Managing Bank Account Risk
The impact of the credit crunch continues to be felt by corporations across many industries. These companies are taking a ‘back to basics’ approach to cash management with a focus on operational efficiencies: minimising bank fees and internal costs, increasing cash visibility and maintaining strong internal controls. Yet corporate treasury managers are faced with managing a complex mix of banking relationships to support businesses that must stay nimble in the current environment. Maintaining a constantly-changing inventory of bank accounts and signatories may not be at the top of their list of priorities, but to neglect it can invite unnecessary bank costs, loss of cash visibility, failure to comply with internal controls and corporate governance policies, and even risk of financial loss due to fraud. The effective use of technology can help establish and maintain a bank account and signatory repository and workflow that enables treasury to manage changes in order to mitigate risk, control costs and increase visibility.
With far-flung business units, subsidiaries, suppliers, and sales offices, the modern corporation must often grapple with hundreds of bank accounts. New accounts are opened frequently at the local level while others become dormant as business needs evolve. Banking relationships, services and required documentation may vary from account to account or region to region. Local laws often restrict who may control or access accounts. Authorised signatories are constantly changing as personnel come and go, or change function or title.
Applying even basic risk management techniques such as transaction limits in a uniform manner is difficult when account and signatory information is dispersed. Maintaining a sophisticated hierarchy of concentration, disbursement and zero balance accounts on a global basis is even more daunting. Banking partners may help manage the complexity and risk, but at a cost. Ultimately treasury is called to account if anything goes wrong.
Maintaining a repository of account and signatory information is the first step toward monitoring and controlling bank account risk. An effective account repository tracks the services, such as positive pay or controlled disbursement, available to the account, the purpose of the account, and overall limits on the account in accordance with the corporate governance framework. Various bank contacts are retained for making changes or opening investigations such as for a relationship manager, a branch manager, or for the controlled disbursement, lockbox, wire or fund management departments.
Treasury must create an audit trail of account-related documentation that demonstrates to their auditors compliance with corporate governance policies and central bank regulations. An electronic repository of scanned documents can ease this process. The repository tracks all bank correspondence – such as a letter to remove a signatory and confirmation from the bank, or a request to close an account and the final bank statement showing a zero balance – as well as corporate and account resolutions, secretary certificates, articles of association, powers of attorney, depository terms & conditions, detailed service agreements, and loan agreements.
Signatory information is just as critical as account data and often more difficult to maintain. A list of each individual’s authorised transactions on each account (ACH, FED wire, dual signature draft, etc) and associated limits is the goal. It is also useful to know, in addition to basic contact information, the signatory’s title for each account. A signatory may have authorisation to accounts under several titles due to corporate structure or local restrictions. For instance, the CFO might be titled CEO on accounts for a finance unit, or the corporate treasurer might sign as an SVP on an account where the head of corporate tax signs as treasurer.
The US residency status of the signatory must also be tracked to facilitate proper filing of the Report of Foreign Bank and Financial Account (FBAR) with the IRS for all individuals with signature authority over foreign accounts that reside or are doing business in the US. The penalty for ‘willful’ non-compliance with FBAR is now 50% of the highest value of the account over the last six years and is being more widely enforced. Copies of documents, such as signature cards, passports, visas, and work permits, should be stored to determine who meets the reporting requirement. Passport information will also be required for foreign nationals who need access to accounts in the US.
A key challenge in maintaining signatory information is normal personnel turnover. Treasury needs regular updates from human resources (HR) in order to remove signatories as personnel leave or transfer. In certain countries, changing account documentation can take more than six months due to local document authentications. Having documentation that allows for the removal of a signatory with a simple letter is effective. Adding signatories, on the other hand, requires time and planning.
Account and signatory data may be widely dispersed, but need not be difficult to collect and maintain if the task is pushed out to business units. A large amount of data that changes regularly and is maintained by numerous people is a candidate for a software solution. For account and signatory data, the important attributes of a solution are security, accessibility, usability, workflow, and auditability: security because this data represents a major operational risk; accessibility and usability because this data has many contributors around the world and must be managed in quantity; workflow and auditability because, as we will see, treasury must be able to leverage this data to exercise appropriate control over the overall corporate liquidity structure.
Once the task of compiling account and signatory information is underway, the individual risk of each account and signatory may be assessed. The risk profile of an account should take into consideration the type of account, the overall account limits, the number of signatories, the transactions authorised to them, and the limits on each, and any risk mitigation services like controlled disbursement and positive pay. Similarly, the risk profile of a signatory should account for the number and type of accounts to which they are authorised, as well as the types of transactions and limits.
An account or signatory may be assigned a risk profile of low, medium or high based on these factors. The task is then to determine ways to reduce exposure in the high-risk accounts, perhaps by introducing new bank services, setting new limits, or removing signatories. High-risk signatories may also be addressed by lowering limits or restricting the range of transactions or accounts granted to them.
The difficulty in assembling account and signatory data often stems from the fact that many bank accounts are opened at the local level, perhaps without the approval or even knowledge of treasury. Maintaining its account data requires that treasury insert itself into this process. Local laws may require action to be taken locally on account openings and modifications, but that doesn’t mean treasury cannot exercise oversight and control of the process.
If local managers are mandated to flow account openings and modifications, including additions of signatories and changes to their authorisations, through treasury for review and approval, treasury gains the opportunity not only to limit risk, but also to strategically evaluate the need for new accounts. It may be advantageous to use an existing account, or grant signature authority to additional individuals, rather than open a new account. Or, vice versa, it may be more appropriate to open a new account than to grant signature authority to an additional individual. Treasury is thus able to enforce its corporate governance framework and direct the evolution of the account and signatory framework, as well as update its account and signatory repository to assist in risk management.
Treasury can take the initiative in validating the existing account and signatory structure without waiting for new requests by automating a regular audit of bank accounts and signatories. A quarterly or annual audit requires local managers to verify and correct a corporate’s existing account and signatory list. It may also require managers to submit bank statements for accounts that are not regularly polled by treasury for reconciliation to account balances and general ledger balances. Pushing treasury’s account and signatory repository out through a secure internet portal facilitates frequent replication and management of the audit for both treasury and business units. If hosted offsite, it can also be an important element in treasury’s disaster recovery plan.
A bank account and signatory audit has several benefits. First, the process may discover accounts and signatories unknown to treasury. These accounts may be incorporated into treasury’s cash management processes, perhaps improving overall liquidity. Second, newly-discovered accounts may be determined to be excessive and either closed or have services curtailed to save costs. Third, this new information will update treasury’s account and signatory repository and contribute to operational risk management by, for instance, indicating where additional bank services could mitigate risk. Fourth, this discovery process may provide more visibility to the business units themselves into their use of bank accounts. Finally, the audit trail produced by this process may assist with SOX 404 compliance.
Leveraging technology to build an effective bank account and signatory repository and management process can yield direct benefits in lower bank fees, improved global cash visibility, decreased operational risk, and easier compliance with internal controls and governance policies. In an environment where liquidity cannot be taken for granted, visibility into cash balances and who has access to those balances is more critical than ever.