vaayaa Inclusive Education
Finance risk assessment

Bank Reconciliation Operations Risk Assessment: Matching, Access and Cash Control Risks

A worked example of how a finance team identifies, scores and controls the risks that arise when bank statements are matched to the ledger, from missed items and duplicate postings to portal access, fraud and unreliable cash figures.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Bank Reconciliation Operations course

Executive summary

This assessment shows how a finance team can find, rate and control the risks that arise when bank statements are matched to the ledger each month. Eight risks were chosen because they are plausible in everyday reconciliation work. Access to the bank portal and payment credentials is the most serious inherent risk, with missed or duplicate transactions close behind. Fraud hidden among unmatched items is less likely but can cause large loss. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls are in place, while credential misuse and concealed fraud remain at Medium because their impact stays serious. The first actions are dual approval of portal changes, a weekly aging report for unmatched items, a split between preparing and approving reconciliations and a tested restore of ledger data. The business in this example is a teaching model, so every score illustrates method rather than describing a real organization.

Focus area
Bank reconciliation and cash control operations
Setting
Finance and accounting function of a small to mid-sized business that reconciles several bank accounts each month
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the daily and monthly reconciliation of the business's operating and payment bank accounts, from statement import through matching, investigation of unmatched items, posting of adjustments and sign-off. It covers the people, ledgers, bank portals and data that support the work. Assumptions are labelled: jurisdiction is not specified, the bank portal and accounting system are generic, and the business is a teaching model rather than any real organization. Treasury dealing, investment accounts and tax advice are out of scope.

Context

The business has an accounts assistant, a senior accountant, a financial controller, a head of finance, an IT manager who administers the accounting system and a treasury lead who manages cash. Bank statements are downloaded from an online bank portal and imported into accounting software. Matching is done in the ledger, with spreadsheets used for outstanding cheques, timing differences and cash forecasts. An external auditor reviews the accounts each year and the board receives a cash summary each quarter. Each risk is scored before controls to show its natural level, then again after the existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to make sure every bank and payment account agrees to the ledger on time, that differences are explained and corrected, and that the cash figures reported to management and the board are reliable. The assets in scope are bank balances, portal credentials, statement files, the ledger and reconciliation workpapers, and the records of payments and receipts. Stakeholders include the accounts team, the financial controller, management, the board, the external auditor, the bank relationship manager, and the suppliers and customers whose payments are matched. Every risk has one owner role, and the financial controller keeps the register current and reports cash exceptions to the board each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H05 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H02
3 Possible Likelihood 3, impact 3, score 9, medium: H06 Likelihood 3, impact 4, score 12, high: H03 Likelihood 3, impact 5, score 15, high: H04
2 Unlikely Likelihood 2, impact 4, score 8, medium: H07 H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H06 H07 Likelihood 2, impact 3, score 6, medium: H01 H03 H05 Likelihood 2, impact 4, score 8, medium: H02 H04
1 Rare Likelihood 1, impact 3, score 3, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Unrecorded, duplicate or misdated bank transactions 16 High 6 Medium Senior accountant
H02 Compromised bank portal credentials and unauthorised payments 20 Critical 8 Medium IT manager
H03 Preparer and approver are the same person 12 High 6 Medium Head of finance
H04 Concealed fraud within unmatched or delayed items 15 High 8 Medium Internal auditor
H05 Stale outstanding items and cut-off errors distort reported cash 12 High 6 Medium Financial controller
H06 Data quality errors from bank feed mapping and spreadsheets 9 Medium 4 Low Accounting system administrator
H07 Liquidity misread from delayed or unreliable cash figures 8 Medium 4 Low Treasury lead
H08 Conflicts of interest and pressure to close quickly 8 Medium 3 Low Compliance officer
H01

Unrecorded, duplicate or misdated bank transactions

Operational Before 16 After 6

Bank charges, receipts or payments are missed, posted twice or recorded in the wrong period, so the ledger and bank statement drift apart without anyone noticing.

Who or what is affected: Accounts team, financial controller and suppliers awaiting payment

Causes

Manual keying, large transaction volumes and timing differences at period end.

Consequences

Incorrect cash balance, late supplier payments, restated reports and poor decisions.

Existing controls

  • Bank statement lines are matched to ledger entries each month.
  • Unmatched items are listed on a working sheet for review.

Control gaps

Items are listed but not aged, so old differences can sit unexplained for months.

Additional controls

  • Prevent: Import bank feeds with a check that stops duplicate lines from posting twice.
  • Detect: Run a weekly aging report of unmatched items with a named owner for each.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Senior accountant Target: Within 45 days Early warning: Unmatched items older than 30 days on any account.
H02

Compromised bank portal credentials and unauthorised payments

Technology and data Before 20 After 8

Shared or reused passwords, phishing and weak portal settings let an outsider or insider change payees, payment limits or user rights and release payments without approval.

