Safety Norms: Financial Accounting and Bookkeeping

1Purpose, Scope, and Safety Principles

These norms set minimum expectations for anyone who handles financial records in this subject, including students in practice exercises, bookkeepers, accounting staff, and supervisors who approve entries or payments. Their purpose is to prevent financial loss, misstatement, fraud, data exposure, and regulatory breaches that arise from everyday recording work.

The scope covers manual and software-based journals, ledgers, bank reconciliations, accounts payable and receivable, payroll inputs, expense claims, and the close activities completed at the end of each reporting cycle. Spreadsheets used as working tools fall within scope when they hold live financial data.

• Must: no single person may create, approve, pay, and record the same transaction.
• Must: every entry must be supported by evidence that a reviewer can trace to its source.
• Must: doubt about a figure, instruction, or document is reported, not resolved privately.
• Should: mark each local procedure as mandatory or recommended so staff know which steps are non-negotiable.
• Note: where local law, accounting framework, or organizational policy sets a stricter rule, the stricter rule applies and any conflict is escalated to a supervisor.

2Roles, Competence, and Accountability

The owner or governing body is accountable for approving the internal control framework and providing the resources to run it. A finance manager or controller owns the procedures, approves exceptions, reviews high-value or unusual activity, and signs off reconciliations. Bookkeepers and accounting staff record transactions only within their assigned authority. Students and trainees work on sample data or under documented supervision.

Competence comes before access. A person must not post journal entries, release payments, change bank details, or sign reconciliations until they have completed the training required by the organization and their authority has been formally approved. Authority must be reviewed whenever a role changes or a person leaves.

• Must: access is granted by role, approved by a manager other than the user, and recorded in an access log.
• Must: users do not share logins, passwords, tokens, or approval credentials.
• Must: anyone unsure whether a task falls within their authority stops and asks the finance manager before proceeding.
• Should: staff confirm in writing that they understand their authority and reporting duties at each review cycle.

3Course-Specific Hazards and Risk Assessment

Hazards in bookkeeping are mainly financial, legal, and informational rather than physical. Each hazard should be identified, rated, and assigned an owner before work begins. Risk is rated by likelihood and impact on a simple scale of low, medium, and high. Impact includes money lost, penalties, reputational harm, and harm to individuals whose data is exposed.

The most common high-risk activities include changing vendor bank details, releasing payment runs, posting manual journals to revenue or suspense accounts, and reconciling bank accounts late. Ratings are recorded in a risk register with the responsible person and a review point. A new process, system, or staffing change triggers a fresh assessment.

• Unauthorized or duplicate payments, caused by altered vendor bank details or repeated invoice processing. Risk level: high.
• Fictitious vendors, personal expenses submitted as business costs, or unsupported manual journals. Risk level: high.
• Misposting or misclassification, where transactions land in the wrong account or period and distort reports. Risk level: medium to high depending on value.
• Unreconciled bank and control accounts that conceal errors or theft. Risk level: high where reconciliations run late.
• Exposure of bank details, payroll data, tax identifiers, or customer records through email, shared drives, or printed reports. Risk level: high.
• Errors from spreadsheet formulas, copied ranges, or unprotected templates. Risk level: medium.
• Pressure to adjust results near deadlines or to alter prior entries. Risk level: high, because it often precedes deliberate misstatement.
• Eye strain, posture problems, and fatigue from long data entry sessions. Risk level: low to medium, controlled through workstation setup and breaks.

4Preventive Controls and Safe Work Practices

Segregation of duties is the central preventive control. Recording, authorizing, custody of cash or assets, and reconciliation should be performed by different people. Where staffing is too small to separate every duty, compensating controls must be documented. Examples include independent review of bank statements by a manager outside the process, dual approval above set value thresholds, and periodic checks of records by someone who does not normally handle them. Thresholds are set by the finance manager and reviewed when volumes or risks change.

Payments follow a verified path. Vendor onboarding requires a completed vendor form, identity and tax number checks where local rules require them, and independent confirmation of bank details using contact information already held on file, never contact details supplied in the request itself. Any change to bank details triggers a callback to a known number and a second approver. Payment runs are compared with approved invoices, purchase orders, or contracts before release. Where a payment cannot be traced to supporting evidence, it is held and escalated.

Journal entries require a clear description, supporting documentation, and an approver who did not prepare the entry. Manual entries to revenue, reserves, equity, or suspense accounts receive additional review. Backdating is prohibited unless a documented correction policy covers the case and a manager approves it in writing. Corrections are made by adjusting or reversing entries with a stated reason, never by deleting history.

Bank and control account reconciliations must be completed within the close window set by the finance manager. The preparer signs, a separate reviewer signs, and each unreconciled item is listed with its age, amount, and owner. Items older than the policy threshold are escalated and not carried forward silently.

Daily working practices reduce common errors and fraud. Lock workstations when unattended. Do not store passwords in notes or browsers shared with others. Use only approved accounting software, and keep personal spreadsheets free of live client, payroll, or bank data unless the finance manager has approved and protected them. Save source documents to approved locations, not personal devices or messaging applications.

