Safety Norms: Bank Reconciliation Operations

1Purpose, Scope, and Safety Principles

Bank reconciliation compares the cash balance in the general ledger with the balance and transactions reported by the bank, then explains and corrects every difference. Its safety purpose is to protect the organization from undetected loss, fraud, misstatement, and improper disclosure of financial data. The harms are mostly financial and informational rather than physical, but they can be serious and move quickly.

This norm set applies to operating, payroll, merchant settlement, and investment cash accounts that the organization reconciles, on whatever cycle its policy requires. It does not cover tax filings, treasury forecasting, or payment system engineering, which need their own procedures. Local procedures must be approved by the organization's finance leadership.

• Mandatory: no reconciliation may be marked complete while unexplained items lack an owner and a documented resolution plan.
• Mandatory: nobody approves a reconciliation or journal entry that they prepared or recorded.
• Recommendation: treat every unexplained difference as a possible control failure until evidence shows otherwise.

2Roles, Competence, and Accountability

The preparer obtains bank data, matches transactions, records reconciling items, and attaches evidence. The reviewer checks the work, challenges unusual items, and signs off. The controller or finance lead owns the policy, sets approval thresholds, and decides on write-offs and escalations. The bank relationship owner manages account mandates, signatories, and bank contact details. Internal audit or another independent function tests whether controls operate as written.

Competence means more than system access. Staff need working knowledge of the ledger, the bank's statement format, the approved tolerance for timing differences, and common fraud red flags. Access should be granted only to people whose role has been approved in writing, and removed promptly when roles change. Where staffing is thin, compensating controls such as independent review by a manager outside the process must be documented before one person covers multiple duties.

• Mandatory: only staff listed in the approved access matrix may prepare or review reconciliations for a given account.
• Mandatory: a person who records cash receipts or disbursements must not be the sole reconciler of that account.
• Mandatory: new preparers complete documented training and work under supervision through at least one full cycle before acting independently.
• Recommendation: review the access matrix whenever staff join, move, or leave, and confirm that departed users hold no remaining bank or ledger rights.

3Realistic Hazards and Risk Levels

Typical activities include downloading statements, matching transactions, investigating timing items, posting correcting entries, and reporting exceptions to management. The people involved are preparers, reviewers, bank staff, vendors, and sometimes payroll or accounts payable teams. The tools are the ledger, bank portal, reconciliation software or spreadsheets, and shared folders.

Realistic scenarios include an unsupported payment to a newly added vendor that clears the bank, a duplicate deposit hidden by a timing difference, a feed mapping error that drops transactions, an overwritten spreadsheet formula that masks a shortfall, and pressure from a manager to clear items without evidence. Each hazard should be scored by likelihood and impact using the organization's risk matrix. Unexplained items older than policy allows, round-sum transfers, late manual entries to cash, and changes to bank details near the end of a cycle are high risk indicators.

Risk levels should be reassessed after system changes, new bank relationships, staffing shortages, or audit findings. A high rated risk with no effective control must be reported to the controller in writing with a named remediation owner.

• High: outflows to new or recently changed payees without approved invoices.
• High: manual journal entries to cash accounts that lack independent approval.
• High: reconciliations signed without evidence or completed by someone outside the authorized list.
• Medium: stale outstanding checks or deposits in transit with no follow-up.
• Medium: spreadsheet errors, broken links, or unlocked formulas.
• Low: minor timing differences inside the approved tolerance, still tracked to clearance.

4Preventive Controls and Safe Work Practices

Prevention depends on building controls into the workflow rather than relying on memory. Obtain bank statements directly from the bank portal or a secure automated feed. Use locked templates with logged changes. Assign each account an owner and a backup so that an absence never leaves an account unreconciled or unreviewed.

Safe practice also means working in the open. Every reconciling item should be traceable to evidence, every entry should carry the preparer's and reviewer's identities, and every exception should be explained in plain language that a reviewer can test. Avoid clearing large or unusual items automatically. Use matching rules for routine volume and review exceptions by hand.

Timing items need a deadline. Outstanding checks older than the policy limit should be followed up with the payee or voided under approved procedure, and a reviewer should confirm the outcome. Deposits in transit should be traced to the bank's posted credit within the clearing window stated in the bank's published terms.

• Mandatory: obtain statements only from the bank's official portal or approved feed; do not accept emailed PDFs, screenshots, or edited files as primary evidence.
• Mandatory: attach evidence such as an invoice, remittance advice, or bank notice to each reconciling item and reference it in the workpaper.
• Mandatory: manual entries to cash accounts require approval by a second person who did not create them.
• Mandatory: changes to vendor or customer bank details are verified by calling a number already on file, never a number supplied in the change request.
• Mandatory: sign-offs record the preparer and reviewer names and the time of each action.
• Recommendation: run matching rules at each agreed interval and keep exception queues visible to the controller.
• Recommendation: rotate reconciliation assignments on a set schedule so no one controls the same account indefinitely.

