Bank Statement and Cash Analysis

Bank Statement and Cash Analysis
Discipline	Forensic accounting; fraud examination
Core tests	Proof of cash; bank reconciliation review; deposit-in-transit and outstanding-check tests; kiting and lapping tests; check examination
Indirect methods	Source and application of funds; expenditures method
Typical inputs	Bank statements, check images, deposit slips, cash receipts journal, general ledger
Fraud-tree branches	Skimming; cash larceny; check tampering; fraudulent disbursements

Bank statement and cash analysis is the family of procedures a forensic accountant uses to test whether the cash an organization (or a person) reports agrees with what actually passed through its bank accounts. Because almost every asset-misappropriation scheme eventually touches cash, the bank is the one independent, third-party record that a fraudster cannot easily rewrite. This article is a working guide: it sets out step-by-step procedures, formulas and worked numeric examples, followed by the evidence each test produces and the pitfalls that commonly trap examiners. For the theory of why such schemes occur see Fraud Triangle; for the person-level equivalent of the indirect methods, see Net Worth Method.

1 Acquiring and preparing bank evidence

Every test below depends on a complete, authentic set of bank records, so acquisition comes first. The procedure is:

1. Inventory every account. Request a list of all accounts, including dormant, payroll, sweep, petty-cash and savings accounts, from the bank (via the entity's signatory or by subpoena or document request in litigation). Omitted accounts are the commonest way a scheme escapes testing. Cross-check against signature cards, the general ledger chart of accounts and Forms 1099-INT.
2. Obtain statements directly from the bank, not from the suspect or from the accounting department, wherever practicable. Statements held by the suspect may have been altered. Preserve the request, the transmission and the receipt under chain-of-custody discipline.
3. Obtain images, not just totals. Request front-and-back images of every paid check and every deposit item, plus deposit slips. The back of a check (endorsements, bank stamps, the depositary institution) frequently contains the evidence.
4. Cover a continuous period that includes at least one full month before the suspected start and the whole period to date, so that the first and last periods of each test have valid opening balances.
5. Convert to a working dataset. Load transactions into a spreadsheet or database with one row per item: date, amount, check number, payee, depositor, account. Reconcile the total of the dataset to each statement's printed totals before analysing anything (a control total check).

Where records are voluminous, the same dataset supports the analytics described in Fraud Detection Analytics and Benford's Law testing of disbursement amounts.

2 Reviewing bank reconciliations for manipulation

A monthly bank reconciliation is the primary internal control over cash, and it is also the usual place where a custodian hides a theft. Review the reconciliations for the period under investigation against the bank statements, not against each other. Look for the following manipulation patterns:^[1]

• Reconciler is the custodian. The same person who handles receipts, writes checks and reconciles the bank account has the opportunity to conceal anything. Segregation-of-duties failure is a root red flag (see Red Flags).
• Fictitious reconciling items. Deposits in transit that never clear, or outstanding checks that are not on the check register, used as plugs to force agreement.
• Forced balances. An unexplained "adjustment" or "miscellaneous" line, or a book balance that was changed at the last minute to equal the bank balance.
• Altered statements. The reconciler works from a photocopied, retyped or electronically edited statement. Compare the copy held internally with a statement obtained directly from the bank, checking balances, check numbers and fonts (see Document Examination).
• Stale items carried forward. Outstanding checks or deposits in transit that remain open for many months (checks rarely stay uncashed beyond 90 to 180 days, and a deposit in transit should clear within one to three business days).
• Reconciliations prepared late or unsigned, or reconciliations missing for specific months (often the months in which the scheme was most active).

The practical test: re-perform one month's reconciliation from scratch using the bank statement, the cash receipts journal and the check register. Then trace every reconciling item to a subsequent-period statement (see section 4).

3 The proof of cash

The proof of cash (four-column reconciliation) is the most powerful single test of bank-versus-book cash because it reconciles not only balances but also the receipts and disbursements that flow between them, which exposes both unrecorded transactions and cut-off errors. It uses four columns: the beginning balance, receipts, disbursements and the ending balance. The same adjusting items (deposits in transit and outstanding checks at both ends of the period) are carried across the columns.^[1]

Procedure.

1. Choose the period (usually one month; for investigations, test several months, including months you suspect and months you do not).
2. Enter the balance per bank at the start and end of the period, and total deposits and total withdrawals per the bank statement.
3. List deposits in transit (DIT) and outstanding checks (OC) at the beginning and at the end of the period.
4. Adjust the receipts column: subtract beginning DIT (already counted by the bank this month but booked last month) and add ending DIT.
5. Adjust the disbursements column: subtract beginning OC and add ending OC.
6. Compare the adjusted bank totals to the book totals from the cash receipts and cash disbursements journals. Any difference is an unreconciled item to investigate.