• Must: no approval by the person who prepared the transaction.
• Must: no payment to a new or changed bank account until verified through a known independent channel.
• Must: unexplained differences in reconciliations are escalated, not forced to balance.
• Must: suspend a payment that cannot be traced to supporting evidence and report it.
• Should: system-enforced approval workflows replace manual sign-off wherever the software allows.
• Should: user access reports are reviewed at each review cycle to detect unnecessary rights.
• Red flags requiring verification: urgent payment requests, requests for secrecy, invoices split below approval limits, changes to instructions from unusual channels, and pressure to skip normal approval.

5Systems, Environment, and Information Safeguards

Accounting software, bank portals, and shared drives are the main tools of this work. Access must be individual, limited to the minimum needed for the role, protected by multi-factor authentication where the platform supports it, and removed promptly when a person leaves or changes role. Administrator rights belong to a small named group who should not also process transactions.

Financial information is confidential. Bank account numbers, salary data, tax identifiers, customer records, and audit working papers are restricted to people with a business need. Share files through approved links with expiry and access limits rather than attaching them to personal email. Printed reports containing sensitive data must be kept in locked storage and destroyed using an approved shredding method. Remote access must use approved devices and networks. Privacy and data protection obligations depend on jurisdiction, so the organization should confirm current requirements with its legal or compliance advisers.

Work areas should provide adequate lighting, adjustable seating, and screens positioned to limit glare. A short break from continuous screen work is a common workplace practice, and local ergonomic guidance should set the detailed interval. Cash, checks, and physical vouchers are kept in locked storage with dual custody when handled. Backups of financial data should be taken on a schedule set by the finance manager, stored separately from the main system, and tested for recovery at a set interval.

• Must: financial data is stored only in approved systems and secured locations.
• Must: sensitive reports are never left on printers, desks, or shared screens.
• Must: physical cash handling uses dual custody and recorded counts.
• Should: multi-factor authentication is enabled for all finance logins where available.
• Should: restoration of backups is tested and results recorded.

6Incident Reporting, Escalation, and Response

Report any suspected fraud, error, data exposure, lost document, system compromise, or near miss to the finance manager on the same working day. If the finance manager is involved, report to the next level, such as the owner, board audit committee, or internal audit function, as set in governance documents. Do not confront the person suspected, alter evidence, or conduct a private investigation. Reports made in good faith must not lead to retaliation, and the organization should state this protection in writing.

Immediate containment steps are limited to what the access rights allow. Suspend a payment or account where authorized to do so, preserve emails, files, and system logs, and record what was observed, by whom, and at what point. If data has been sent to an unintended recipient, attempt recall through approved channels and notify the designated privacy contact. Serious matters, including suspected theft, criminal activity, or a personal data breach, may require notification to regulators, insurers, banks, or law enforcement under local rules. These decisions belong to designated senior staff and qualified advisers.

If a person is in danger or a physical emergency occurs, such as fire or a medical event in the office, call local emergency services first and follow building evacuation procedures. Financial recording can wait until the situation is safe.

• Must: report suspected fraud or data exposure to the finance manager on the same working day.
• Must: preserve evidence and do not edit, delete, or backdate records during an investigation.
• Must: escalate directly to an independent senior person when the finance manager may be involved.
• Must: do not contact external parties about suspected fraud unless the organization procedure or a legal obligation requires it.
• Should: hold a short post-incident review and update controls based on what was learned.

7Records, Training, Inspection, and Review

Every transaction must be supported by source documents retained for the period required by applicable law and organizational policy. Retention periods vary by jurisdiction and record type, so they must be confirmed with qualified advisers. Records must be complete, legible, and retrievable. Approval records, access logs, exception requests, and training records are part of the control evidence and must be kept with the same care as the financial records themselves.

Training is required before access and must be refreshed when procedures, software, or applicable law changes. Training covers fraud red flags, data handling rules, segregation of duties, and the escalation route. Students practice on sample data only and never on live client or employer records.

Inspection includes periodic reconciliation reviews, access reviews, sampling of journal entries against source documents, and unannounced checks of supporting evidence for payments. Each finding is logged with its owner and a completion target, and it stays open until a reviewer verifies the fix. These norms should be reviewed after any incident, audit finding, or significant system change, and at a regular interval set by the owner.

• Must: keep records of approvals, exceptions, and overrides.
• Must: track each control finding until closure is verified by someone other than the owner.
• Must: retain training evidence showing who was trained, on what content, and who assessed competence.
• Should: internal audit or another independent party reviews control effectiveness at a set interval.
• Should: maintain a lessons-learned log that feeds into training and procedure updates.

Implementation checklist

• Confirm that your system access is approved in writing and matches your assigned role.
• Never approve a transaction you prepared, and never pay an invoice you cannot trace to a contract, order, or delivery record.
• Verify any change to vendor bank details by calling a number already held on file, not one supplied in the request.
• Attach supporting evidence and a clear description to every manual journal before submitting it for approval.
• Complete and sign bank reconciliations on time, and escalate unexplained differences rather than forcing them to balance.
• Store confidential financial data only in approved systems and locked locations, and share it only through approved links.
• Lock your workstation when away, and never share passwords, tokens, or approval credentials.
• Report suspected fraud, errors, or data exposure to the finance manager on the same working day.
• Preserve evidence during any investigation and do not alter or delete records.
• Confirm current local law, accounting framework, and retention rules with qualified advisers before changing any procedure.