5Equipment, Environment, Information, and Safeguards

Tools include the general ledger, bank portal, reconciliation software or spreadsheets, document repository, and approved messaging. Spreadsheets carry higher error risk, so protect them with restricted edit rights, version control, control totals that tie to the ledger, and a visible check that formulas have not changed. Workstations should follow the organization's IT configuration standard.

Bank statements, account numbers, routing details, and payee information are confidential. Treat them as sensitive data and limit access to people with a documented need. Privacy and data protection rules vary by jurisdiction and by bank contract, so verify current requirements with your privacy officer and legal counsel.

• Mandatory: use multifactor authentication on bank and ledger systems wherever the organization requires it.
• Mandatory: show only the last four digits of account numbers in shared workpapers.
• Mandatory: never send statements or account data to personal email, messaging apps, or unapproved storage.
• Mandatory: lock screens when away from the desk and collect printed statements from shared printers immediately.
• Recommendation: store workpapers in a restricted folder with access logging, and review the access list periodically.

6Incident Reporting, Emergency Response, and Escalation

Suspicious activity includes unfamiliar bank debits, requests to change payment instructions, pressure to clear items without support, missing or altered statements, and reviewers being asked to approve their own work. Report it at once. Do not confront the individual, do not investigate alone, and do not delete or alter any record. Preserve workpapers, emails, and system logs as they stand.

If funds may be at risk, contact the bank's fraud team using a phone number from the bank's official website or your signed agreement, not a number in the suspicious message. Physical emergencies at the workplace follow building procedures and local emergency services, and this norm set does not cover them. Escalation runs to the controller, and to internal audit or the designated ethics channel where the controller may be involved.

Staff who raise concerns in good faith must be protected from retaliation under organizational policy. The confidentiality of each report should be preserved so that the review is not compromised.

• Mandatory: report suspected fraud, control override, or misconduct to the controller and the independent channel within the timeframe set by policy.
• Mandatory: if a manager is implicated, use the independent escalation path without informing the subject first.
• Mandatory: record near misses, such as a duplicate payment stopped before release, in the incident log.
• Mandatory: contact the bank's fraud team immediately where recovery may still be possible.
• Recommendation: hold a short post incident review and update controls within an agreed window.

7Records, Training, Inspection, and Review

Each reconciliation record should show the account, the statement used, the balance comparison, each reconciling item with its evidence, the decision taken, the preparer, and the reviewer. Record retention periods are set by law, regulation, and organizational policy and vary by jurisdiction, so confirm them with legal counsel or records management.

Training covers these norms, the systems in use, fraud red flags, and escalation steps. Inspection combines supervisor sampling with independent testing. Access reviews should confirm that each user's rights match the approved access matrix, and any segregation conflict must be documented with compensating controls approved by the controller. Review findings feed revisions to procedures and access rules, so the process improves over time rather than being signed off once.

• Mandatory: keep reconciliation evidence for the retention period set by policy.
• Mandatory: complete training before access is granted and again whenever procedures change.
• Mandatory: supervisors review a documented sample of completed reconciliations and record the results.
• Recommendation: track aging of open items, the number of manual entries, and late completions, and review them with the controller.
• Recommendation: test whether controls work through walkthroughs and periodic independent review.

8Conclusion and Local Adoption

These norms are a starting point, not a finished procedure. Local procedures should name the actual systems, thresholds, approvers, bank contacts, and retention rules, and they should be approved by the organization's finance leadership. Confirm bank agreements, accounting standards, and regulatory obligations against current versions with qualified professionals and competent authorities.

Safe reconciliation depends on separation of duties, complete evidence, honest exception reporting, and fast escalation. When a difference cannot be explained, stop, preserve the records, and escalate rather than resolving it alone. Silence or quiet adjustment is the failure this process exists to prevent.

Implementation checklist

• Confirm the preparer and reviewer are on the approved access matrix for this account.
• Download statements only from the bank's official portal or an approved feed.
• Attach evidence to every reconciling item and show only the last four digits of account numbers.
• Obtain second approval for every manual entry to a cash account.
• Verify any change to bank details by calling a number already on file.
• Classify each exception, assign an owner, and track open items to clearance.
• Escalate suspicious activity to the controller and the independent channel without alerting the subject.
• Preserve workpapers, emails, and system logs; never edit or delete records to make a difference disappear.
• Record near misses and complete sign-offs with names and times.
• Have a supervisor review a documented sample of completed reconciliations.
• Confirm retention, privacy, and bank obligations with qualified professionals for your jurisdiction.