Who or what is affected: Owners, the bank, suppliers and the accounts team

Causes

Phishing emails, reused passwords and user lists that are rarely reviewed.

Consequences

Direct loss of funds, emergency recovery costs and damage to trust with the bank.

Existing controls

  • Each user has an individual login to the bank portal.
  • Payments above a set value need a second authoriser.

Control gaps

User rights are not reviewed against current staff, and limit changes are not logged for review.

Additional controls

  • Prevent: Enable multi-factor sign in and remove shared logins from every bank portal user.
  • Respond: Block portal access within the hour when a suspicious login or payment is reported.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: IT manager Target: Within 30 days Early warning: Bank portal logins from unfamiliar devices or outside normal hours.
H03

Preparer and approver are the same person

Operational Before 12 After 6

One person prepares the reconciliation, posts the adjusting entries and signs the result, so errors and misuse are not checked by anyone else before the figures are used.

Who or what is affected: Financial controller, management and external auditors

Causes

Small team size, holiday cover and roles added without redesigning the process.

Consequences

Errors and concealed misuse go unnoticed, leading to audit findings and loss of confidence.

Existing controls

  • The financial controller reviews reconciliations at month end.
  • Sign-off sheets are kept for each bank account.

Control gaps

Approval is recorded on paper and is not checked against the system user rights.

Additional controls

  • Prevent: Assign separate preparer and approver roles in the accounting system.
  • Detect: Review monthly approver logs to confirm that no reconciliation is self approved.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Head of finance Target: Within 60 days Early warning: Reconciliations prepared and approved by the same person.
H04

Concealed fraud within unmatched or delayed items

Financial Before 15 After 8

Staff delay or hide transactions, such as moving receipts between accounts to cover a shortfall or altering statement copies, and the gap grows over time if no one checks the detail.

Who or what is affected: Owners, lenders, customers and colleagues

Causes

Trust placed in one person, pressure to hit targets and weak checks on the detail of unmatched items.

Consequences

Direct loss, legal action, reputational harm and a costly investigation.

Existing controls

  • Bank statements are downloaded directly from the bank portal.
  • The financial controller reviews unmatched items each month.

Control gaps

Review covers totals rather than the detail of individual unmatched items over time.

Additional controls

  • Detect: Compare statement lines with a fresh portal download each month and record any difference.
  • Prevent: Restrict edit rights on reconciliation workpapers to named reviewers only.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Internal auditor Target: Within 45 days Early warning: Unmatched items that move between accounts or are repeatedly rolled forward.
H05

Stale outstanding items and cut-off errors distort reported cash

Financial Before 12 After 6

Cheques, transfers and deposits in transit are carried forward without follow up, and transactions near the period end are assigned to the wrong month, so reported cash is wrong.

Who or what is affected: Management, the board and the external auditor

Causes

Manual cut-off steps, late bank statements and no formal rule on how old an item may be.

Consequences

Misstated cash and working capital, misleading board packs and an audit adjustment.

Existing controls

  • Outstanding cheques are listed on each month's reconciliation.
  • Cut-off dates are shared with the team before close.

Control gaps

Outstanding items have no maximum age, so old entries are rarely challenged.

Additional controls

  • Prevent: Set a cut-off checklist with dated sign-off for every bank account.
  • Respond: Clear stale items after investigation and record the reason for each one.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Financial controller Target: Within 30 days Early warning: Outstanding items older than 60 days on a reconciliation.
H06

Data quality errors from bank feed mapping and spreadsheets

Technology and data Before 9 After 4

Bank feed fields are mapped wrongly, currency or date formats differ, and figures are copied between spreadsheets and the ledger by hand, creating errors that look like valid matches.

Who or what is affected: Accounts team, system administrators and reviewers

Causes

Changes to bank file formats, manual copying and templates edited without testing.

Consequences

False matches, hidden differences and extra time spent on correction.

Existing controls

  • Import templates are reused for each bank account.
  • A reviewer checks a sample of imported lines each month.

Control gaps

Control totals are not compared with the statement before matching begins.

Additional controls

  • Prevent: Lock import templates and test each change with a sample file before use.
  • Detect: Compare total debits and credits from the feed with the statement control total.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Accounting system administrator Target: Within 60 days Early warning: Import totals that differ from the bank statement control total.
H07

Liquidity misread from delayed or unreliable cash figures

Financial Before 8 After 4

Cash is shown higher or lower than it really is because the reconciliation is late or unmatched items are ignored, and payment or funding decisions rely on that unconfirmed figure.

Who or what is affected: Treasury lead, suppliers and staff who depend on timely payment

Causes

Late reconciliations and forecasts that rely on balances not yet confirmed.

