Treasury and Bank Structure Readiness

How is the company's bank account structure organized today?

Account architecture is the physical layer of treasury control: a payroll account funded per cycle caps payroll fraud exposure to one pay run, and a separate reserve account makes excess cash visible and deliberate. The common trap is judging structure by the number of accounts rather than by whether each account has a purpose, a funding rule, and a named owner.

A commingled single account defeats the most basic treasury control - design a purposeful account architecture before layering tools (Green Book, Principle 10). Unrationalized account sprawl obscures the true cash position and weakens control - rationalize the architecture first (Green Book, Principle 10).

Official guidance: SBA guidance for managing finances

Is there a current, owner- or board-approved signatory and bank-access policy - who may open accounts, sign, and approve payments, and at what limits - with access removed promptly when people leave?

Test this against the bank's own records, not the org chart: pull the signature cards and the online-banking user entitlement report and reconcile both to the approved list. The common trap is administering signature cards carefully while ignoring platform entitlements, where a departed employee's wire-initiation profile can survive for years.

Undocumented or stale payment authority is a direct fraud exposure - rebuild the signatory and access baseline before optimizing anything else (Green Book, Principles 10 and 12).

Official guidance: SBA guidance for managing finances

Does every electronic payment require two different people - one to initiate and a second to approve and release - enforced by the banking platform itself, with no shared credentials?

Dual control only counts when the banking platform enforces it; a policy that one person can override is not a control. Where the team is too small for full segregation, the Green Book contemplates alternative control activities - for example, owner release of every payment above a threshold combined with prompt independent review of actual bank activity.

Single-person payment release concentrates custody and authorization in one set of hands - impose platform-enforced dual control now (Green Book, Principle 10).

Official guidance: SBA guidance for managing finances

Are external payment fraud defenses active - positive pay on checks, ACH debit blocks or filters, and callback verification of vendor bank-detail changes using an independently obtained phone number?

These three defenses address the most common external attacks: altered or counterfeit checks, unauthorized ACH debits, and business email compromise redirecting vendor payments. The trap is treating verification as an accounts-payable courtesy - the callback must use a phone number sourced independently of the change request, because the request itself is what the fraudster controls.

Principles 10 through 12 set the design, information-system, and implementation standards these payment controls are built on.

Official guidance: SBA guidance for managing finances

• GAO Green Book - Standards for Internal Control

How does the company decide, day to day and over the coming quarter, how much cash sits where?

Cash positioning is a timing discipline, not an accounting report: it works from bank-cleared receipts and disbursements by week, not monthly accrual totals. Thirteen weeks is the standard horizon because it captures a full quarter of payroll, tax, and debt-service dates while staying close enough to forecast with confidence.

The SBA business guide covers cash flow forecasting and the separation of business bank accounts for growing companies.

Official guidance: SBA guidance for managing finances

• SBA guidance for managing finances

Is there a written excess-cash and deposit policy - a defined minimum operating balance, permitted places for cash above that floor, and deliberate management of deposits above insured limits?

The policy answers three questions in writing: how much cash must stay immediately liquid, where cash above that floor may be placed, and how much exposure to any single bank above insured limits is acceptable. The common failure is drift - balances accumulating in a non-interest operating account at one bank because no one owns the decision.

Undirected excess cash forfeits yield and concentrates uninsured deposit risk - adopt a written excess-cash policy (Green Book, Principle 12).

Official guidance: SBA guidance for managing finances

Do you monitor debt covenant compliance and liquidity headroom on a forward-looking basis - projected covenant ratios and available liquidity against your minimum - rather than discovering the result at the compliance date?

A covenant breach discovered at quarter-end can trigger default interest, blocked draws, or acceleration with no time to negotiate; projecting compliance from the 13-week forecast buys the negotiating window. If the company has no debt, answer from whether you track liquidity headroom against a defined minimum-cash floor - the discipline is the same.

The treasury baseline is in place - shift attention to yield, bank fees, counterparty concentration, and periodic control testing (Green Book, Principle 12). Covenant surprises remove options exactly when they are most needed - build forward headroom monitoring into the weekly forecast refresh (SBA guidance for managing finances).

Official guidance: SBA guidance for managing finances