Worked example. An illustrative nonprofit shows these figures for a month:

Line	Beginning balance	Receipts	Disbursements	Ending balance
Per bank statement	$40,000	$300,000	$290,000	$50,000
Deposits in transit, beginning	+5,000	−5,000	—	—
Deposits in transit, ending	—	+9,000	—	+9,000
Outstanding checks, beginning	−8,000	—	−8,000	—
Outstanding checks, ending	—	—	+12,000	−12,000
Adjusted (true) cash	$37,000	$304,000	$294,000	$47,000
Per books (ledger)	$37,000	$296,500	$294,000	$39,500
Difference	0	$7,500	0	$7,500

Check: $37,000 + $304,000 − $294,000 = $47,000, so the adjusted bank columns foot across. The books, however, recorded $7,500 less in receipts than the bank actually received, leaving book cash $7,500 too low. In this fact pattern the discrepancy is in the books, not the bank, and it must be explained: unrecorded donations or loan proceeds, a transfer from another account, or a receipt that the bookkeeper recorded as a net amount after pulling cash. The inverse pattern, where book receipts exceed bank receipts, suggests fictitious entries or deposits that were never made; if the shortfall is concentrated in cash (currency) receipts, skimming or lapping becomes the leading hypothesis.

What the test cannot do. The proof of cash shows that recorded and banked amounts differ; it does not tell you whether revenue that was never recorded or banked (pure off-book skimming) exists. That requires the indirect methods in section 8 or comparison to independent sales evidence (see Analytical Methods).

4 Deposit-in-transit and outstanding-check tests

Both reconciling items rely on the reconciler's say-so, so test them directly against the following period's bank statement (a "subsequent clearing" test).

Deposit-in-transit test.

1. List all DIT at period end from the reconciliation.
2. Obtain the bank statement for the next month and the deposit slips.
3. Confirm each DIT cleared the bank within the first one to three business days. Tolerate weekends and holidays, but flag any item that took longer.
4. Confirm the DIT amount and the make-up of the deposit (cash versus checks) agree to the cash receipts journal and the deposit slip.
5. Flag a DIT that does not clear, clears for a smaller amount, or clears in a differently composed deposit. A common concealment is to record a "deposit in transit" on the last day of the month that is later offset with the next month's receipts.

Outstanding-check test.

1. List outstanding checks at period end from the reconciliation.
2. Trace each to the check register and to the date and amount in the following statements.
3. Flag outstanding checks that are listed on the reconciliation but are missing from the register, that have been outstanding more than six months, or that were issued for round amounts at the period end. A check recorded as outstanding but actually cashed (the paid check is in the next statement dated before the period end) shows a deliberately false reconciling item.
4. Test the reverse: checks dated in the period that cleared in the first days of the next month but are not listed as outstanding. This understates outstanding checks and overstates cash, one signature of window dressing.

Cut-off arithmetic. Adjusted cash equals balance per bank + DIT − OC. If the entity delayed recording $25,000 of checks written in the last days of the month, the book cash balance is overstated by $25,000 at period end, which can hide a loan covenant breach or a negative working-capital position. The proof of cash catches this because the same $25,000 appears in the disbursements column of the following period.

5 Kiting

Check kiting exploits the float, the time between a check being deposited and the funds being collected from the drawee bank, to create a fictitious balance that does not exist. Typically two or more accounts at different banks are used: a check drawn on Account A is deposited in Account B, which is credited provisionally, and the funds are drawn out before the check clears; a check on Account B is then deposited back into Account A to cover the first overdraft, and the cycle repeats and grows. Each bank sees only its own side. A related variant, kiting with wire transfers, uses same-day wires in place of checks to move apparent funds between accounts.

A well-documented example is E.F. Hutton & Co., which in 1985 pleaded guilty to 2,000 counts of mail and wire fraud for a 1980–1982 scheme in which it deliberately overdrew accounts at many banks and covered the overdrafts with checks drawn on other banks, obtaining in effect interest-free loans. Hutton agreed to a $2 million fine and the costs of the investigation, and to restitution to the affected banks.^[2] The case shows that kiting is not limited to small businesses; it is a form of unauthorized borrowing.

Detection procedure.

1. Obtain statements for all accounts held by the entity and by related parties for at least a month on either side of the suspect period.
2. Build a transfer schedule: list every deposit of a check drawn on another of the entity's accounts, and every check that clears an account and was deposited into another. Fields: drawn-on account, check number, amount, date written, date deposited, date cleared.
3. Calculate the float days for each item (date cleared minus date deposited). Kites rely on a sustained gap of 2 to 5 days.
4. Compute the kite balance: the total of items in float on each date. Compare it to the ledger balance of the accounts; a kite shows as a large "balance" supported by uncleared items.
5. Run statistical screens: deposits and checks of near-equal amounts between the same accounts; check numbers that appear sequentially across the accounts; account balances that hover near zero with large gross activity ("high turnover, low balance"); total debits and credits that are many multiples of the real business revenue.
6. Reconcile the schedule to the proof of cash. A kite appears as large reconciling items in both DIT and outstanding checks that net to a small number.

