Corporate bank accounts are often treated as treasury infrastructure, but the related master data and access rights can directly affect payment execution, cash visibility and financial reporting. Accounts may be opened for a new entity, changed after a bank relationship update, restricted during a system migration or left active after a business unit closes. If the account inventory and approval trail are incomplete, finance may not know which accounts exist, who can change them, or whether the account remains necessary.
For controllers in the United States and Canada, the objective is a controlled lifecycle: every corporate bank account should have a business owner, documented purpose, approved access, reliable statement integration and a clear process for changes and closure. The exact workflow differs by bank, ERP deployment and company policy; this article focuses on practical governance rather than bank-specific legal requirements.
Why bank-account governance belongs in the control framework
Bank account master data supports payment processing, bank reconciliation and cash positioning. A wrong or outdated account assignment can misroute payments, delay reconciliations or cause treasury reports to omit cash. Excessive access may allow unauthorized changes to account details or payment approvals. Dormant accounts may also remain in bank portals or ERP configuration after their original business purpose disappears.
SAP’s Cash and Liquidity Management documentation describes centralized bank-account management and supports workflow or dual-control processes for opening, changing, closing and reviewing accounts in relevant configurations. See the SAP Help Portal overview of Bank Relationship Management. Availability and exact capabilities depend on product edition, release and configuration; validate the design in your own environment.
Ten controls for the bank-account lifecycle
1. Maintain one authoritative account inventory
Keep a controlled register of corporate accounts across legal entities, currencies, banks and countries. At minimum, record the legal owner, bank name, account identifier using an appropriately masked display, currency, purpose, company code, account status, business owner, statement method, payment role and last review date. Reconcile the inventory to ERP house-bank configuration, bank portal access lists and treasury records on a defined schedule.
2. Require documented business need and approval
New accounts should have a stated purpose, expected transaction activity, legal-entity owner, currency rationale and intended users. Obtain approval from designated treasury and finance authorities before setup is completed. Avoid informal requests that arrive through an unverified email or chat. If a bank requires its own forms and signatories, retain those records with the internal approval package.
3. Separate request, setup and approval
Where practicable, the requester should not be the sole person who creates the account record and approves it for use. Apply dual control to sensitive changes such as account identifiers, bank details, payment approvers and status. Where the team is too small for full segregation, use a compensating independent review and retain evidence that it occurred before the account was used.
4. Verify account changes through a trusted channel
Changes to bank details, signatories or payment approval arrangements should be confirmed using an established contact method already on file, not contact details supplied only in the change request. Record who requested the change, who independently verified it, who approved it and when the change became effective. This control should cover the company’s own accounts as well as relevant bank portal and ERP records.
5. Govern access in both the ERP and bank portals
ERP access and bank portal access are separate control surfaces. Review who can maintain house-bank configuration, change account assignments, create or approve payment files, release payments and administer users. Compare the roles to job responsibilities and remove access promptly when employees transfer or leave. Review emergency or privileged access and retain evidence of post-use review where emergency access is permitted.
6. Confirm statements and reconciliation coverage
Every active account should have an owner and a defined process for obtaining statements or bank transaction data. Reconcile expected accounts to the statement-import configuration and bank reconciliation process. Monitor missing statements, failed imports, unreconciled items and unusual delays. A bank account that is present in the register but missing from the reconciliation process can weaken cash completeness and period-end assurance.
7. Reconcile actual cash flows to forecasts
For accounts included in liquidity planning, compare bank-statement flows with forecast items and investigate unmatched or duplicate forecast lines. SAP documents cash-flow reconciliation features that compare bank statement flows with forecasted flows and can help identify unknown or unfinished payments. See SAP’s Reconcile Cash Flows app documentation. These capabilities are product- and configuration-dependent; organizations may use a different treasury platform or controlled spreadsheet process.
8. Review inactive accounts and unused payment routes
Periodically identify accounts with no activity, obsolete company-code assignments, discontinued payment methods or no clear business owner. Ask the owner whether the account is still needed and whether statements and reconciliations remain complete. Do not close an account solely because it appears dormant: confirm outstanding checks, pending receipts, fees, payroll or tax payment dependencies, and other operational needs first.
9. Control closure and retain evidence
Account closure should be an approved workflow, not just a status change in the ERP. Confirm that open payments and receipts have been addressed, bank access is revoked, recurring transactions are redirected, statement feeds are stopped appropriately and the ERP record is marked according to the organization’s retention and audit policy. Retain bank confirmation and evidence of the final reconciliation.
10. Monitor changes and exceptions
Generate a periodic report of account master changes, new accounts, closed accounts, access changes, failed statement imports and unreconciled balances. Review unusual changes independently and follow up on repeated exceptions. The review should include the change history and approval evidence—not merely a screenshot of the current account record.
Controller review matrix
| Control area | Evidence to retain | Warning sign |
|---|---|---|
| Account completeness | Central inventory reconciled to ERP, bank and treasury records | Accounts appear in one source but not another |
| Opening and changes | Business justification, verified request, approval and change log | Account changed without independent verification |
| Access | ERP roles, bank portal users, approver list and review sign-off | Former employees or incompatible permissions remain active |
| Statements and reconciliation | Statement feed status, reconciliations and exception log | Missing statements or recurring unreconciled items |
| Closure | Closure authorization, bank confirmation, access removal and final reconciliation | Account is marked closed internally but remains usable at the bank |
Example: the account that disappeared from reporting
A Canadian subsidiary opens a local-currency account to support a new operation. The bank account is created, but the ERP configuration and statement-import setup are not updated consistently. Treasury’s daily cash position omits the account, while the local finance team reconciles it manually outside the standard close package. The issue may not create an immediate misstatement, but it can delay detection of unusual transactions and make cash completeness harder to demonstrate.
A controlled onboarding checklist would require confirmation of the account inventory, ERP assignment, statement integration, reconciliation owner, portal permissions and inclusion in cash reporting before the account is considered fully operational. The controller can then test that the account appears in the expected reports and that the first statement reconciles.
Suggested monthly and quarterly checks
- Monthly: review missing statements, unreconciled balances, failed bank feeds and unapproved account changes.
- Quarterly: reconcile the corporate account inventory to ERP configuration and bank portal users; confirm business owners and payment approvers.
- At every change: retain the request, independent verification, approval, system change record and evidence of completion.
- At closure: verify outstanding transactions, access revocation, statement-feed changes and final reconciliation.
- At system migration: map each active account to the target entity, company code, currency, payment method, statement channel and reconciliation owner; test completeness before cutover sign-off.
This risk-based approach supports the broader objectives of effective internal control described in COSO’s Internal Control—Integrated Framework: reliable information, clear accountability and controls that operate consistently as business processes change.
Conclusion
Bank-account governance is more than keeping a list of account numbers. It connects treasury operations, payment security, ERP master data, cash visibility and the close. Controllers should insist on a complete inventory, documented approvals, independent verification, least-privilege access, reliable statements, timely reconciliation and evidence of closure. Configure SAP or other treasury tools to support the process, but do not assume that a system workflow alone proves the control operated effectively.
Disclaimer: This article is for general informational purposes only and is not legal, accounting, banking or SAP implementation advice. Confirm control requirements against your organization’s policies, bank arrangements, applicable regulations and system configuration.
