How to Audit Cash: Controls, Confirmations, and Red Flags

To audit cash, you confirm balances directly with every financial institution the company uses, test the client’s bank reconciliations against source documents, run cutoff procedures around the balance sheet date, prepare an interbank transfer schedule to detect kiting, count petty cash on a surprise basis, and verify that restricted balances are classified and disclosed correctly. Each of these procedures ties back to one or more assertions about the reported cash figure, and the depth of testing depends on how much the auditor can rely on the company’s internal controls.

Cash is the most liquid asset on a balance sheet, which is exactly why it draws the most fraud risk and the most rigorous procedures in a financial statement audit.

What the Cash Account Covers

The audit scope for cash is broader than the currency in a register. It includes currency on hand, demand deposits, and any account where funds can be deposited or withdrawn at any time without penalty. Cash equivalents fall in too: short-term, highly liquid investments so close to maturity that interest-rate changes pose virtually no risk to their value. In practice, that means every checking and savings account, money market accounts, short-term certificates of deposit, petty cash funds, and balances held with third-party payment processors like Stripe or PayPal.

High transaction volume creates more opportunities for error. Extreme liquidity creates more opportunities for theft. A single employee with access and motivation can move cash quickly and cover the trail, which is why the account is approached with a level of skepticism not applied to fixed assets.

The Assertions Every Procedure Serves

Every cash procedure maps back to the claims management makes when it presents the number:

Existence or occurrence: the cash on the balance sheet actually exists at the reporting date, and recorded transactions actually happened.
Completeness: every cash transaction that should be in the financial statements is included.
Valuation: cash is recorded at the correct amount, including proper translation of foreign currency balances.
Rights and obligations: the company holds or controls the rights to the reported cash. Funds held in trust for someone else do not belong in the unrestricted balance.
Presentation and disclosure: cash is properly classified, and any restrictions on its use are disclosed.

Bank confirmations primarily address existence. Cutoff testing addresses completeness and occurrence. Knowing which assertion a test covers keeps the program efficient and closes gaps before they open.¹

Evaluating Internal Controls Over Cash

Before testing balances, evaluate the company’s controls. This step shapes how extensive the substantive procedures need to be. Strong, well-documented controls let you reduce transaction testing. Weak or missing controls force you to compensate with more.²

Segregation of duties is the single most important control. The person who collects cash should not be the same person who records it, and neither should be the person who reconciles the bank account. When one individual handles multiple steps in the cash cycle, the opportunity for fraud or undetected error rises sharply. In smaller organizations where full segregation is impossible, a compensating control such as management review of reconciliations can partially fill the gap.

Look at whether the company requires dual signatures on checks above a threshold, whether bank reconciliations are prepared and reviewed by separate people on a timely basis, and whether online banking access is restricted. If control risk ends up at the maximum because controls are missing or ineffective, substantive testing has to expand to compensate.²

Testing the Bank Reconciliations

Obtain the client’s bank statements and reconciliations for every account as of the balance sheet date. The first job is confirming that the reconciliation actually reconciles. The balance per the bank statement must trace to the statement itself. The balance per the books must trace to the general ledger. If the starting points don’t match, nothing downstream is reliable.

Once those tie, independently test every reconciling item. Outstanding checks need to be verified as legitimately issued before year-end but not yet cleared. Deposits in transit should appear on the subsequent period’s bank statement within a reasonable window. Large or unusual reconciling items deserve extra documentation and explanation.

A reconciling item that’s been sitting for months without resolution is a red flag. So is a reconciliation that only “works” because of vague adjustments or rounding entries. If the reconciliation doesn’t hold up, understand why before moving to external verification.

