Content authored by practitioners with experience at Amazon India, Intuit QuickBooks, and the Tata Group. Meet the team →
The statutory audit is in the final week before sign-off. The auditor circulates a draft management letter with an observation on bank reconciliation — sometimes phrased as a Significant Deficiency under Section 143(3)(i) internal-financial-controls reporting, sometimes as a CARO 2020 clause vii or clause xi annexure comment, sometimes as a Matter of Emphasis on the main auditor's report. The finance team reads the observation and pushes back because the bank reconciliation was prepared every month, the file is complete, and the transactions all tie. The confusion is that the auditor is not questioning whether the reconciliation exists — the auditor is questioning whether the reconciliation, as designed and as operated in the period under audit, meets the SA 315 and Guidance Note on Internal Financial Controls expectations. The seven days before sign-off are the window to close the finding, and the wrong fix (increasing frequency when the actual failure is on aging or supervisor review) does not remove the observation from the audit report.
An Indian statutory auditor evaluates bank reconciliation against five design attributes drawn from the ICAI Guidance Note on Internal Financial Controls Over Financial Reporting and the SA 315 illustrative implementation guidance. Attribute one — frequency at least monthly and aligned to the transaction volume of the account. Attribute two — aging discipline on reconciling items with a 30-day routine window, 60-day investigation window, and 90-day escalation floor. Attribute three — every reconciling item carries a named root cause, an owner, and a target closure date rather than 'under investigation' as an indefinite tag. Attribute four — bounced cheques and returned NEFT or IMPS credits are traced from the bank statement dishonour code and reversed in the book within the same period. Attribute five — treasury cash sweeps between operating and investment accounts carry a documented approval trail and are visible on the reconciliation as an intended movement rather than an unexplained item. A failure on any single attribute is a Significant Deficiency. A failure on two or more that aggregates to a material misstatement risk becomes a Material Weakness and lands as an Adverse ICFR opinion under Section 143(3)(i).
A monthly bank reconciliation file per material operating and investment account, prepared by an accounts officer independent of bank-book posting, reviewed and signed off by a supervisor within five working days of month-end. An aging report on reconciling items with a 30-day, 60-day, and 90-day threshold and a named owner per item. A bounced-cheque log fed from the bank statement dishonour codes with a same-period reversal requirement in the book. A treasury sweep approval trail cross-referenced to the reconciliation working paper. A summary schedule attached to the audit-file bank confirmation under SA 505 that lists the closing bank balance per bank statement, the closing balance per book, the reconciling items with age and owner, and the supervisor's sign-off.
A statutory audit closes with a clean Section 143(3)(i) ICFR opinion on the bank reconciliation control, a CARO 2020 annexure with no clause vii, clause ix, or clause xi observation traceable to bank reconciliation failure, and no Matter of Emphasis on the main auditor's report. In the following year's audit, the previous year's aging tail is measurably shorter, the average close time on reconciling items is inside 30 days, and the auditor's continuing risk assessment under SA 315 downgrades the bank reconciliation control from a focus area to a routine test. The finance team enters the next audit cycle with a documented control that survives the auditor's design and operating-effectiveness test without a management letter observation.
The statutory audit is one week from sign-off. The engagement partner circulates a draft management letter and there is a paragraph on bank reconciliation — sometimes framed as a Significant Deficiency under the Section 143(3)(i) internal-financial-controls opinion, sometimes as a CARO 2020 annexure comment, sometimes as a Matter of Emphasis on the main auditor’s report. The finance team reads it and pushes back — the reconciliation was prepared every month, the file is complete, the closing balances tie. What exactly is the auditor flagging, and how do you close it before the report is signed?
The quick answer
The auditor is almost never questioning whether the bank reconciliation exists. The auditor is testing whether the reconciliation, as designed and as operated in the period under audit, meets five attributes drawn from the ICAI Standards on Auditing and the Guidance Note on Internal Financial Controls Over Financial Reporting — frequency, aging discipline on reconciling items, root-cause and owner attribution, bounced-cheque reversal, and treasury sweep documentation. A failure on any one of these is a Significant Deficiency. Two or more that aggregate to a material misstatement risk becomes a Material Weakness and lands as an Adverse Section 143(3)(i) ICFR opinion.
The right fix is the one that closes the specific attribute the auditor has flagged, not a generic “we will reconcile more often.” Increasing frequency does not close an aging-tail observation. Adding a preparer signature does not close an unreversed-bounced-cheque observation. Work the five buckets in order, identify which one the auditor is naming, and produce the evidence that closes it inside the audit window.
