To audit cash, you confirm balances directly with the bank, test the client’s bank reconciliations, examine cutoff around the balance sheet date, and run fraud-focused procedures like an interbank transfer schedule and a surprise petty cash count. Because cash is the most liquid asset on the balance sheet, it draws a disproportionate share of fraud risk, and the procedures applied to it are among the most rigorous in a financial statement audit. Learning how to audit cash means learning where the account is most exposed and matching a procedure to each exposure.
What the Audit Covers
For audit purposes, cash is broader than currency. It includes bills and coins on hand, demand deposits, and any account where funds can be deposited or withdrawn at any time without penalty. Cash equivalents are short-term, highly liquid investments that convert to a known amount of cash and sit close enough to maturity that interest-rate changes pose virtually no risk to their value. In practice, scope covers every checking and savings account, money market accounts, short-term certificates of deposit, petty cash funds, and balances held with third-party payment processors like Stripe or PayPal.
The reason cash gets extra scrutiny is straightforward. It’s the one asset everyone wants. High transaction volume creates more chances for error, and extreme liquidity creates more chances for theft. A single employee with access and motivation can move cash quickly and cover the trail, which is why auditors approach the account with a level of skepticism they don’t apply to, say, fixed assets.
Assess Internal Controls First
Before touching the numbers, evaluate the company’s internal controls over cash. This step directly shapes how extensive the substantive testing needs to be. Strong, documented controls let the auditor reduce the volume of detailed transaction testing. Weak or missing controls force the auditor to compensate with more extensive procedures.1Public Company Accounting Oversight Board. AS 2301 – The Auditors Responses to the Risks of Material Misstatement
The single most important control is segregation of duties. The person who collects cash should not be the person who records it, and neither should be the person who reconciles the bank account. When one individual handles multiple steps in the cash cycle, the opportunity for fraud or undetected error rises sharply. In smaller organizations where full segregation isn’t possible, a compensating control like management review of reconciliations can partially fill the gap.
Look at whether checks above a set threshold require dual signatures, whether bank reconciliations are prepared and reviewed by separate people on a timely basis, and whether access to online banking is restricted. If control risk ends up assessed at the maximum because controls are missing or ineffective, substantive testing has to expand accordingly.
Test the Bank Reconciliations
Obtain the client’s bank statements and bank reconciliations for every account as of the balance sheet date. The first check is whether the reconciliation actually reconciles. The balance per the bank statement must trace to the statement itself. The balance per the books must trace to the general ledger. If those starting points don’t match, nothing downstream is reliable.
Once the starting figures check out, independently test every reconciling item. Outstanding checks need to be verified as legitimately issued before year-end but not yet cleared. Deposits in transit should appear on the subsequent period’s bank statement within a reasonable window. Large or unusual reconciling items deserve extra documentation and explanation from the client.
Problems tend to surface here. A reconciling item that has been sitting there for months without resolution is a red flag. So is a reconciliation that only works because of vague adjustments or rounding entries. The integrity of the client’s reconciliation is a prerequisite for everything that follows.
Confirm Balances Directly With the Bank
Direct confirmation with the financial institution is the strongest evidence available for the existence of cash. The process uses a standard confirmation form jointly approved by the American Bankers Association, the AICPA, and the Bank Administration Institute, which requests the balance on deposit for each account at the balance sheet date.2AICPA and CIMA. Standard Form to Confirm Account Balance Information with Financial Institutions
Beyond deposit balances, consider confirming other financial relationships with the institution based on the assessed risk of material misstatement. These include lines of credit, other debt, compensating balance arrangements, and contingent liabilities like guarantees.3Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation
Maintain control over the entire process. The auditor selects which accounts to confirm, sends the request directly to the bank, and receives the response directly from the bank. The client never touches the confirmation in transit. That control is what keeps the evidence from being intercepted or altered.
