, and how this lesson connects forward

If you manage or invest in a U.S. public company (one whose shares trade on a stock exchange and it files with the Securities and Exchange Commission (SEC)), cash controls are not only operational hygiene. They are compliance obligations. SOX requires the CEO and CFO to certify quarterly and annual reports. Section 404 requires management to document and test ICFR. Independent auditors report on whether controls are effective. A material weakness means a reasonable possibility exists that a material misstatement will not be prevented or detected on time.

Private companies are not subject to SOX in the same way, but they still face lender covenants, investor due diligence, and insurance requirements that mirror SOX expectations. When a private company prepares for an initial public offering (IPO), weak historical cash controls become expensive remediation projects.

This lesson connects backward and forward across ACC 101. Backward: you need Unit 2's journal and posting fluency to record reconciliation adjustments, and Unit 3's adjusting entry mindset to treat bank fees and NSF items as period corrections. Forward: Lesson 2 in this unit covers accounts receivable (AR) and credit losses, the natural pairing with cash collections and lapping risk. Lessons 3 through 5 cover inventory, property and equipment, and liabilities, each with its own control and estimate issues.

Cash is not an estimate-heavy account like bad debt or depreciation. Cash is either there or it is not. The judgment lies in controls, cutoff, classification (restricted versus unrestricted), and honest reconciliation. That simplicity makes cash deceptively dangerous: people assume it is easy, so they stop checking.

Westridge Provisions Co. distributes specialty food products to regional grocery chains. The controller, Dana Okonkwo, closes March books on April 3. Dana's task is to reconcile GL Cash to the March 31 bank statement, post required adjustments, and brief the CFO on any items that signal control weakness.

Part A: Facts at March 31, 2026

GL Cash balance per books (after all March journal entries posted): $49,355

Bank statement ending balance, March 31: $51,350

Outstanding checks (recorded by Westridge, not yet cleared by bank):

Deposit in transit: On March 31 at 6:15 p.m., a store manager deposited $3,000 of customer checks at the bank's night drop. Westridge recorded the deposit on March 31. The bank statement does not include it (cutoff was 4:00 p.m.).

Bank service charge: $35 fee on the statement; not yet recorded in GL.

NSF check: Customer Harbor Foods check #118 for $1,500 was deposited in March and recorded as a collection. The bank returned it NSF on March 31. Westridge has not yet reversed the receipt.

Recording error: Check #8821 to a freight vendor was recorded in GL as $2,800. The bank cleared $3,300. Westridge understated freight expense and overstated Cash by $500.

Part B: Reconciliation schedule

Bank side:

Book side (before adjustments):

47,320 = 47,320 ✓ The reconciliation ties.

Economically, Westridge has $47,320 of cash that is both recorded correctly and consistent with the bank after timing items and corrections. The CFO should not plan April disbursements using $51,350 (raw bank) or $49,355 (uncorrected books).

Part C: Adjusting journal entries

Entry 1: Bank service charge

Entry 2: NSF check from Harbor Foods

Reverse the original deposit that will not collect:

Harbor Foods owes Westridge again. Collections must restart.

Entry 3: Correct check #8821 error

Post-adjustment GL Cash: 49,355 − 35 − 1,500 − 500 = $47,320

Check: Adjusted book balance matches adjusted bank balance. Ending GL Cash equals the reconciled spendable position after timing items clear (outstanding checks and deposit in transit will resolve in April as checks clear and the deposit appears).

Part D: Managerial read

Dana should escalate three items beyond routine entries:

1. NSF from Harbor Foods: Credit team should review Harbor's payment history. Repeated NSF may require cash-on-delivery terms.
2. Check amount error: Investigate whether the mistake was keystroke error or override fraud. One error is training; patterns warrant audit.
3. Outstanding checks: Check #8829 for $2,000 issued March 31 should clear within days. If checks age beyond 90 days, treasury should void and reissue after confirming the vendor did not receive payment.

