What is involved in having bank reconciliation performed by an outside provider?

What does the provider do in one cycle, and what stays with you?

The provider performs the periodic bank-to-book tie-out on your behalf, while the books, and every decision the tie-out surfaces, stay yours. One cycle divides like this:

The Washington State Auditor's cash manual for local governments lists bank activity the books may not yet hold, such as interest earned, bank fees, NSF checks and unrecorded deposits, and says the records should be updated for all of it. Agree which of those entries the provider may make itself.

If the account has a bank feed, agree who handles downloaded transactions too. Intuit's help on matching in QuickBooks Online says matching links a bank transaction to a record you already created and prevents duplicate entries, so the provider matches what staff entered rather than adding it again, and its list of entries shows what it matched and what it created. The same help says matching to an invoice or bill also marks it paid, and tells you to verify first that the payment was actually sent or received, so agree that the provider matches to one only where payee, amount and reference agree, lists each such match, and sends any doubtful one to you as an open item.

What has to be settled before the first cycle?

A provider that starts without these either cannot get the data or does not know when it has finished. Settle them in this order:

1. Accounts in scope. List each bank and card account to be reconciled, with its ledger account and statement period. Name any account left out and the person inside the business who reconciles it.
2. Ledger access. Set up a named user for the provider, write down what it may change, and record who removes it at exit and how. Require the provider to report, within an agreed number of days, anyone with access to your books or bank who leaves the engagement or the firm, and have that person's access removed at once (Chase's business account-management page, for example, lets you suspend or delete a user). Recheck both user lists whenever your own admin or reviewer changes.
3. Statement source. Have the provider take statements from the bank as its own view-only user, or from someone who neither records transactions nor handles cash, never from the bookkeeper whose entries it reconciles. The Washington State Auditor's guidance on bank statement review warns that fraudsters often alter statements before someone else independently reviews them.
4. Cadence and cut-off. Tie each cycle to the statement closing date, and fix how many business days after it the reconciliation and your answers are due. Before you fix either, find any time limit your account agreement sets for reporting unauthorized or erroneous transactions, and set both so each reconciliation, and your report to the bank, falls well inside it; if the window is short, reconcile more often or have someone inside check account activity between cycles. For busy or high-risk accounts, the Washington State Auditor's cash manual tells governments to consider reconciling more often, even daily.
5. Deliverable set. Agree what comes back for each account and cycle, to the evidence standard described under judging the work.
6. Exception routing. Record which items the provider may clear under a written rule, who answers its questions and by when, which go to your accountant, who handles bank-feed transactions, and who gets a same-day report of a possibly unauthorized charge.
7. Internal reviewer. Name the person who reviews and approves each reconciliation, and a deputy. Intuit's audit-log help lists admin access as a requirement for the QuickBooks Online audit log, so if the reviewer is not the owner, have the owner or another admin run the audit-log checks with them rather than making the reviewer an admin: Intuit's help on inviting accountant users says admins can do pretty much everything, so the reviewer could change what they approve.

How should the provider get into your books and bank data?

The Federal Trade Commission's cybersecurity guidance for small businesses says to limit vendor access to a need-to-know basis, and only for the time the vendor needs to do the job. The three ways to give ledger access differ:

Only the first leaves a usable audit trail, and it makes the provider's changes attributable and removable, not narrow. Intuit's audit-log help for QuickBooks Online says changes a connected third-party app sends or makes appear as System Administration events rather than under a person's user, so the written terms should forbid the provider to connect an app to your file without your agreement and require it to list any it uses. In QuickBooks Online, Intuit's help on inviting accountant users says a primary admin or company admin sends the invitation and that accountant users get tools to review your books and make corrections. The same page suggests upgrading to Advanced if you need more than 2 accountant firms, so count the firms already invited. Intuit's help on removing an accountant user says an admin can remove one at any time, and the removal is immediate.

On Advanced, Intuit's custom-roles help says you choose what users can see and do in areas such as banking; check any role you give the provider before relying on it. Otherwise, list in the written terms what the provider may change, forbid it to add, change or disconnect bank connections, and have your reviewer check the audit log against that list. Intuit's audit-log help says the log shows the date and user of each change and cannot be turned off, but keeps its history for 2 years, so keep each cycle's reviewed deliverable and dated approval yourself.