Confirming Balances With the Bank

Direct confirmation with the financial institution is the strongest evidence available for the existence of cash. The process uses a standard confirmation form jointly approved by the American Bankers Association, the AICPA, and the Bank Administration Institute. The form requests the balance on deposit for each account at the balance sheet date.³

Depending on the assessed risk, you should also consider confirming other financial relationships with the institution: lines of credit, other debt, compensating balance arrangements, and contingent liabilities like guarantees.⁴

Maintain control over the entire confirmation process. You select which accounts to confirm, you send the request directly to the bank, and you receive the response directly from the bank. The client never touches the confirmation in transit. That control prevents interception or alteration.⁴

Electronic Confirmations

Most confirmations now move through electronic platforms rather than paper mail. When an intermediary facilitates the electronic exchange, evaluate whether the intermediary’s controls adequately protect against interception and alteration, and assess whether the client has any relationship with the intermediary that could allow it to override those controls. If security measures are inadequate and the risk can’t be addressed through other procedures, the response shouldn’t be treated as reliable.⁴

When the Bank Doesn’t Respond

If a bank fails to return the confirmation, send second and third requests. When those also go unanswered, alternative procedures are required. For cash, the most common alternative is verifying the account information by directly accessing it through the bank’s secure website or online portal.⁴

Balances Held With Payment Processors

Companies receiving payments through platforms like Stripe hold balances that are functionally cash but sit outside traditional bank accounts. You can request read-only dashboard access from the client, navigate to the balance summary reports, confirm the correct account is displayed, set the appropriate date range, and verify the balance directly. The client can revoke access once the audit is complete.⁵

Cutoff Testing

Cutoff testing verifies that cash receipts and disbursements land in the correct accounting period. Getting the cutoff wrong inflates or deflates the year-end balance, and deliberate manipulation here is one of the most common ways companies dress up their financial position.

Examine bank statements for the days immediately before and after the balance sheet date. Compare the dates the bank recorded each transaction against the dates the company recorded them in the general ledger. Cash the company booked before year-end should show up as a bank deposit within a reasonable window. Checks recorded before year-end should clear the bank in the subsequent period’s statement.

A common manipulation is holding the books open past the cutoff to record receipts that actually arrived in the next period, which inflates both cash and revenue at year-end. The reverse trick works too: recording disbursements early can understate cash and create the appearance of lower liabilities. Either pattern, once identified, has to be quantified and evaluated for materiality.

The bank cutoff statement supports this work. It’s a bank statement dated shortly after year-end, requested by the client but sent directly to the auditor. Use it to trace which outstanding checks from the year-end reconciliation actually cleared, and to spot any checks that cleared in January but never appeared on the outstanding check list. That pattern points to kiting or unrecorded liabilities.

Interbank Transfer Schedule for Kiting

Kiting exploits the delay between depositing a check at one bank and having it clear at another. A company with accounts at two banks writes a check from Bank A and deposits it at Bank B near year-end. If Bank B records the deposit before Bank A processes the withdrawal, the same money appears in both accounts at once, inflating the total.

The primary defense is an interbank transfer schedule listing every transfer between the company’s bank accounts for several days before and after year-end. For each transfer, capture four dates: when the withdrawal was recorded in the books, when it appeared on Bank A’s statement, when the deposit was recorded in the books, and when it appeared on Bank B’s statement.

The tell is a timing mismatch. If the deposit shows up in the current period but the withdrawal isn’t recorded until the next period, cash is double-counted. Legitimate transfers have both sides recorded in the same accounting period. Adjust the window based on how long the company’s banks typically take to process transfers; international accounts need a wider window than domestic ones.

Counting Petty Cash

Petty cash is a small fund with outsized vulnerability to theft. Conduct the physical count as a surprise, without advance notice to the fund custodian. The custodian must be present throughout the count to witness the results and acknowledge the findings.

Count all physical currency and coins, then add the value of all paid vouchers and receipts currently in the fund. The total must match the established imprest balance recorded in the general ledger exactly. A shortage suggests either a control breakdown or theft. An overage, while less alarming, still indicates sloppy record-keeping that needs correction.

Even when the fund balances perfectly, review vouchers for proper authorization, reasonable business purpose, and sequential numbering. Investigate vouchers without receipts, vouchers approved by the custodian rather than a supervisor, and frequent replenishments that seem disproportionate to the business activity the fund is supposed to support.

The Proof of Cash

A proof of cash reconciles four components rather than one: the beginning balance, all receipts during the period, all disbursements during the period, and the ending balance. Each column reconciles the bank’s figures to the company’s books.

This procedure is particularly useful when transactions may be recorded in the wrong period or when the standard bank reconciliation may have been manipulated. By tying all four elements together, the proof of cash catches discrepancies a standard ending-balance reconciliation would miss. If deposits in transit from the beginning of the period never actually cleared, or if outstanding checks from the prior month were quietly removed from the list, the proof of cash reveals the gap.