Worked example (illustrative). Account A at Bank 1 and Account B at Bank 2 each carry a true balance near $0. On day 1 the owner writes check #101 for $50,000 on A and deposits it in B; B shows $50,000 provisional. On day 2, he writes check #5001 for $50,000 on B (available because of the provisional credit) and deposits it into A so that check #101 clears. On day 3, #5001 clears at B only if another check covers it, and so a larger check on A is deposited in B. The kite grows by the amount needed each time to stay ahead of the float. At the point of collapse the apparent balance, perhaps hundreds of thousands of dollars, vanishes and the banks hold the loss. The statements show check #101 deposited on day 1 but not cleared until day 3, and the equal-amount cross-deposits are the fingerprint.

Criminal exposure arises mainly under 18 U.S.C. 1344 (bank fraud) and the wire and mail fraud statutes. Banks themselves monitor for kiting using “uncollected funds” and large-item reports, so the bank’s own investigation file is a useful source.

6 Lapping and skimming

Skimming is theft of receipts before they are recorded. Lapping is the cover-up method for stealing a customer's payment in an accounts-receivable system: the thief pockets customer A's payment, then applies customer B's later payment to A's account to keep A current, then applies customer C's payment to B, and so on. The “lap” must be sustained indefinitely, since stopping reveals the shortfall.

Detection procedure.

1. Match deposits to remittances. For a sample of days, compare the deposit slip, the lockbox or mail log and the postings in the receivables ledger by customer name and amount. In lapping, the name on the check (customer B) differs from the account credited (A).
2. Check dating. Compare the date of the check with the date it was deposited and the date it was posted. Lapping produces a growing delay between receipt and posting.
3. Run an aging analysis by clerk. Accounts handled by the suspect show frequent short delays and late payments with partial aging; ones that are always “just current.”
4. Send confirmations (positive, with the statement balance and the date of last payment) to a sample of customers, and have the replies go directly to the examiner, not to the clerk. A mismatch in last-payment date or amount is the best single indicator.
5. Examine credit memos and write-offs approved or posted by the suspect: they may be used to clear a lapped balance.
6. Look at the endorsement side of checks. Checks cashed or deposited into a non-company account carry a different bank stamp.

Worked numeric example. The suspect steals Customer A's $1,200 check on 3 March. On 12 March he applies Customer B's $1,500 check (actually owed on B's account) to A's account for $1,200 and records the other $300 as an unapplied credit. On 20 March he applies Customer C's $900 check to B's account, with a further $600 now needed from a later payment. Over months the amount of the lap, the sum of stolen receipts not yet covered, accumulates, so the number of “borrowed” payments climbs. A trace of March deposits shows B's remittance advice dated 12 March but B's account credited on 20 March, and customer B's confirmation shows a balance that disagrees with the ledger.

For skimming of cash sales, there is no ledger entry to trace; compare recorded sales volume to independent measures (inventory depletion, customer counts, utility use, industry gross margin) and run a proof of cash (section 3), looking at a drop in the ratio of cash-to-credit receipts. The ACFE classifies skimming as an “off-book” scheme, which is why its detection depends on indirect evidence.^[3]

7 Check-tampering examination

Check tampering is a fraudulent disbursement in which an employee forges or alters a check to pay himself or an accomplice. The ACFE identifies five principal forms:^[3]

Form	Method	What to look for on the paid-check image
Forged maker	Employee signs the authorized signer’s name	Signature differing from the signature card; hesitation, tremor; “traced” look; signature stamp used by an unauthorized person
Forged endorsement	Employee intercepts a legitimate check to a third party and endorses it	Endorsement not matching payee; deposited to an account not belonging to the payee; second endorsement by an unknown person
Altered payee	Payee changed (often to the employee) after signing	Different ink or pen pressure; payee line spaced irregularly; residue from chemical removal; payee inconsistent with the vendor master
Authorized maker	An employee with signing authority writes checks for personal use	Payees not in the vendor file; round amounts; documentation missing; approvals missing
Concealed check	A check is slipped into a stack the signer approves with an invoice bundle	Check without supporting invoice or purchase order; payee unfamiliar to the signer

Examination procedure.