For statements, the provider does not need your online-banking login. Chase's business account-management support page, for example, says you can restrict a user to view-only access to some or all of your accounts, and that deleting a user ends its access to all of them. Give a provider view-only access to the in-scope accounts and no transaction rights, so it can see activity but cannot move money.

What if your books are in a desktop or hosted file?

If the provider works in your installed or hosted file, give it its own user. Intuit's help on setting up an External Accountant user in QuickBooks Desktop recommends that role for accountants; such a user reaches all areas except customer credit card numbers, can make any changes, and has its changes tracked by your audit trail. On a hosted file, the provider's login to the host should be its own too. Before the first cycle, confirm for your QuickBooks version, and with your host, how each login is removed; on the last day, remove both, check that the user no longer appears in your file's user list, and get the host's confirmation that the login is closed.

If you exchange files instead, Intuit's help on using the Accountant's Copy says you can keep working in your file meanwhile, but the provider's QuickBooks version must match yours. Intuit's help on creating the copy, which covers QuickBooks Desktop for Windows only, has you enter a dividing date, and restricts certain activities in your file until you import the provider's changes or remove the restriction. On QuickBooks Desktop for Mac, check how your version exchanges files with an accountant before choosing this route. Intuit's help on import errors says a reconciliation done in an Accountant's Copy can hold at most 800 transactions; change its dates to shrink a larger one. The same help says that if the bank reconciliation shows up on the Incorporate Accountant's Changes report, some transactions failed to import, and you must remove the restriction and send a new copy.

So agree the dividing date as the cut-off, decide who reconciles each account while the copy is out, and import the returned changes before the next cycle, then check that each account's reconciliation appears in your live file before you accept the cycle. If the engagement ends with a copy out, import the changes or remove the restriction first. Entries made in a copy reach your file through that import, so nobody re-keys them; if an import cannot be fixed, Intuit's help on import errors has you enter the changes manually. For extracts or a failed import, one named person keys the provider's entries into the live file once, and the provider checks them against its list. Either way, have the provider sign and date each reconciliation.

Who decides the items the provider cannot clear?

The provider clears timing differences as the bank catches up, and records bank items under your rules. The Washington State Auditor's cash manual says a bank error should be communicated and resolved with the bank; raising it stays with you.

What the provider cannot settle is what an item is. The manual says an unrecorded deposit should be investigated and recorded and, if unknown at reconciliation, held in a suspense fund until resolved; in a business, that is a holding (suspense) account. Agree whether the provider may post an unidentified deposit there. It stays on the open-items list until resolved. If it proves to be a receipt the business has recorded or will record elsewhere, such as an invoice payment, clear the holding entry against that record (reverse it and match the bank line to the payment, or apply it to the invoice) instead of reclassifying it to revenue or receivables, and tell staff not to record it again, so the receipt counts once. The holding account should be empty once every answer is in. Each item then takes an agreed route:

A charge that may not have been authorized is not a coding question. The provider reports it to your named person the day it is found, and you raise it with the bank at once rather than at cycle close. Check whether your account agreement sets a time limit for reporting unauthorized transactions.

Each open item carries a question, an owner, the date asked and a reply-by date, and the provider records answers as they arrive. A cycle is closed when every account ties to its statement, every reconciling item is resolved or listed with those four entries, and your reviewer has approved the reconciliation. An item unanswered at its reply-by date goes to the reviewer and heads the next cycle's list.

Does outsourcing the preparation outsource the review?

No. The Washington State Auditor's guidance on audits of cash suggests having departments submit reconciliations to central finance for checking, so preparer and reviewer differ; hiring a preparer leaves the review with you. The Journal of Accountancy's refresher on fraud controls gives the classic split: the person receiving cash should not be the one who records it, deposits it or reconciles the bank account. An outside reconciler takes over only the last duty; if one person inside still receives, records and deposits cash, that concentration remains.

Name the reviewer: the owner, or a manager who neither records transactions nor handles cash. Working from a statement taken directly from the bank, the reviewer applies the checks in the Washington State Auditor's guidance on audits of cash: scrutinize old outstanding checks and unexpected deposits in transit for validity and support, follow up any unresolved variance, and check the math. The reviewer then signs and dates the approval. If nobody inside the business can do this, the control is missing whatever the provider sends.

A signed reconciliation shows only that one account's bank record agrees with your books' record of it. A payment coded to the wrong expense can sit inside a perfectly reconciled account, and a missing bill never touches it, so the reconciliation never replaces a review of the rest of the books.

What changes if the same firm also keeps your books?