Electronic Confirmations
Most confirmations today move through electronic platforms rather than paper mail. When an intermediary facilitates the exchange, evaluate whether the intermediary’s controls adequately protect against interception and alteration, and whether the client has any relationship with the intermediary that could allow it to override those controls. If the security measures are inadequate and the risk can’t be addressed through other procedures, the response shouldn’t be treated as reliable.3Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation
When the Bank Doesn’t Respond
If a bank fails to return the confirmation, send second and third requests. When those also go unanswered, alternative procedures apply. For cash, the most common alternative is verifying account information by directly accessing it through the bank’s secure website or online portal.3Public Company Accounting Oversight Board. AS 2310 – The Auditors Use of Confirmation
Payment Processor Balances
Companies that receive payments through platforms like Stripe hold balances that function as cash but sit outside traditional bank accounts. For these, request read-only dashboard access from the client, navigate to the balance summary reports, confirm the correct account is displayed, set the appropriate date range, and verify the balance. The client can revoke access once the audit is complete.4Stripe. Fulfill a Balance Confirmation Request by an External Audit Firm
Cutoff Testing Around Year-End
Cutoff testing verifies that cash receipts and disbursements land in the correct accounting period. Getting the cutoff wrong inflates or deflates the year-end balance, and deliberate manipulation here is one of the most common ways companies dress up their financial position.
Examine bank statements for the days immediately before and after the balance sheet date and compare the dates the bank recorded each transaction against the dates the company recorded them in the general ledger. Cash the company booked as received before year-end should show up as a bank deposit within a reasonable window. Checks recorded before year-end should clear the bank in the subsequent period’s statement.
A common manipulation involves holding the books open past the cutoff date to record receipts that actually arrived in the next period, which inflates both cash and revenue. The reverse works too: recording disbursements early understates cash and creates the appearance of lower liabilities. Either pattern, once identified, requires quantifying the misstatement and assessing whether it’s material.
A related tool is the bank cutoff statement, a bank statement dated shortly after year-end that the client requests but the bank sends directly to the auditor. That statement lets the auditor trace which outstanding checks from the year-end reconciliation actually cleared and spot any checks that cleared in January but never appeared on the outstanding check list, a pattern that points to kiting or unrecorded liabilities.
Interbank Transfer Schedule for Kiting
Kiting exploits the delay between depositing a check at one bank and having it clear at another. A company with accounts at two banks writes a check from Bank A and deposits it at Bank B near year-end. If Bank B records the deposit before Bank A processes the withdrawal, the same money appears in both accounts simultaneously, inflating total cash.
The primary defense is an interbank transfer schedule. It lists every transfer between the company’s bank accounts for several days before and after year-end. For each transfer, it captures four dates: when the withdrawal was recorded in the books, when it appeared on Bank A’s statement, when the deposit was recorded in the books, and when it appeared on Bank B’s statement.
The tell is a timing mismatch. If the deposit shows up in the current period but the withdrawal doesn’t get recorded until the next period, cash is double-counted. Legitimate transfers have both sides recorded in the same accounting period. Any discrepancy demands immediate follow-up, and the scope of the schedule should widen for accounts whose banks take longer to process transfers, such as international accounts.
Count the Petty Cash
Petty cash is a small fund, but its vulnerability to theft is outsized. Conduct the physical count as a surprise, without advance notice to the custodian. The custodian must be present throughout to witness the count and acknowledge the results.
Count all physical currency and coins, then add the value of all paid vouchers and receipts currently in the fund. That total must match the established imprest balance recorded in the general ledger exactly. A shortage suggests either a control breakdown or outright theft. An overage, while less alarming, still indicates sloppy record-keeping that needs correction.
Even when the fund balances perfectly, review the vouchers for proper authorization, reasonable business purpose, and sequential numbering. Watch for vouchers without receipts, vouchers approved by the custodian rather than a supervisor, and frequent replenishments that seem disproportionate to the business activity the fund is supposed to support.
Proof of Cash When Standard Reconciliation Isn’t Enough
A proof of cash reconciles four components rather than one: the beginning balance, all receipts during the period, all disbursements during the period, and the ending balance. Each column reconciles the bank’s figures to the books.