Consequences

Overdrawn accounts, missed payments and higher borrowing costs.

Existing controls

  • A daily bank balance is checked on the online portal.
  • Cash forecasts are updated each week by the finance lead.

Control gaps

The forecast is not adjusted for unmatched items before payment decisions are made.

Additional controls

  • Detect: Compare the daily bank balance with the ledger cash figure before each payment run.
  • Respond: Hold non-essential payments when the cash figure cannot be confirmed.
Likelihood 2 x impact 4 before; 2 x 2 after Owner: Treasury lead Target: Within 60 days Early warning: A payment run approved while the ledger cash figure is not yet reconciled.
H08

Conflicts of interest and pressure to close quickly

Reputational Before 8 After 3

The person reconciling has a personal link to a supplier, customer or bank contact, or is pressed to close quickly, and so accepts unexplained items or approves payments that should be queried.

Who or what is affected: Accounts team, suppliers, the bank and owners

Causes

Close relationships with suppliers, deadline pressure and unclear rules on gifts.

Consequences

Biased approvals, loss of trust with the bank and disciplinary action.

Existing controls

  • Staff sign an annual conflicts declaration.
  • Bank relationship contacts are listed in the procedure manual.

Control gaps

Declarations are not compared with the payees and suppliers that appear on reconciliations.

Additional controls

  • Prevent: Rotate reconciliation duties for accounts linked to the same supplier or bank contact.
  • Respond: Refer any unexplained item linked to a declared interest to the internal auditor.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Compliance officer Target: Within 90 days Early warning: A declared interest linked to a payee or supplier on an unexplained item.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from 1, Rare, to 5, Almost certain. Impact runs from 1, Insignificant, to 5, Severe, and considers money lost, time to correct, the effect on reported cash and harm to trust with the bank. Multiplying the two gives a score from 1 to 25 in one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Low means accept and monitor, Medium means routine control with a named owner, High means senior attention and a dated plan, and Critical means immediate action and board notice. Inherent risk is scored before any controls. Residual risk is scored after existing and added controls, and it must never be higher than inherent. Where inherent is 10 or more, residual must be lower. Ratings are challenged by the people who do the reconciliations, by a second reviewer who was not involved, and by the internal auditor at each review. A rating is not lowered simply because a risk has not yet occurred, and the register is reopened whenever an early warning indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Unmatched bank items older than 30 days on any account.Escalate to the financial controller when any item passes 30 days, and to the head of finance after 60 days.
Bank portal logins from unfamiliar devices or outside normal hours.Escalate to the IT manager at once, and suspend the credential until the login is explained.
Reconciliations prepared and approved by the same person.Escalate to the head of finance when found, and reassign the approval within five working days.
Differences between bank and ledger balances above the agreed threshold at month end.Escalate to the financial controller on the day found, and to the board if unresolved by the next month end.
Reconciliations not completed within the agreed close window.Escalate to the financial controller after two missed days, and to the head of finance if still open after five.

Contingency arrangements

If a suspected fraud, an unexplained large difference or a compromised bank credential is found, the financial controller freezes related payments and asks the bank to block the affected access. The IT manager resets credentials and reviews recent logins. Records are preserved, the work is handed to someone outside the affected process, and the head of finance informs the board. Legal and bank contacts are made through the head of finance as required in the relevant jurisdiction. Cash is protected with a standby funding plan, and staff are told what they need to know early and plainly.

Prioritized action plan

  1. Require dual approval for any change to bank portal users or payment limits, owner financial controller, within 30 days.
  2. Age all unmatched items weekly and clear anything older than 30 days, owner senior accountant, within 45 days.
  3. Separate preparing and approving reconciliations and review user rights, owner head of finance, within 60 days.
  4. Enable multi-factor sign in on the bank portal and test a ledger restore from backup, owner IT manager, within 30 days.
  5. Confirm every bank detail change by call back to a known bank contact, owner internal auditor, within 45 days.

Conclusion

Reliable cash figures depend on a few steady habits: timely matching, dated aging of unmatched items, split duties between preparing and approving, dual control over bank changes and tested backups. The highest scores sit with credential misuse, unrecorded transactions and concealed fraud, and each has actions that bring residual risk down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice from bank, audit or legal specialists for any real case.

Assumptions and limitations

Assumptions

  • The business holds several bank accounts with one main bank and uses an online portal with individual user logins.
  • Reconciliations are prepared in accounting software that records who prepared and approved each step.
  • Jurisdiction is not specified, so legal and reporting duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real business, bank or audit.
  • Bank, payment and reporting rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not financial, banking, tax or legal advice.

Related frameworks to study

  • Internal control framework with control activities and monitoring
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Segregation of duties principle

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Bank Reconciliation Operations course Read the best practices for this course

More Finance risk assessments

Hourly Active: 39,499 Learners