Internal Controls over Cash: A Simple Guide

Internal controls over cash are the policies and procedures that protect money, keep cash records accurate, and make sure payments are authorized. Key examples include segregation of duties (splitting key tasks among different people), prompt deposits, approved and documented payments, secure custody, and independent bank reconciliations. Together, they give reasonable assurance, not a guarantee, that cash is safe.

Cash is easy to transfer and difficult to recover after misuse. Reliable controls also tell managers how much money is available to pay bills. This guide covers the controls you study in Intermediate Accounting and for professional exams: cash receipts, cash payments, bank accounts, and safeguards. All examples and practice questions are hypothetical.

Why does this matter? In the Association of Certified Fraud Examiners (ACFE) study Occupational Fraud 2026: A Report to the Nations, asset misappropriation appeared in 90% of the 2,402 cases examined. Asset misappropriation means stealing or misusing an organization’s resources, including cash. The report also links anti-fraud controls with lower losses and faster detection.

What Should Internal Controls over Cash Accomplish?

Start with two questions: Is the money protected, and are the records dependable? A locked cash drawer helps answer the first. Comparing receipts, deposits, and ledger balances helps answer the second. Neither procedure replaces the other.

Authorization means approval by someone with assigned authority. Custody means physical possession or access to funds. Recordkeeping means entering transactions in the accounting system. Segregation of duties, also called separation of duties, means giving these jobs to different people. It reduces the opportunity for one person to take money and conceal the loss. Many organizations also treat reconciliation, which means comparing two sets of records and explaining any differences, as a fourth duty to keep separate.

For example, the employee who holds petty cash should not also approve and record the reimbursement. A different employee reviews the supporting receipts. Where staffing is limited, a supervisor can perform a detailed independent review. Controls provide reasonable assurance, not a guarantee that mistakes or collusion will never occur.

Where do these ideas come from? A widely used model is the Internal Control – Integrated Framework from COSO, the Committee of Sponsoring Organizations of the Treadway Commission. COSO issued it in 1992 and refreshed it in 2013. It has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Most of the cash procedures on this page are control activities, the specific actions that carry out management’s directions.

Public companies also face a legal requirement. Section 404 of the Sarbanes-Oxley Act requires management to report each year on internal control over financial reporting. Private companies that are not SEC reporting issuers generally are not subject to Section 404, but the same control ideas still protect their cash.

Internal Control Examples at a Glance

Controls usually do one of two jobs. Preventive controls stop a problem before it happens. Detective controls find a problem after it happens. Strong systems use both.

How Do Companies Control Cash Receipts?

Cash receipts are most at risk before anyone records them. Once a record exists, missing money is much easier to trace. Good procedures create that record right away.

Over-the-counter sales

• Enter each sale in a cash register or point-of-sale system when it happens.
• Give every customer a receipt.
• Have someone else compare the register total with the cash counted. Record any difference in Cash Over and Short, an account reported on the income statement.

Payments received by mail

• Have two people open the mail together. This is called dual control.
• Stamp each check right away with a restrictive endorsement, such as “For Deposit Only.”
• List the payments received, then share that list with the people who deposit and record them.

All cash receipts

• Deposit receipts promptly and intact, which means without paying expenses out of them first.
• Have someone who does not handle the cash compare recorded receipts with bank deposits.

Example: recording a cash shortage

A shop’s register shows cash sales of $1,250 for the day. After removing the starting change, the drawer holds $1,240. The $10 shortage goes to Cash Over and Short.

A shortage is a debit, and an overage is a credit. One small shortage may be a simple mistake. Repeated shortages at the same register deserve a closer look.

How Do Companies Control Cash Payments?

Cash payments, also called disbursements, need a different focus. The goal is to make sure money leaves only for a real, approved obligation.

• Pay by check or electronic transfer. Use currency only for small petty cash items.
• Approve before paying. A three-way match compares the invoice, purchase order, and receiving report.
• Separate duties. The person who approves a payment should not also release it, record it, or reconcile the account.
• Require extra approval for large payments, such as two signatures on a check.
• Control checks and payment logins. Use prenumbered checks, mark spoiled checks void, and limit who can release electronic payments.
• Verify changes to vendor bank details by calling a phone number you already have on file.
• Use bank fraud tools. Positive pay compares checks presented for payment with your list of issued checks and holds mismatches for review. ACH debit blocks and filters control which companies can pull money from your account electronically.

These tools have limits. If your own team approves a fake vendor’s invoice and issues a check, positive pay will likely see a match. That is why approval controls still matter.

Which Bank Accounts Help Control Cash?

Different accounts serve different operating needs. More accounts do not automatically produce stronger control; each account needs a clear purpose, responsible employees, and reconciliation.

A general checking account may be the only account a small business needs. Larger organizations may route money through that account to separate collection or disbursement accounts. The important point is to preserve a traceable record of every transfer.

How Does a Lockbox Reduce Collection Float?

In a traditional lockbox arrangement, customers mail checks and payment details to a designated post office box. The authorized bank collects the contents, processes the checks, and supplies remittance information. A remittance is a payment; its accompanying information identifies the customer and invoice.

The company uses the bank’s collection report to update customer accounts. Bank processing can reduce the time spent waiting for company employees to open mail and prepare deposits. It does not eliminate the need to match collections to invoices or reconcile bank activity.

Collection float is the total delay between the moment a customer sends a payment and the moment your company can use the money. It has three parts: mail float (time in the mail), processing float (time between receiving a check and depositing it), and availability float (time between the deposit and usable funds). A lockbox can shorten all three, which makes cash available sooner. Crediting a deposit and making its funds available are not always simultaneous; availability depends on the arrangement and the payment.

