3.6 Business Processes, Data Flows & Controls Over Cash and Banking
Key Takeaways
- ICAB Syllabus 2023 requires candidates to identify the main business processes of an entity and the data flows between areas of the business that need effective control systems.
- The main financially significant processes are revenue and receipts, purchases and payments, payroll, inventory and production, non-current assets, and financial reporting and the general ledger.
- Controls are most likely to fail at the handover points between processes, where data passes from one department or system to another.
- Cash and bank is the highest-risk asset because it is liquid, anonymous and universally desirable, so it requires the strictest segregation of duties and independent reconciliation.
- An independent monthly bank reconciliation, prepared and reviewed by people with no cash-handling or posting duties, is the single most important detective control over cash.
Business Processes, Data Flows & Controls Over Cash and Banking
ICAB Syllabus 2023 asks candidates to "identify the main business processes of an entity and data flows between areas of the business that need effective control systems." This is not an abstract systems-analysis exercise. It is the practical skill of looking at a company and knowing where the accounting numbers come from, who touches them and where they can go wrong.
1. The main financially significant business processes
Almost every trading or manufacturing entity can be decomposed into six processes that generate the figures in the financial statements.
| Process | What it produces in the financial statements | Departments involved |
|---|---|---|
| Revenue and receipts | Revenue, trade receivables, cash received, allowance for expected credit losses | Sales, credit control, warehouse, accounts, treasury |
| Purchases and payments | Purchases and expenses, trade payables, accruals, cash paid | Requisitioning departments, procurement, stores, accounts payable, treasury |
| Payroll | Wages and salaries, statutory deductions, provident fund and gratuity liabilities | Human resources, payroll, finance |
| Inventory and production | Inventory, cost of sales, work in progress, provisions for obsolescence | Stores, production, costing, accounts |
| Non-current assets | Property, plant and equipment, depreciation, disposals, impairment | Capital expenditure approvers, engineering, fixed asset register, accounts |
| Financial reporting and general ledger | Journals, consolidation, estimates, disclosures | Financial reporting team, CFO |
The last one is easy to overlook and is where management override typically operates. Manual top-side journals posted directly to the general ledger, outside any transaction cycle, are a standard fraud vector precisely because they bypass every process control.
2. Data flows: where control actually breaks
A data flow is the transfer of information from one part of the business, or one system, to another. Control weaknesses concentrate at these handovers because ownership is ambiguous — each side assumes the other checked.
Consider the flow from warehouse to accounts in a revenue cycle:
[Warehouse] --Goods Dispatch Note (pre-numbered)--> [Accounts]
| |
| updates inventory system | raises sales invoice, posts to
| | sales ledger and general ledger
v v
[Inventory ledger] <-- must reconcile --> [Cost of sales / revenue]
Three questions to ask of any data flow:
- Is the transfer complete? Sequence checks on pre-numbered documents, batch totals and interface exception reports answer this. If GDNs 4501 to 4520 were raised but only 18 invoices exist, two dispatches were never billed.
- Is the transfer accurate? Control totals, reconciliations between the feeder system and the general ledger, and hash totals answer this.
- Is the transfer authorised and timely? Cut-off controls ensure the transaction lands in the correct period.
Common Bangladeshi examples of weak data flows: a standalone payroll spreadsheet that is re-keyed into the accounting package each month; an inventory system in the factory that does not interface with the head office ledger; VAT records maintained separately from commercial sales invoices so that the Mushak register and the sales ledger diverge.
Interface controls — automated reconciliations between feeder systems and the general ledger, with exception reports reviewed and cleared by someone independent — are the control activity that addresses these flows.
3. Cash and banking: the highest-risk cycle
Cash is liquid, anonymous, universally desirable and easy to conceal. It therefore attracts the strictest controls in any control system, and it is heavily represented in ICAB items.
Controls over cash receipts
- Physical safeguards: cash received is banked intact and daily; a safe with dual custody; a cash-in-transit arrangement for significant sums.
- Encourage non-cash settlement: collections by BEFTN or RTGS bank transfer, or by crossed account-payee cheque, remove the physical asset from the process altogether.
- Segregation: the person who opens the post or receives cash must not post to the sales ledger, and must not perform the bank reconciliation.
- Pre-numbered receipts: issued for every collection and sequence-checked against the cash book.
- Independent listing: an immediate independent list of receipts, later agreed to the paying-in slip and the bank statement.
Controls over cash payments
- Authorised signatories with limits: for example, dual signatures required above BDT 500,000, with a documented mandate lodged with the bank.
- Payment only against a completed three-way match and cancellation of supporting documents after payment to prevent duplicate submission.
- Segregation: the person preparing the payment must not approve it, and neither should perform the bank reconciliation.
- Restricted access to payment systems and to blank cheques, which are sequentially controlled and held securely.
- Petty cash on an imprest system: a fixed float, reimbursed only for vouched expenditure, subject to unannounced counts.
The bank reconciliation
The monthly bank reconciliation is the most important detective control over cash. Its power depends entirely on who performs it. Prepared by the cashier, it is nearly worthless — the person who could steal the cash also controls the document that would reveal the theft. Prepared by someone with no cash-handling or posting duties, and reviewed and signed by a manager who investigates old or unusual reconciling items, it is the control that closes the cycle.
Reconciling items that should attract attention:
| Item | What it may indicate |
|---|---|
| Cheques unpresented for many months | Cheques never sent, or a fictitious payee |
| Deposits in transit at every month-end | Teeming and lading, or delayed banking |
| Unexplained bank charges or transfers | Unauthorised payments |
| Frequent reconciling adjustments cleared by journal | Errors being suppressed rather than investigated |
Teeming and lading
The classic cash fraud tested in this paper. An employee misappropriates a receipt from Customer A, then conceals the gap by posting a later receipt from Customer B to A's account, and so on. It survives only while the employee both handles receipts and posts the sales ledger. The controls that kill it are segregation of those two duties, independent customer statements sent directly, and an aged receivables review by a manager.
4. Documenting the flows for the audit file
Having identified the processes and flows, the auditor records them and confirms understanding by a walkthrough — tracing one transaction from initiation through every handover to the general ledger. A walkthrough tests implementation, confirming the system operates as described; it is not a test of operating effectiveness, which requires a sample.
At which point in an entity's systems are internal control weaknesses most likely to arise, and why?
A cashier at a Dhaka trading company receives customer cash, posts receipts to the sales ledger and prepares the monthly bank reconciliation. Which fraud is this arrangement most likely to permit and conceal?
An auditor traces a single sales transaction from the customer order, through credit approval, dispatch and invoicing, to the entry in the general ledger. What has the auditor performed, and what does it establish?