Two High-Value Treasury Controls That Often Don't Get Enough Credit
Terece Tai, CPA, CA
9/21/20264 min read
Not every valuable treasury control is sophisticated or technology-driven. Some of the most effective controls are familiar procedures that have gradually been reduced to administrative tasks.
Two examples are bank reconciliations and independent callback verification. Both can materially reduce financial risk, but only when the people performing them understand the purpose of the control and exercise appropriate professional judgment.
1. Bank Reconciliations: More Than Matching Numbers
The value of bank reconciliations is often under-estimated. In many finance departments, their preparation is assigned to junior staff because the process is perceived as mechanical.
The problem is not that junior staff prepare them. The problem arises when preparers are taught how to complete a template without being taught what the control is intended to detect.
A bank reconciliation may appropriately contain timing differences and other valid reconciling items, but it should not contain an unexplained difference. Even a small unexplained amount may indicate a missing entry, duplicate transaction, input error, incorrect posting, or another issue requiring investigation.
Materiality can help management assess whether an unresolved item affects the month-end close or requires immediate escalation. It should not become a reason to leave a difference unexplained indefinitely. Otherwise, the item may simply be carried from one month to the next until nobody remembers where it originated.
Modern reconciliation and AI-assisted tools can make transaction matching and discrepancy identification faster. However, technology does not remove the need to understand and resolve the underlying cause.
If a genuinely immaterial legacy difference cannot be resolved after reasonable investigation, any write-off should be documented, appropriately approved, and treated as an exception rather than normal practice.
The reviewer is also an essential part of the control. A meaningful review involves more than signing the reconciliation. The reviewer should challenge old or recurring reconciling items, unusual transactions, unsupported adjustments, unexplained differences, and evidence that required corrections were posted.
A reconciliation prepared without understanding, or reviewed without challenge, may look complete while accomplishing very little.
2. Independent Callback Verification: Verify the Change, Not Just the Payment
I have seen funds wired to fraudsters because a callback was not performed. I have also seen funds wired to fraudsters because a callback was performed incorrectly.
That experience has reinforced a simple lesson: a callback procedure can significantly reduce payment fraud risk, but only when it is properly designed and properly executed.
Companies should be cautious about using a payment-value threshold to determine whether a change in payment instructions requires verification. A fraudster may begin with a small payment to establish fraudulent banking information and wait for a larger payment to follow.
For that reason, every request to create or change payment instructions should be independently verified, regardless of the value of the first payment. Approval thresholds can still be used to require additional authorization for larger transactions, but approval of a payment is not a substitute for validating the banking information.
A callback should not consist of replying to the original email or calling a telephone number included in that email. The verifier should make an outbound call using contact information obtained from a previously validated and independently maintained source, such as the approved vendor master record or an existing business contact.
Where possible, verification should involve someone who has an established relationship with the vendor or payee and understands the normal business activity between the parties. That person may be better positioned to recognize unusual circumstances, identify inconsistencies, and confirm the business rationale behind the request.
However, familiarity with a voice or face should not be relied upon as the sole evidence of identity. As voice and video impersonation capabilities become more accessible, the process should also rely on trusted contact information, known contextual details, documented approval, and appropriate segregation of duties.
For unexpected or high-risk payments, companies may also consider contacting the payee even where no formal banking change was communicated. This can help detect situations in which fraudulent instructions were introduced without the legitimate payee's knowledge.
Therefore, establishing a callback procedure is only part of the control. Equally important is ensuring that those responsible for performing callbacks understand when they are required, how they should be executed, and what red flags should trigger additional scrutiny.
In many cases, the control breakdown is not caused by a lack of policy. The organization may already have a callback requirement documented. The failure occurs when employees are unfamiliar with the rationale behind the procedure, shortcut the process under time pressure, or assume that a completed callback automatically means the request is legitimate.
Controls Work Only When Their Purpose Is Understood
Neither bank reconciliations nor callbacks are new controls. Their value comes from how they are designed, performed, reviewed, and documented.
A control completed as a checklist item may create the appearance of protection. A control performed by someone who understands the risk, challenges exceptions, and follows through on unresolved issues provides real protection.
That distinction is especially important for growing businesses. Strong treasury controls do not need to be overly complicated, but they do need to be purposeful, understood, and consistently executed.
More often, controls fail not because they are missing, but because they are performed without understanding.
Disclaimer: Every organization's control environment is unique. The concepts discussed in this article are intended as general guidance and may not be appropriate for all situations. Readers should evaluate their specific circumstances and seek professional advice where appropriate before implementing changes or making decisions. FX-cient accepts no responsibility for losses, damages, or outcomes resulting from reliance on the information presented.
Disclaimer: This article is intended to share general observations and practical insights related to treasury, finance, and internal controls. It is provided for educational purposes only and should not be considered legal, accounting, audit, or professional advice.
© 2026. All rights reserved.