Auditing Cash: The Why and How Guide

By Charles Hall | Auditing

Mar 11

Auditing cash tends to be straightforward. We usually just obtain the bank reconciliations and test them. We send confirmations and vouch the outstanding reconciling items to the subsequent month’s bank statement. But are such procedures always adequate? Hardly. 

Recall the Parmalat and ZZZZ Best Carpet Cleaning frauds. In those businesses, the theft of cash was covered up with fake bank statements and fake confirmation responses. Millions were lost and reputations we’re sullied.

How to Audit Cash

In this post, we will take a look auditing cash including:

  • Primary cash assertions
  • Cash walkthrough
  • Directional risk for cash
  • Primary risks for cash
  • Common cash control deficiencies
  • Risk of material misstatement for cash
  • Substantive procedures for cash
  • Common cash work papers

Primary Cash Assertions

The primary relevant cash assertions are:

  • Existence
  • Completeness
  • Rights
  • Accuracy
  • Cutoff


YouTube player


Of these assertions, I believe existence, accuracy, and cutoff are most important. The audit client is asserting that the cash balance exists, that it’s accurate, and that only transactions within the period are included.

Classification is normally not a relevant assertion. Cash is almost always a current asset. But when bank overdrafts occur, classification can be in play. The negative cash balance can be presented as cash or as a payable depending on the circumstances.

Cash Walkthrough

As we perform walkthroughs of cash, we normally look for ways that cash might be overstated (though it can also be understated as well). We are asking, “What can go wrong?” whether intentionally or by mistake.


YouTube player


In performing cash walkthroughs, ask questions such as:

  • Are timely bank reconciliations performed by competent personnel?
  • Are all bank accounts reconciled?
  • Are the bank reconciliations reviewed by a second person?
  • Are all bank accounts on the general ledger?
  • Are transactions appropriately cut off at period-end (with no subsequent period transactions appearing in the current year)?
  • Is there appropriate segregation between persons handling cash, recording cash, making payments, and  reconciling the bank statements
  • What bank accounts were opened in the period?
  • What bank accounts were closed in the period?
  • Are there any restrictions on the bank accounts?
  • What persons are on the bank signature cards?
  • Who has the authority to open and/or close bank accounts?
  • What is the nature of each bank account (e.g., payroll bank account)?
  • Are there any cash equivalents (e.g., investments of less than three months)
  • Were there any held checks (checks written but unreleased) at period-end?

As we ask questions, we also inspect documents (e.g., bank reconciliations) and make observations (who is doing what?).

If controls weaknesses exist, we create audit procedures to address them. For example, if during the walkthrough we review three monthly bank reconciliations and they all have obvious errors, we will perform more substantive work to prove the year-end bank reconciliation. For example, we might vouch every outstanding deposit and disbursement.

Directional Risk for Cash

What is directional risk in auditing cash? It’s the potential bias that a client has regarding an account balance. A client might desire an overstatement of assets and an understatement of liabilities  since each makes the balance sheet appear healthier.

The directional risk for cash is overstatement. So, in performing your audit procedures, perform procedures such as testing the bank reconciliation to ensure that cash is not overstated.

Primary Risks for Cash

The primary risks are:

  1. Cash is stolen
  2. Cash is intentionally overstated to cover up theft
  3. Not all cash accounts are on the general ledger
  4. Cash is misstated due to errors in the bank reconciliation
  5. Cash is misstated due to improper cutoff

Auditing cash

Common Cash Control Deficiencies

In smaller entities, it is common to have the following control deficiencies:

  • One person receipts and/or disburses monies, records those transactions in the general ledger, and reconciles the related bank accounts
  • The person performing the bank reconciliation does not possess the skill to perform the duty
  • Bank reconciliations are not timely performed

Risk of Material Misstatement for Cash

In my smaller audit engagements, I usually assess control risk at high for each assertion. If control risk is assessed at less than high, then controls must be tested to support the lower risk assessment. Assessing risks at high is usually more efficient than testing controls.

When control risk is assessed at high, inherent risk becomes the driver of the risk of material misstatement (control risk X inherent risk = risk of material misstatement). For example, if control risk is high and inherent risk is moderate, then my RMM is moderate.

The assertions that concern me the most are existence, accuracy, and cutoff. So my RMM for these assertions is usually moderate to high.

My response to higher risk assessments is to perform certain substantive procedures: namely, bank confirmations and testing of the bank reconciliations. As RMM increases I examine more of the period-end bank reconciliations and more of the outstanding reconciling items. Also, I am more inclined confirm the balances.

A common mistake is for auditors to document the risk assessment for all assertions together, like this:

AssertionInherent RiskControl RiskRisk of Material Misstatement
E/O; CU; R/O; A/V; P/DHighHighHigh

It is best to assess risk for each individual assertion. For example, if existence, accuracy, and cutoff are relevant assertions, you would have a row for each of the three assertions. 