Deploy it when controls over cash are weak, when prior-period reconciliation issues went unresolved, or when there are specific concerns about fraud. It’s time-intensive, which is why it’s reserved for situations where the standard reconciliation doesn’t provide enough assurance.

Restricted Cash and Compensating Balances

Not all cash a company holds is freely available. Restricted cash includes funds that cannot be withdrawn or used due to legal agreements, regulatory requirements, or contractual obligations. Escrow deposits, cash pledged as collateral, and funds held to satisfy debt covenants are typical examples.

Compensating balances present a related issue. Some lending agreements require the borrower to maintain a minimum balance with the lending bank. If that arrangement legally restricts the company’s ability to use the funds, the balance should be classified as restricted cash rather than reported as part of the general cash balance. Cash restricted in connection with long-term debt should typically be classified as a noncurrent asset.

Confirm the restriction directly with the bank, which is one reason the confirmation process asks about more than deposit balances. Read the relevant loan agreements or contracts. Verify that the financial statement presentation and footnote disclosures properly reflect the nature and amount of any restrictions. Restricted cash must be reconciled separately and included in the statement of cash flows alongside unrestricted cash, with a clear reconciliation to the balance sheet amounts.

Fraud Indicators to Watch

The possibility of fraud has to be considered throughout every engagement, not only when something looks obviously wrong. For cash, certain patterns should trigger heightened skepticism:

Vendor anomalies: suppliers with post office box addresses, residential addresses matching employee addresses, or multiple remittance addresses for the same vendor.
Invoice irregularities: unfolded invoices that were never mailed, invoices from different vendors on identical stationery, and recurring identical amounts from the same vendor that fall just below approval thresholds.
Unexplained trends: payments to a vendor increasing dramatically without a corresponding change in business activity, or numerous entries in suspense accounts during the year.
Control gaps: no separation between the person who processes invoices and the person who updates vendor master files, or between the person who prepares checks and the person who mails them.

These indicators come from the Department of Defense Inspector General’s fraud detection resources and reflect patterns that surface repeatedly across industries.⁶

Reporting Fraud Findings

When evidence suggests fraud may exist, bring it to the attention of management at an appropriate level, even if the matter seems minor. Fraud involving senior management, or any fraud that causes a material misstatement, must be reported directly to the audit committee before the audit report is issued.⁷

If fraud risks carry ongoing control implications, evaluate them as potential significant deficiencies or material weaknesses and communicate them to both senior management and the audit committee. For public companies, there may also be a legal obligation to report to the SEC, particularly when the engagement is terminated or when the matter involves an illegal act under Section 10A of the Securities Exchange Act.⁷

Evaluating Misstatements at the End

Accumulate every misstatement identified in cash testing, excluding only those that are clearly trivial. That accumulation includes not just specifically identified errors but also your best estimate of total misstatement in the tested accounts, including projected misstatements from sampling. If accumulated misstatements start approaching the materiality level used in planning, reassess whether the overall audit strategy requires modification, which usually means performing additional procedures.⁸

The final step is evaluating whether any uncorrected misstatements, individually or combined, are material to the financial statements as a whole. That evaluation considers both quantitative factors (the dollar amount relative to materiality) and qualitative factors (whether the misstatement masks a trend, changes a loss into a profit, or affects compliance with debt covenants). A cash misstatement that’s small in dollar terms but changes the direction of a key metric can still be material.⁸

1
Public Company Accounting Oversight Board. AS 1105 – Audit Evidence
2
Public Company Accounting Oversight Board. AS 2301 – The Auditors Responses to the Risks of Material Misstatement
3
AICPA and CIMA. Standard Form to Confirm Account Balance Information with Financial Institutions
4
Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation
5
Stripe. Fulfill a Balance Confirmation Request by an External Audit Firm
6
DoD Office of Inspector General. Fraud Red Flags
7
Public Company Accounting Oversight Board. AS 2401 – Consideration of Fraud in a Financial Statement Audit
8
Public Company Accounting Oversight Board. AS 2810 – Evaluating Audit Results