By Shagun Malhotra, Founder and CEO of SkyStem.
A $2 million suspense account and a $40,000 operating account shouldn’t consume the same amount of review time simply because both appear on the reconciliation checklist. Yet in many financial close processes, they do. A stable bank account with a clean history can receive the same scrutiny as a volatile suspense account that’s been drifting for months. While the process may be consistent, the risk isn’t.
A recent report from the ACFE found that proactive data monitoring was tied to a 53% reduction in median fraud loss, one of the strongest control effects in the study. The same report tied 70% of the fraud cases examined to three weaknesses, namely a lack of internal controls, overridden controls, and insufficient management review.
An undifferentiated reconciliation review is a classic paper control that fulfills a requirement without mitigating actual risk.
When reviewer time is split evenly, a low-risk account gets checked off just like it would under a properly scaled process. But a high-risk account that actually needed extra attention gets rushed through because there’s no allotted additional time set aside for a thorough review. That gap, though, doesn’t show up until weeks later as a post-close adjustment, or months later as an audit finding, by which point tracing it back to a rushed review is nearly impossible.
Reconciliation triage means separating accounts by actual behavior instead of habit. The variables that should drive tiering aren’t complicated: how often an account produces a variance, how large that variance tends to be in dollar terms, and how volatile the account’s activity is relative to its historical baseline.
An account with a stable history and no unexplained variances for the last several cycles doesn’t need the same walkthrough as one that keeps producing surprises. The first can follow a streamlined path: confirm the balance, verify there’s no deviation from historical patterns, and close it out. The second earns the deeper review it should have been getting all along, without competing for attention against a number of other line items that did not really need it.
Routing the same hours toward the accounts where a missed error actually matters is a better use of everyone’s time. A control environment that spends five minutes on a low-volatility account and the exact same five minutes on a high-turnover account with a history of adjustments is spreading limited attention so thin that real anomalies get lost in the noise.
Controllers also underuse a defensibility argument that comes with tiered review models. A process where risk tier determines depth of review, and that logic is documented, holds up better under audit than a flat process that claims equal rigor everywhere but delivers shallow attention across the board. PCAOB’s risk assessment standard, AS 2110, directs auditors to scale the nature, timing, and extent of procedures to the assessed risk of material misstatement, meaning higher-risk areas are expected to draw more audit attention than lower-risk ones. A reconciliation process built the same way mirrors the same logic auditors are already required to apply. Auditors don’t expect every account to get the same treatment. They expect the treatment to match the risk, and they expect you to be able to explain why.
Getting there doesn’t require buying new software right away. Start by pulling twelve months of reconciliation history and sorting accounts by variance frequency and dollar impact. Plenty of teams have never actually done this, which is part of why the same review steps get applied to everything by default. Once accounts are segmented, the review calendar can follow, with low-risk items on a lighter cadence and high-risk items getting the depth they’ve been missing.
Software can make that segmentation easier to sustain once volume grows past what a spreadsheet can track cleanly. But don’t automate the problem before having a proper diagnosis.
As most controllers can implement these changes right away, they should also seek to build a process that tells them where to look. Right now, for most close processes, it doesn’t. Closing that gap is one of the few controls upgrades a finance team can make without adding a single new person to their payroll.
ABOUT THE AUTHOR:
Shagun Malhotra is CEO of SkyStem, a financial close management software company serving mid-market and enterprise organizations. She has over two decades of experience in finance and accounting technology.
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
Tags: Accounting, Firm Management, Small Business