The board's liquidity question for April is answered with $47,320 of reconciled cash, not the $51,350 bank statement headline. That distinction is the payoff of Unit 2 posting discipline applied with Unit 3's adjusting entry rigor.

This example covers two angles required for cash fluency: imprest petty cash mechanics and AR-linked fraud detection.

Part A: Clearwater petty cash imprest fund

Clearwater Hospitality Group operates three boutique hotels. Each front desk maintains a petty cash imprest fund of $500.

April activity at the Harborview property:

Physical count on April 30: Cash in box = $334

Imprest proof: Petty cash ($334) + receipts ($166) = $500 ✓

The fund is intact. No theft, no undocumented spending.

Replenishment on May 2: Clearwater writes a company check to petty cash custodian Maria Chen for $166, restoring cash to $500. Maria deposits that check and places cash in the box.

Journal entry (replenishment, not individual petty cash payments):

Note: individual petty cash spends do not hit the GL until replenishment (or until the company chooses to record them at time of spend in larger operations). The imprest count is the daily control.

Managerial read: Maria should not be the same person who reconciles the main operating bank account without independent review. Clearwater's regional controller performs surprise petty cash counts quarterly.

Part B: Pinecrest Medical Supplies lapping pattern

Pinecrest Medical Supplies sells surgical consumables to clinics. Collections clerk Jordan Lee records customer payments and applies them in the AR subledger. Jordan also opens mail and deposits checks some mornings when staffing is thin. That is an SoD failure: custody plus recording on the same customer cash.

Simplified lapping timeline (fictional investigative reconstruction):

Detection path:

1. Customer statement mismatch triggers AR inquiry.
2. Bank deposit totals do not match recorded cash receipts when compared by an analyst excluding Jordan.
3. Jordan's "no vacation" pattern noted during human resources review.

GL impact: Total revenue may still look plausible early in the scheme because Jordan applies later receipts to earlier customer balances. The AR subledger shows strange payment timing and employee-specific concentration of "adjustments." Bank reconciliation may show repeated small shortages if Jordan cannot lap fast enough.

Remediation Pinecrest implemented:

• Mail opening and deposit preparation separated from AR application.
• Lockbox service at bank: customers mail checks to bank post office box; bank scans and deposits; AR matches remittance advices.
• Mandatory two-week vacation with backup clerk performing applications.
• Monthly independent AR confirmation letters to top 50 customers.

Managerial read: Lapping is why Lesson 2's AR controls and aging reviews matter as much as cash controls. Cash integrity and AR integrity are one continuous system.

Northline Outdoor Gear Inc. ends April with the following information:

• GL Cash per books: $62,480
• Bank statement balance April 30: $60,072

Outstanding checks:

Deposits in transit at April 30: $6,750

Bank statement items not recorded on books:

• Bank service charge: $28
• NSF check from customer Summit Outfitters: $2,100 (original receipt recorded in April)
• Recording error: Northline recorded check #1139 to a supplier as $1,600; the bank cleared $2,100

Tasks:

1. Prepare the April 30 bank reconciliation (bank side and book side).
2. Prepare all required adjusting journal entries.
3. State the corrected GL Cash balance after adjustments.
4. Explain why Northline should not use $60,072 for its May 1 cash forecast.

Solution

1. Bank reconciliation

Bank side:

Book side (before adjustments):

59,852 = 59,852 ✓ The reconciliation ties.

2. Adjusting journal entries

Bank service charge:

NSF check from Summit Outfitters:

Correct check #1139 error:

3. Corrected GL Cash balance

62,480 − 28 − 2,100 − 500 = $59,852

4. Why not use $60,072 for the May 1 cash forecast

The raw bank statement balance of $60,072 includes checks Northline already recorded but the bank has not yet paid ($6,970 outstanding). It excludes the deposit in transit that Northline already recorded ($6,750) but the bank had not credited by statement cutoff. Those timing items are not errors; they are normal month-end gaps. More importantly, the books overstated cash by $2,628 before adjustments ($28 fee + $2,100 NSF + $500 recording error). Planning disbursements from $60,072 would ignore both timing and book corrections. Treasury should forecast from the reconciled, adjusted position of $59,852, then separately model when outstanding checks will clear and when deposits in transit will appear on the bank statement.

