Clean books are evidence that your accounting cycle finished. They aren’t evidence that the person who moved the cash couldn’t also explain it away.

That distinction is control independence. Your books can close inside 10 business days, the trial balance can net to zero, and the bank reconciliation can reach a fully explained $0.00 difference.

And one person can still create a supplier, enter an invoice, release an electronic payment, and clear it on the reconciliation.

Nothing in double-entry bookkeeping objects. The debits and credits are immaculate. So is the problem.

The U.S. Government Accountability Office’s 2025 Green Book separates authority, custody, and accounting for exactly this reason. In your firm, job titles are a poor map. Capabilities are the map: who can add a payee, change bank details, approve a bill, release cash, post an adjustment, and reconcile the account.

The Gap

Start by separating two things you probably bundle into “the books are clean.”

Bookkeeping completeness means a journal entry has a dated debit and credit that sum to zero, the trial balance nets to zero, and assets equal liabilities plus equity.
Reconciliation completeness means the adjusted ledger balance equals the statement balance to a fully explained $0.00 difference, with each outstanding item specific and dated.
Control effectiveness means the transaction had the right authority, source evidence, timing, and independent review before or after cash moved.

The first two checks matter. Neither proves the third. A payment to a fictitious supplier can be recorded accurately in the ledger and clear accurately at the bank. A reconciler who also holds payment-release access can call it an expense, clear it, and present a perfect zero difference. The reconciliation found no arithmetic disagreement because there wasn’t one.

That’s why a trial balance isn’t a fraud test and a bank reconciliation isn’t an authorization test. They’re different stages of the same route.

Software can collapse journalizing, posting, and trial balance into one click. It can’t create an independent person by doing the click faster.

The Payment Route

Map your payment route before you assign permissions. For each route — supplier invoice, payroll, expense reimbursement, refund, bank transfer, customer credit, and a vendor or employee bank-detail change — name the initiator, approver, payment releaser, recorder, reconciler, and reviewer.

Then run one normal transaction and one exception through it yourself. The route needs more than an approval status.

The requester supplies the vendor, business purpose, expected amount, destination, and any conflict of interest.
A different person verifies a new supplier or changed remittance account through a contact channel the business already holds. A phone number inside the change email is not independent evidence. It is a little too convenient.
The payment releaser checks payee, amount, due date, account, duplicate indicators, and attached approval before the bank instruction goes out, with a second authorized user releasing it where the bank supports dual authorization.

Vendor creation and bank-detail changes deserve that separate route at any amount you handle. A dollar limit governs the size of a payment. It doesn’t govern a master-data edit that can redirect every future payment. The record should keep the old value, new value, requester, verifier, and timestamps.

After release, link the bank reference to the invoice, approval, receipt evidence, and payee record. When you reconcile the account, get the bank or card statement directly from the institution or through a controlled feed — not solely from the payment operator.

Match bank to books and books to bank. The second direction exposes fabricated ledger entries and stale outstanding items that a one-way match will miss.

The Roles

The design changes with your staffing. The rule doesn’t: no one person should control authorization, custody, and accounting across a whole high-risk route. The point is to create two or three independent identities across each cash-moving capability chain, not to rename the same administrator twice.

Team design	Payment initiator	Approver	Bank-release role	Reconciler	Reviewer	Compensating control
Sole proprietor	Owner	Owner	Owner	Owner	External accountant or other authorized person	Bank-imposed limits, restricted cards, read-only accountant access, and periodic review from bank-originated statements
Two people	Bookkeeper or owner	Owner for ordinary payments	The person who did not initiate	The person who did not release	Owner obtains the statement independently	Independent bank statements and external review when the owner is purchaser or payee
Three or more people	Requester or bookkeeper	Budget holder or other authorized approver	Separate authorized releaser	Person separate from preparer and releaser	Person who did not release the relevant payments	Separate preparer, releaser, and reconciler; review unusual payees, changes, old items, transfers, and manual entries

That table is a design range, not a claim that a sole proprietor can approve their own entry twice and call it separation.

Where you can’t separate fully, measure the compensating review: whether it covered the right population, whether the reviewer was independent, which evidence was inspected, and how long after the payment it happened.