1. Obtain the paid-check images (front and back) in the highest available resolution; the original instrument if litigation is likely, since images lose ink and indentation detail.
2. Sort the population by payee, amount, signer and endorsement. Flag payees that are the employee’s name, near matches, or that appear nowhere in the vendor master or purchase-order system.
3. Check the endorsement chain. Trace the depositary bank’s routing number and account stamp on the back of each suspect check, and request the deposit account’s signature card and statements through legal process.
4. Compare check numbers to the check register. Gaps, out-of-sequence numbers, voided checks that nonetheless cleared, and checks cleared but not recorded are all indicators.
5. Refer questioned documents to a qualified document examiner for handwriting, ink and alteration analysis. See Document Examination and Daubert Standard for the reliability standards to which such testimony is held.
6. Quantify. Total the fraudulent checks by month; this is the loss figure for the report.

Legal timing. Under UCC § 4-406(f), a customer who fails to discover and report an unauthorized signature or alteration within one year after the statement or items are made available loses the right to assert the claim against the bank.^[4] The practical consequence is that account statements should be reviewed promptly, and that an investigation which finds forged items must preserve the claim by notifying the bank in writing well inside that window; shorter periods can be fixed by account agreement. The “positive pay” service, in which the company transmits its issued-check file and the bank matches presented items, is the leading preventive control.

8 Source and application of funds; expenditures method

When books are missing, destroyed or untrustworthy, the examiner reconstructs income indirectly from how money was spent. The source and application of funds analysis (also called cash-flow analysis) lists every identified source of cash and every identified use over a period, and treats the difference as unexplained.

Formula.

Unexplained funds  =  Total applications of funds  −  Total identified sources of funds
Applications  =  living expenses + purchases of assets + debt repayments + deposits to savings
Sources       =  known (reported) income + loan proceeds + asset sales + decrease in cash on hand + gifts

The expenditures method is the same logic applied to a person: if expenditures exceed known sources of funds, the excess is attributed to unreported income. It is the cash-based sibling of the net worth method, which compares changes in net worth instead.

Worked example (illustrative).

Item	Amount
Living expenses (rent, utilities, food, travel, from bank and card records)	$86,000
Vehicle purchased for cash	$42,000
Mortgage principal repaid	$18,000
Increase in savings and brokerage balances	$30,000
Total applications	$176,000
Reported salary after tax	$95,000
Loan proceeds	$10,000
Sale of old vehicle	$8,000
Decrease in cash on hand (beginning less ending)	$5,000
Total identified sources	$118,000
Unexplained funds (possible unreported income)	$58,000

Because the result is an inference, the examiner must (1) establish an opening position (cash on hand and net worth at the start; in tax prosecutions, the courts have required the government to establish an opening net worth with reasonable certainty and to investigate leads offered by the taxpayer), (2) rule out non-income sources, such as gifts, inheritances, loans and prior savings, and (3) show a likely source, such as the business. Without this, the figure proves only that spending exceeded recorded income. For large cases see Asset Tracing, and for laundering-related uses of the same logic, Money Laundering.

For a business, the equivalent is a cash-flow reconstruction: total bank deposits less transfers, loan proceeds and other non-income deposits gives net business receipts; compare it with reported revenue. Bank deposits method is the common name when the reconstruction starts from deposits. Adjustments needed: remove inter-account transfers (double-counting), refunds, redeposited items (a returned check redeposited), and add cash expenses paid from receipts before deposit.

9 Pitfalls and documentation

• Double-counting transfers. Failing to eliminate transfers between the entity’s own accounts is the most common error and inflates apparent receipts.
• Incomplete account coverage. A missing account breaks the proof of cash and makes the unexplained amount meaningless.
• Cut-off drift. Unless beginning DIT and outstanding checks are carried across, a proof of cash will always show a difference.
• Treating anomalies as proof. A mismatch is a lead. Interview the preparer (see Forensic Interviewing and Statement Analysis) before concluding that it is fraud; legitimate causes include timing, bank errors and foreign-exchange.
• Confirmation bias. Run the tests on months you do not suspect as a control; a method that flags every month is measuring noise.
• Documentation. Keep a working-paper trail: source documents, who obtained them and when, formulas used, reconciling items traced and the conclusion. Reproducible work is what survives cross-examination (see Evidence and Testimony and Forensic Accountant Ethics).

See also: Net Worth Method, Occupational Fraud, Journal Entry and Ledger Testing, Link and Network Analysis, Red Flags.

References

1. Crain, M., Hopwood, W., Pacini, C. & Young, G. Essentials of Forensic Accounting (AICPA), 2015; Wells, J. T. Principles of Fraud Examination (Wiley), proof-of-cash and reconciliation procedures.
2. Securities Historical Society. “Hutton Guilty” (1985 news record of E.F. Hutton’s plea).
3. Association of Certified Fraud Examiners. Occupational Fraud 2024: A Report to the Nations (scheme definitions: skimming, check tampering). acfe.com
4. Uniform Commercial Code § 4-406, “Customer’s Duty to Discover and Report Unauthorized Signature or Alteration.” Cornell Legal Information Institute. law.cornell.edu