Beacon Street Café LLC is a 15-employee coffee chain with one location that still uses a manual cash register tape. The owner asks you to evaluate controls.

Facts:

• The store manager opens mail, prepares bank deposits, records daily sales in the accounting system, and reconciles the bank account.
• Petty cash ($300 imprest) is kept in an unlocked drawer; no receipts are required.
• Vendor invoices under $500 are approved and paid by the same office manager.
• The company is private but preparing for a potential IPO in two years.

Tasks:

1. Identify three segregation-of-duties failures and one authorization weakness.
2. Propose one compensating control for each failure without hiring new staff.
3. Explain whether skimming or lapping is the greater risk in this setting and why.
4. Name two SOX-relevant control themes the company should strengthen before going public, even though SOX does not apply yet.

Solution

1. Failures identified

SoD failure 1: Store manager both custodies cash (prepares deposits) and reconciles the bank. Reconciliation loses independence when the same person who handled cash proves their own work.

SoD failure 2: Store manager records daily sales and prepares deposits. Sales could be understated (skimming) before cash ever reaches the bank, with no independent count.

SoD failure 3: Office manager approves vendor invoices and pays vendors under $500. A fictitious vendor could be created and paid without a second reviewer.

Authorization weakness: No documented approval thresholds or three-way match for vendor payments. "Under $500" is a dollar limit without verification that goods were received or that the vendor is legitimate.

2. Compensating controls (no new hires)

3. Skimming versus lapping risk

Skimming is the greater risk in a retail cash setting. A meaningful share of Beacon Street's revenue likely arrives as cash and card settlements that pass through the manager's hands before recording. Skimming steals receipts before they enter the GL, which matches the manager's combined custody-and-recording role. Lapping requires recorded customer AR balances to manipulate; café retail is mostly immediate payment, not open invoices on a subledger. Lapping could still occur on small catering receivables, but skimming is the primary threat.

4. SOX-relevant themes to strengthen pre-IPO

Even before SOX legally applies, investors and underwriters will expect:

1. Documented and tested ICFR over cash: written policies, evidence of monthly bank reconciliation review by someone independent of cash handling, and retention of support for reconciling items.
2. Management certification readiness: leadership must eventually attest that reported cash is fairly stated in all material respects. Building a control environment where exceptions are logged, investigated, and remediated is easier before the first SEC filing than during a rushed remediation project.

Key takeaways

• Cash is high-risk because it is liquid, anonymous, and high-volume; GL Cash and bank balance are different numbers that require reconciliation.
• Segregation of duties splits authorization, custody, recording, and reconciliation; small teams need compensating controls such as owner review and positive pay.
• Bank reconciliation explains timing items (outstanding checks, deposits in transit) and drives adjusting entries for bank fees, NSF checks, and book errors.
• Skimming steals cash before recording; lapping conceals theft after recording by manipulating later receipts; petty cash imprest counts and lockbox services reduce exposure.
• Public companies must document and test internal control over financial reporting under SOX; private companies face parallel expectations from lenders and IPO due diligence.

1. Pull the most recent bank reconciliation for a team or company you know (or a public 10-K internal control disclosure). Who prepares it, who reviews it, and how long do reconciling items stay open?
2. Map one cash-handling process you oversee to the four SoD functions (authorize, custody, record, reconcile). Where is one person doing two steps, and what compensating control could you add this month?
3. Continue to Lesson 2: Accounts Receivable and Credit Losses. Cash collections and AR application are one continuous control system; the next lesson covers what happens when customers do not pay.