A simple cost-benefit example

Harbor Supply estimates that a lockbox will free $80,000 of cash otherwise tied up in collection delays. Assume that earlier access provides an annual benefit of 4%, and annual fees are $2,400.

Under these assumptions, the estimated benefit exceeds the fees. The $80,000 is cash released sooner, not $80,000 of new revenue. Management should also consider service reliability and whether the expected reduction in delay is realistic.

How Does an Imprest Bank Account Work?

An imprest bank account makes a specified amount available for a designated purpose. For example, if approved net pay (employees’ take-home pay after withholdings) totals $24,000, a company might transfer $24,000 from general checking to its payroll account. Payments are then made from that account and compared with the approved payroll.

The transfer between the company’s own accounts does not create an expense or change total cash. If separate ledger accounts are used, debit Cash—Payroll and credit Cash—General. Recognition of payroll expense and related liabilities is a separate accounting matter.

An imprest bank account is different from a physical petty cash box. Both set a fixed amount that someone must account for, but the bank account can handle much larger payments. The petty cash journal entries guide explains how small cash payments and reimbursements work.

How Do You Protect Cash and Verify Its Balance?

Keep office cash to the amount needed for petty cash, change, and receipts awaiting deposit. Use a safe or locked cash drawer, limit access, and send receipts to the bank as soon as practicable. A large unexplained balance in an office drawer increases exposure without improving accountability.

Count physical currency and compare it with the relevant records. For bank deposits, prepare a bank reconciliation that explains bank and book differences. Document who performed the check, who reviewed it, and how discrepancies were resolved.

Physical protection and reconciliation serve different purposes. A safe restricts access; reconciliation identifies missing entries, timing differences, and errors. A balanced reconciliation also does not prove that every payment was authorized, so approval and supporting documents remain necessary.

Key Takeaways

• Internal controls over cash protect money and keep cash records reliable.
• Segregation of duties helps stop one person from both taking cash and hiding it.
• Receipts are most exposed before they are recorded, so record and deposit them quickly.
• Payments should leave only after approval and supporting documents.
• A lockbox speeds collections, but it does not replace matching or reconciliation.
• A reconciliation finds differences. It does not prove every payment was authorized.
• Controls give reasonable assurance, not a guarantee.

How This Topic Appears on Exams

On the CPA Exam, internal control is part of the Auditing and Attestation (AUD) section, where you think like an auditor. What could go wrong, and which control would prevent or catch it? On the CMA Exam, Internal Controls makes up 15% of Part 1.

When you practice, look for one person holding two jobs that should be separate.

Common mistakes to avoid

• Treating a bank account as a complete control. Someone must still approve, record, and reconcile.
• Calling cash released by a lockbox revenue. It is your own cash arriving sooner.
• Recording a transfer between your own accounts as an expense. Total cash does not change.
• Assuming a balanced reconciliation means every payment was proper.

Ready for more practice? Explore the Auditing course or the CMA Part 1 course.

Practice Questions and Explanations

1. Identify the control weakness

One employee receives customer checks, records collections, and prepares the bank reconciliation. What should change?

2. Evaluate a lockbox

A lockbox releases $50,000 earlier. Assume a 5% annual benefit and $2,100 annual fees. What is the estimated net benefit?

3. Analyze an account transfer

A company transfers $9,000 from general checking to its imprest travel account. Does total cash decrease?

4. Record a cash shortage

The register shows cash sales of $980. After removing the starting change, the drawer holds $975. What is the journal entry?

5. Evaluate a payment control

A company uses positive pay. An employee sets up a fake vendor, gets its invoice approved, and the company issues a check. Will positive pay likely stop the payment?

Frequently Asked Questions

What are examples of internal controls over cash?

Common examples include separating cash handling from recordkeeping, depositing receipts promptly, requiring approval before payment, keeping cash in a safe, and having an independent person prepare bank reconciliations.

What is segregation of duties for cash?

It means no single person controls a cash transaction from start to finish. Different people authorize, handle, and record cash, and an independent person reconciles it.

Why is a bank reconciliation an internal control?

It compares the company’s cash records with the bank’s records and explains each difference. This can reveal errors and missing entries. It works best when prepared by someone who does not handle or record cash.

Are internal controls over cash tested on the CPA and CMA exams?

Yes, internal control is part of the CPA Exam’s Auditing and Attestation (AUD) section, and Internal Controls makes up 15% of CMA Exam Part 1.

Is a lockbox simply a safe?

No. In cash management, a lockbox is a bank collection arrangement. A safe physically protects money held on company premises.

Does using a bank remove the need for internal controls?

No. Management must still authorize payments, record collections, control access, and reconcile accounts.

Are imprest bank accounts always petty cash accounts?

No. An imprest bank account can serve payroll or other designated payments. Petty cash is a small fund used for minor approved expenditures.

Sources and Further Study

• COSO: Internal Control – Integrated Framework guidance
• SEC: Management’s Report on Internal Control Over Financial Reporting (Release 33-8238)
• ACFE: Occupational Fraud 2026: A Report to the Nations
• AICPA & CIMA: Uniform CPA Examination Blueprints

Bank of America’s treasury-management guidance describes lockbox collection benefits. Penn’s operational internal-control guidance illustrates duty separation and cash safeguards. These are practical control references, not a claim that one institution’s policies are accounting requirements for every company.

About the Author

Mansour Farhat, CPA, CIA, DBA, is the founder of Farhat Lectures and its YouTube channel. He holds a Doctor of Business Administration from Temple University and a Master of Accountancy from Bloomsburg University. He helps college students and CPA, CMA, and Enrolled Agent candidates build a strong understanding of accounting.

Read more about Professor Farhat.