Treasury controls audit checklist for mid-market companies

A treasury controls audit checklist for a mid-market company covers four areas together rather than as isolated checks: segregation of duties between the person who initiates a payment, the person who approves it, and the person who reconciles the bank account afterward; genuine dual-signatory control over outgoing payments rather than a rule that exists on paper only; a periodic review of bank mandates so that authorised signatories and online banking access match current employees and current approval limits; and a cash flow forecast that management actually uses to decide when to draw on a facility or hold a deposit, rather than a spreadsheet built once a year for the bank.

Why this is a single topic, not four

Each of the articles in this cluster covers one balance or one procedure — bank reconciliation, cash counts, confirmations, deposits, borrowings, guarantees. Treasury controls are the layer underneath all of them: the reason a reconciliation gets reviewed every month instead of once a year, the reason a lien on a deposit gets noticed, the reason a guarantee register stays current. Weak treasury controls do not show up as a single misstatement; they show up as every other area of this cluster taking longer to audit and carrying more residual risk.

Segregation of duties over payments

1. 01Map the actual people against each role, by name, not by job titleJob titles suggest separation that does not always exist in practice, particularly in smaller finance teams where one person covers two roles during leave or a vacancy.
2. 02Check net banking user access logs against the approved signatory listMost corporate net banking platforms let you pull a list of users and their transaction limits; compare this against the board-approved list of authorised signatories, not against what the finance team believes is configured.
3. 03Test a sample of payments end to endFor each payment sampled, identify who requested it, who approved it, and who executed it, and confirm these are three different people for payments above a reasonable threshold.

Dual signatories: making sure the rule actually bites

A dual-signatory requirement is only a control if both signatures are genuinely required and genuinely independent. It is common to find a rule that reads well on paper but does not function as a real check in practice.

• Confirm the bank's own system, not just the company's internal policy, enforces the dual-signatory requirement — a payment that the bank will release on one signature is not actually dual-controlled, whatever the internal policy says.
• Check that the two signatories are not both reporting the payment request from the same source without independent review — two sign-offs obtained in sequence from the same approval email thread, with no separate verification, function as one decision wearing two signatures.
• For digital payment platforms, confirm that one signatory cannot hold both approval credentials, whether through shared logins, saved passwords, or a second signatory who delegates their login to someone else for convenience.
• Review whether the dual-signatory threshold has been set at a level that actually captures meaningful payments, or at a level so high that most day-to-day payments bypass it entirely.

Bank mandate review frequency

The bank mandate is the document on file with each bank specifying who is authorised to operate the account and at what limits. It drifts out of date constantly — an employee leaves, a signatory is promoted and their limit should change, a director resigns from the board — and banks do not automatically detect this; the company has to proactively update the mandate.

1. 01Obtain the current mandate on file with each bank and compare against the current board-approved signatory listA mandate still listing a former employee or former director as an authorised signatory is a live control gap, not a historical curiosity.
2. 02Check when the mandate was last formally reviewed and updatedA review should happen at least annually, and immediately after any change in directors, authorised signatories, or approval limits — not only when the company happens to open a new facility.
3. 03Confirm resigned directors and departed employees are removed promptly, not left on the mandate pending a formal bank visitBanks often require an in-person visit or specific board resolution to update a mandate, which creates a real incentive for companies to defer this, and the gap sits open in the meantime.

Cash flow forecasting controls

A cash flow forecast is a genuine treasury control when it is used to decide something — whether to draw on an overdraft, when to place a deposit, whether a payment can be released this week or needs to wait. It is decorative when it exists only because a lender asked for one and is updated once a year to match whatever the audited numbers eventually show.

• Ask how often the forecast is updated, and compare the forecast dates on file against the actual update frequency claimed — a forecast with a single revision date for the whole year is not a working tool.
• Compare a few historical forecasts against what actually happened, to gauge whether the forecast has any predictive value or is simply optimistic by a consistent margin.
• Check whether treasury decisions — drawing down a facility, placing a deposit, timing a large payment — are documented as having referenced the forecast, or whether they appear to be made independently of it.
• Where the company has multiple bank accounts and facilities, check whether the forecast consolidates the full picture or is built around a single main account, missing idle balances sitting in secondary accounts that could reduce borrowing costs.