The procedure is particularly useful when transactions may be recorded in the wrong period or when the bank reconciliation itself may have been manipulated. By tying together all four elements, it catches discrepancies a standard ending-balance reconciliation would miss. If deposits in transit from the beginning of the period never actually cleared, or if outstanding checks from the prior month were quietly removed from the list, the proof of cash will reveal the gap.
It’s typically deployed when internal controls over cash are weak, when prior-period reconciliation issues went unresolved, or when there are specific fraud concerns. It’s time-intensive, which is why it’s reserved for situations where the standard reconciliation doesn’t provide enough assurance.
Restricted Cash and Compensating Balances
Not all cash a company holds is freely available. Restricted cash includes funds that cannot be withdrawn or used because of legal agreements, regulatory requirements, or contractual obligations. Common examples include escrow deposits, cash pledged as collateral, and funds held to satisfy debt covenants.
Compensating balances raise a related issue. Some lending agreements require the borrower to maintain a minimum balance with the lending bank. If that arrangement legally restricts the company’s ability to use the funds, the balance should be classified as restricted cash rather than reported as part of general cash. Cash restricted in connection with long-term debt should typically be classified as a noncurrent asset.
Audit procedures here include confirming the restriction directly with the bank, reading the relevant loan agreements or contracts, and verifying that financial statement presentation and footnote disclosures properly reflect the nature and amount of any restrictions. Restricted cash must be reconciled separately and included in the statement of cash flows alongside unrestricted cash, with a clear reconciliation to the balance sheet amounts.
Fraud Red Flags to Watch For
Fraud consideration runs throughout the engagement, not just when something looks obviously wrong. Several patterns should trigger heightened skepticism around cash and disbursements:
- Vendor anomalies, including suppliers with post office box addresses, residential addresses matching employee addresses, or multiple remittance addresses for the same vendor.
- Invoice irregularities, such as unfolded invoices that were never mailed, invoices from different vendors on identical stationery, and recurring identical amounts from the same vendor that fall just below approval thresholds.
- Unexplained trends, like payments to a vendor increasing dramatically without a corresponding change in business activity, or numerous entries in suspense accounts during the year.
- Control gaps, including no separation between the person who processes invoices and the person who updates vendor master files, or between the person who prepares checks and the person who mails them.
These indicators come from the Department of Defense Inspector General’s fraud detection resources and reflect patterns that surface repeatedly across industries.5DoD Office of Inspector General. Fraud Red Flags
When Fraud Evidence Surfaces
When evidence suggests fraud may exist, bring it to the attention of management at an appropriate level, even if the matter seems minor. Fraud involving senior management, or any fraud that causes a material misstatement, must be reported directly to the audit committee before the audit report is issued.6Public Company Accounting Oversight Board. AS 2401 – Consideration of Fraud in a Financial Statement Audit
Obligations don’t stop at internal reporting. Fraud risks with ongoing control implications must be evaluated as potential significant deficiencies or material weaknesses and communicated to both senior management and the audit committee. For public companies, there may also be a legal obligation to report to the SEC, particularly when the engagement is terminated or the matter involves an illegal act under Section 10A of the Securities Exchange Act.
Evaluating What You Found
As testing progresses, accumulate every misstatement identified in cash procedures, excluding only those that are clearly trivial. Clearly trivial is a high bar: inconsequential by any measure of size, nature, or circumstances, not simply below the materiality threshold.7Public Company Accounting Oversight Board. AS 2810 – Evaluating Audit Results
The accumulation includes specifically identified errors and the best estimate of total misstatement in the tested accounts, including projected misstatements from sampling. If accumulated misstatements start approaching planning materiality, reassess whether the overall audit strategy needs to change, which usually means performing additional procedures.
At the end, evaluate whether any uncorrected misstatements, individually or combined, are material to the financial statements as a whole. That evaluation weighs both dollar amount relative to materiality and qualitative factors such as whether the misstatement masks a trend, converts a loss into a profit, or affects compliance with debt covenants. A cash misstatement that’s small in dollar terms but changes the direction of a key metric can still be material.