For your active operating account, monthly reconciliation is the outer boundary. Higher-velocity cash drawers, processor settlements, and bank feeds can need daily matching, while a low-volume but meaningful account may suit weekly review.

More important, old reconciling items can’t sit there forever. Monthly frequency with six-month-old “timing” items is an exposure window wearing a nice calendar.

Locate the Broken Stage

Use the visible symptom to locate the broken stage. It’s faster than calling every discrepancy fraud, and it’s more honest.

Reconciliation clears to $0.00 without challenge, and the preparer can also release payments → independence is broken

Compare permissions with actual use, move release authority, or add bank-originated statement review by somebody outside the release path.

Duplicate or altered vendor payments appear, and new payees or remittance changes lack verification → master-data control is broken

Test vendor creation and change records for independent, out-of-band verification and retained old-versus-new values.

Books carry miscellaneous, clearing, or suspense plugs, and differences reverse just after month-end → the explanation is broken

Trace each adjustment to a dated source item. A plug forces agreement. It doesn’t resolve the cause.

Approval arrives after payment, as a screenshot, or through a manager’s account → authorization is broken

Separate approval time from payment time, and test whether the approver actually saw the invoice, supplier, amount, and support.

Logs name admin, vendor profiles are deleted and recreated, or configuration changes precede a payment → attribution is broken

Give users individual accounts and protect the history from modification or deletion.

The control has a signature but no review date, evidence, or independent reviewer → demonstration is broken

The result isn’t “effective.” It’s not demonstrated, because inquiry or a check mark alone can’t establish operation.

Each of those is a lead, not a verdict. An unapproved payment can still be legitimate. A supplier sharing an employee’s address can have a legitimate reason. Your next job is to preserve the record, test the mechanism, and state the deviation without inventing a culprit.

The Evidence

Your reconciliation has to be literal. The preparer attaches the statement, matching report, outstanding-item list, and corrections, dates the work, and identifies every unresolved difference.

The reviewer, who didn’t release the relevant payments, examines unusual payees, changed bank details, old outstanding items, transfers between company accounts, and manual journal entries.

“Approved” isn’t review evidence. Questions and their resolutions are.

Run the reconciliation twice in thought, even when the software has done its matching. Start at the statement and find every withdrawal in the books with approval and support. Then start at the ledger and find every recorded payment and deposit at the bank. A deposit that was recorded but never banked and a payment that was never authorized survive different shortcuts.

Your audit history needs enough fields to reconstruct authority. NIST SP 800-171 Revision 3 identifies event type, time, source, outcome, affected object, and identity.

For financial actions, add the before-and-after value, initiator, approver, release identity, attached support, and override reason. A shared login turns the identity field into a department name. That isn’t an audit trail. It’s a group costume.

Test the control on four dimensions:

Coverage: every eligible payment, vendor change, or reconciliation period encountered the control.
Timeliness: approval occurred before release, and reconciliation happened before an old difference compounded.
Quality: the reviewer examined the invoice, vendor identity, bank evidence, amount, and support instead of initialing a batch.
Independence: the reviewer was separate from the transaction, the payment release, and the record being checked.

PCAOB AS 2201 makes the useful distinction between design and operating effectiveness. A well-drawn workflow isn’t proof that it ran, and inquiry alone is insufficient for an effectiveness conclusion.

You don’t need to claim a PCAOB audit to use that discipline. You just need to keep the evidence.

The Close

When an exception suggests fraud, stop further release, preserve the original records and logs, and escalate through your incident route.

Don’t tidy suspicious entries before copying the evidence. A clean-up can turn a problem into an unanswerable question.

The ACFE’s 2026 study of investigated cases reported that 90% involved asset misappropriation, that a typical detected scheme lasted 12 months, and that 43% were first detected through tips.

Those aren’t odds for your company. They’re a reminder that loss is a lagging measure, and that clean accounts aren’t a detection channel by themselves.

A clean reconciliation proves the records agree. It does not prove the cash was safe. Independent payment authority and review make a disagreement visible before the cash disappears.

Separate the hands that move your cash from the hands that explain it. Reconcile to zero — but make sure somebody else can challenge the zero.