Reconciliation only, over books kept in-house. The outsider separates reconciling from recording. Access can stay as narrow as your platform allows. The provider records only bank items you have authorized, reports errors in staff entries as open items for staff to correct, and changes a staff entry only under a written rule, showing every such change on its list of entries made or changed.

Reconciliation inside a full bookkeeping engagement. The firm that recorded the transactions is now checking them. In the AICPA's rules for CPA firms that audit or review a client, quoted in the Journal of Accountancy's 2016 article on nonattest services, this is a self-review threat. If the same CPA firm also performs an engagement that requires independence, such as an audit or review of your financial statements, those rules apply directly: the 2016 article says they require you to agree to assume all management responsibilities, designate someone with suitable skills, knowledge or experience to oversee the service, evaluate its adequacy and results, and accept responsibility for the results. Without such an engagement, the same risk still arises when a firm checks records it created. The firm also needs broader rights, and you see fewer questions because it has already coded what it recorded.

So your own checks carry more weight: read statements you obtain directly from the bank, work through the open-items list, spot-check the coding of a sample of transactions, and keep an admin role inside the business. Intuit's help on removing an accountant user says that takes a primary admin or company admin.

What should the written terms settle?

Terms become contested when a relationship fails, so put the seven items settled before the first cycle in writing. Add whether a catch-up of past periods is included, what happens to overdue answers, who removes each named ledger and bank user, and a requirement for multi-factor authentication on each of the provider's logins, which the Federal Trade Commission's guidance says to require to protect sensitive information. Then settle three more terms:

• Accuracy of the records. Settle who answers for the accuracy of the records and decisions you supply, who answers for errors in the provider's own work, and how, by when and at whose cost those errors are corrected.
• Handback at exit. Name every reconciliation report, the open-items history, the supporting files and the working papers as deliverables, due within a set number of days in files you can open.
• Data after exit. State how long the provider may keep copies of your statements and files and how it will delete them, as the Federal Trade Commission's cybersecurity guidance advises for vendors.

Write the handback in even if the provider is a CPA who is an AICPA member. The Tax Adviser's summary of the AICPA's records-requests rule says a member must generally provide records you gave it, records it was not specifically engaged to prepare that are not in your books (such as adjusting entries it proposed, with supporting schedules), and its work product, meaning the deliverables in the engagement terms. It need not provide its working papers unless laws or contracts impose more, and may withhold its own records and work product in certain circumstances, such as when fees are due.

Compare proposals on accounts, transaction volume, cadence, turnaround, whether exception work is included or billed separately, and whether any catch-up is priced as its own project. To test a provider cheaply, start with one account for a cycle or two before widening access.

How can you tell the reconciliation was actually done?

The returns in the cycle table are your acceptance test, and each should carry its own evidence:

• The reconciliation report. Intuit's help on reconciliation reports says QuickBooks Online generates one each time you finish reconciling, with beginning and ending balances and the transactions cleared and left uncleared. It also generates a new report when the same month is reconciled again, so ask why if you find two for one account and period.
• The statement it was reconciled to. Compare it with the report and with your own copy from the bank.
• The open-items list. Every item shows its date, amount, question, owner, reply-by date and age.
• The list of entries made or changed. Every entry cites the agreed rule or your decision behind it, and shows whether it was matched to a feed item or created.
• The preparer and the date. Intuit's QuickBooks Online audit log should show the provider's user making those entries on those dates, but entries made through a connected app show as System Administration, so check those against the provider's list of entries; for work in a copy or on extracts, the provider's signature and date stand in.

Watch for three signs that the work was not done:

• An unexplained balancing entry. A plug is a difference nobody researched.
• Edits to reconciled periods. Intuit's help on reconciliation reports calls the saved report static, and Intuit's audit-log help points you to indirect edits such as an edited reconciliation.
• A growing open-items list. Questions are sitting unanswered in the business, or the provider is listing items rather than resolving them; either way the loop has stopped closing.

What if the engagement starts with months that were never reconciled?

Then you are buying two things. The catch-up is a bounded project with its own scope, price and acceptance test, such as every in-scope account reconciled month by month from an agreed starting balance, ending with an open-items list your reviewer has approved. The recurring cycle starts once the catch-up is accepted, and its price and acceptance terms should not absorb the backlog. While the catch-up runs, have current activity checked against the bank for unauthorized charges at the agreed cadence, so the backlog does not delay reporting them. How to work through the old periods is a separate question.