Substantive Procedures for Cash

My customary audit tests are as follows:

  1. Confirm cash balances
  2. Vouch reconciling items to the subsequent month’s bank statement
  3. Ask if all bank accounts are included on the general ledger
  4. Inspect final deposits and disbursements for proper cutoff

The auditor should send confirmations directly to the bank. Some individuals create false bank statements to cover up theft. Those same persons provide false confirmation addresses. Then the confirmation is sent to an individual (the fraudster) rather than a bank. Once received, the fraudster replies to the confirmation as though the bank is doing so. You can lessen the chance of fraudulent confirmations by using, a company that specializes in bank confirmations. Alternatively, you might Google the confirmation address to verify its existence.

Agree the confirmed bank balance to the period-end bank reconciliation (e.g., December 31, 20X7). Then, agree the reconciling items on the bank reconciliation to the bank statement subsequent to the period-end. For example, examine the January 20X8 bank statement activity when clearing the December 20X7 reconciling items. Finally, agree the reconciled balance to the general ledger cash balance for the period-end (e.g., December 31, 20X7).

Cut-off bank statements (e.g., January 20, 20X8 bank statement) may be used to test the outstanding items. Such statements, similar to bank confirmations, are mailed directly to the auditor. Alternatively, the auditor might examine the reconciling items by viewing online bank statements. (Read-only rights can be given to the auditor.)

Common Cash Work Papers

My cash work papers normally include the following:

  • An understanding of cash-related internal controls
  • Risk assessment of cash assertions at the assertion level
  • Documentation of any control deficiencies
  • Cash audit program
  • Bank reconciliations for each significant account
  • Bank confirmations

Auditing Cash 

We’ve discussed how to perform cash risk assessment procedures, the relevant cash assertions, the cash risk assessments, and substantive cash procedures.

Next we’ll examine how to audit receivables and revenues.

Get Your Copy of The Why and How of Auditing

Click the book below to see it on Amazon.

Click the book cover to see The Why and How of Auditing on Amazon.


About the Author

Charles Hall is a practicing CPA and Certified Fraud Examiner. For the last thirty-five years, he has primarily audited governments, nonprofits, and small businesses. He is the author of The Little Book of Local Government Fraud Prevention, The Why and How of Auditing, Audit Risk Assessment Made Easy, and Preparation of Financial Statements & Compilation Engagements. He frequently speaks at continuing education events. Charles consults with other CPA firms, assisting them with auditing and accounting issues.

  • Charles Hall says:

    TS, you probably need a CPA that lives near your place of business, preferably someone that audits several companies. I’m not sure what your locale is, but I would ask around in the business community for a CPA with extensive audit experience.

  • TS Hughes says:

    I would like a professional to come audit our practices in person. From our tils, to recording procedures, how it reaches the deposit box. How can I go about finding a reputable auditor?

  • Charles Hall says:

    This is usually done as a fraud detection procedure to see if the company is shuffling funds into accounts temporarily. Say, a bank loan requires $1,000,000 in a reserve cash account, but the company only had $600,000 in it most of the year. Then they might move funds at year-end.

  • Charles Hall says:

    Nonkululeko, it’s fine to point this out as you discover it (during walkthrough phase of the engagement) rather than waiting until you audit cash.

  • Nonkululeko Msimango says:

    Hi Charles

    My client reconciliation has an incorrect balance as per bank statement, do I raise that as a finding during my walkthrough or wait until execution to raise it?

  • Charles Hall says:

    Zach, that is a fraud detection procedure to see if management is doing anything fishy in the last days of the year. Management might move funds around to different bank accounts to make them look as they should. For instance, say a bank loan requires so much money in a particular account, then the company could temporarily move cash to that account. This is not a procedure that I commonly do.

  • Zach says:

    Thank you for the article. Question, we often review the last five days of the December bank statement as well, what is the purpose of that?

  • Charles Hall says:

    Anthony, I believe I would write a request letter to the bank asking for all bank accounts; of course, the client will need to sign it. You’ll want the bank to respond directly to you.

  • Charles Hall says:

    You are welcome, Ara.

  • Charles Hall says:

    You are welcome, Mariam.

  • Charles Hall says:

    Mazi, I only sell the book through Amazon. If you can order from there, that will work. Thanks.

  • Mazi Mossu says:

    how can i get the book Mr charles????? Am from Ethiopia please contact me 0940030749

  • Mariam Nabbuye says:

    THANKS Charles

  • Ara says:

    Thank you for this

  • Anthony says:

    Hi Charles,

    Thanks for this post. What procedures would you recommend when testing for incomplete cash on the client’s general ledger (IE identifying a bank account opened by the fraudster as their “slush” fund that is not reported anywhere in the books)? does not appear to have a confirmation template that would allow for an auditor to request the financial institution to provide all bank account #’s in the client’s name.


  • Geo says:

    This was really helpful.

  • Charles Hall says:

    Kenna, I would advise the client that the audit can’t be performed until the bank statements are reconciled. Unreconciled bank accounts can lead to all sorts of improper balances—-in the bank account, but also in revenues, expenses, other asset and liability accounts.

  • Kenna says:

    What if client has not reconciled Bank statement ?

  • >