15.3 Internal Controls, Ethical Safeguards, and Fraud Prevention in Local Treasury

Internal Controls, Ethical Safeguards, and Fraud Prevention

Control objectives

Local-treasury controls should provide reasonable assurance that collections are lawful and complete, assets are safeguarded, payments are authorized, reports are reliable, and officials comply with law. Controls must work in daily operations, not exist only in a manual.

A useful structure covers the control environment, risk assessment, control activities, information and communication, and monitoring. Leadership sets expectations; process owners identify where funds, forms, credentials, or data can be stolen or misstated; controls address those risks; exceptions are reported; and independent review tests whether controls actually operate.

Segregation and compensating review

Separate incompatible functions:

• authorization of a transaction;
• physical or electronic custody of cash and payment instruments;
• accounting and posting;
• bank reconciliation; and
• supervisory or independent review.

The treasurer's custody and funds-availability role should remain distinct from the accountant's recording and obligation role and from the budget officer's appropriation certification. In a small office where perfect separation is impossible, use documented supervisory review, dual control, restricted access, independent cash counts, and timely higher-level reconciliation.

Receipt and deposit controls

Issue only authorized, sequentially controlled receipts. Account for issued, voided, spoiled, and unused forms. Compare collection-system totals with reports of collections and deposits, validated bank credits, and ledger postings. Deposit collections intact and promptly. Prohibit IOUs, personal-check accommodation, netting expenses from collections, and delayed receipting.

Control electronic collections through approved merchant or bank arrangements, unique credentials, maker-checker approval, immutable transaction logs, settlement reconciliation, and investigation of reversals and chargebacks. Cyber controls are custody controls when electronic value and credentials can move public funds.

Disbursement and payee controls

Require complete supporting evidence, statutory certifications, beneficiary verification, and duplicate-payment checks. Never pre-sign blank checks or approve an electronic batch without reviewing its details. Checks payable to “Cash” are prohibited. A petty-cash replenishment must be payable to the named bonded petty-cash custodian; a payroll cash advance must be payable to the named bonded disbursing officer. Naming the accountable person is the control—those transactions are not exceptions allowing “Cash” as payee.

Track issued, released, cancelled, stale, and outstanding payments and reconcile them to the bank and ledger. Independently verify changes to vendor bank details. Recover or revoke access immediately after reassignment or separation.

Monitoring and response

Surprise cash counts, mandatory leave or rotation where validly adopted, exception reports, and complaint channels can expose concealed schemes. Rotation is useful only when duties are properly handed over and the replacement performs an independent check; moving two colluding employees together proves nothing.

When an exception appears, preserve evidence, restrict access proportionately, reconcile the account, notify proper authorities, and avoid public accusations before findings. Correct the control weakness as well as the individual transaction.

Accountability is role-specific. Delegation does not excuse a supervisor who ignored known red flags or failed required duties, but it also does not make a treasurer automatically personally liable whenever a subordinate steals. Apply PD 1445, RA 7160, COA rules, Madera, administrative law, and criminal law according to each person's duty, acts, diligence, participation, and the forum involved.

Designing and testing a control matrix

Map each material process across authorization, custody, recording, reconciliation, and review. For collections, separate rate and account setup, receipt, cancellation or refund approval, deposit, posting, and bank reconciliation. For disbursements, separate request, procurement, inspection and acceptance, voucher preparation, certifications, payment release, recording, and reconciliation. For accountable forms and system credentials, assign issuance, physical custody, inventory, access administration, and independent review. Where staffing makes full separation impossible, document the conflict and install a specific compensating review by someone with authority and evidence access.

Access should follow least privilege and current assignment. Require individual credentials, multifactor protection where available, timely removal on transfer or separation, and periodic recertification by process owners. Log changes to rates, taxpayer master data, payees, bank accounts, receipt cancellations, and journal entries. A supervisor's password used by several employees destroys attribution even if every transaction is later approved. Physical safeguards—controlled keys, vault access logs, counts, serial inventories, and secure transport—must agree with the digital record.

Test controls rather than assuming a written procedure operates. Select transactions, trace approvals and timestamps, reperform reconciliations, inspect exception follow-up, and confirm that reviewers were independent and timely. Track deficiencies to an owner and due date and verify closure. Repeated unexplained reconciling items, override activity, missing sequences, and unusually round or after-hours entries are signals for investigation, not automatic proof of fraud.