Where the CARO 2020 flag actually sits
A search for “CARO 2020 bank reconciliation” assumes the observation lives under a specific CARO clause. In practice, the flag surfaces across three linked routes in the auditor’s report and the finance team has to know which one they are dealing with before drafting the response.
Route one — Section 143(3)(i), the ICFR opinion. This is where a systemic bank reconciliation weakness typically lands, classified as a Significant Deficiency, a Material Weakness, or (worst case) an Adverse opinion on internal financial controls. The Section 143(3)(i) opinion is separate from the main auditor’s opinion on the financial statements and is now standard for every company covered under the ICFR reporting framework.
Route two — CARO 2020 annexure clauses that require the auditor to trace balances through the bank ledger. Most commonly clause vii on statutory-dues remittance timing (a PF, TDS, GST, or ESI payment that did not clear the bank until after the due date will surface through the bank reconciliation and land on the CARO annexure), clause ix on default in repayment of borrowings (EMI or interest payments that failed to debit on the schedule date), and clause xi on fraud reporting (an unexplained bank credit or debit meeting the reporting threshold). The CARO 2020 reporting companion walks the full twenty-one-clause structure.
Route three — Section 143(3)(g), the audit-trail exception. Effective 1 April 2023, Rule 3(1) of the Companies (Accounts) Rules 2014 requires an audit trail on every book edit. A bank-book adjustment made after the reconciliation date without an audit-trail record is a direct Section 143(3)(g) exception, separate from the ICFR opinion.
The CARO 2020 bank reconciliation audit walkthrough is the technical treatment of exactly which clause and section carries which failure mode.
Bucket 1 — reconciliation frequency below the appropriate minimum
SA 315 requires the auditor to evaluate whether the control frequency matches the transaction volume of the account. The default expectation is monthly. For a high-transaction current account (say 3,200 transactions in a typical month across UPI collections, NEFT payments, cheque issues, and IMPS settlements), monthly is the floor and weekly or continuous reconciliation is the norm at scale. Reconciling a high-volume current account only quarterly is a design failure the auditor will name explicitly.
Where to look. The bank reconciliation working paper file for the year under audit. Count the number of reconciliations per account. Any account with fewer than twelve reconciliations in the year (one per month) sits in bucket 1.
Bucket 2 — reconciling items aged beyond the working benchmark
There is no Indian GAAP or Standards on Auditing bright-line rule on aging, but the working benchmark most Big 4 and mid-tier audit firms apply is 30 days routine, 30 to 60 days requires an explanation on the reconciliation, above 60 days requires evidence of active investigation, and above 90 days is a Significant Deficiency by default.
Illustrative arithmetic. An unmatched credit of Rs 47,236 aged 45 days with only “under investigation” as the comment will attract a query even though the amount is immaterial. A Rs 2.3 lakh unmatched debit aged 92 days with no owner and no closure date is a near-certain Significant Deficiency, and if the auditor cannot independently corroborate the entry to the bank side, a Matter of Emphasis on the main auditor’s report. The unreconciled bank credit decision tree is the operator’s routing framework for closing the aging tail before it hits the auditor’s file.
Where to look. The aging column on the current reconciliation. Any item above 60 days without a documented investigation status sits in bucket 2.
Bucket 3 — reconciling items without a named root cause and owner
Every reconciling item on a well-designed bank reconciliation carries three attributes: the root cause identified (bank-side error, book-side error, timing difference, unrecorded income, unrecorded expense, bounced cheque, treasury sweep, or held for investigation with a specific hypothesis), the owner (a named person, not a team), and the target closure date. “Under investigation” as the standing comment on twelve items totalling Rs 1.85 lakh, three months into the aging queue, is what the ICAI Guidance Note characterises as a control-operation failure rather than a control-design failure — the control exists but has stopped operating at the required precision.
Where to look. The comment column on the reconciliation. Any item marked “under investigation” or blank sits in bucket 3.
Bucket 4 — bounced cheques not reversed in the book
This is the one to escalate first. An unreversed bounced cheque directly overstates the closing bank balance and the corresponding revenue or receivable — it is a misstatement in the financial statements, not just a control deficiency. When a customer cheque of Rs 82,000 bounces (marked R-25 “cheque dishonoured” or similar under the CTS return-reason codes) and the book-side entry is not reversed within the same period, the trial balance carries Rs 82,000 of receipt that never actually happened. The receivable that should have re-opened stays closed on the AR ageing.
The HDFC bank reconciliation narration-pattern walkthrough documents the specific dishonour codes in the MT940 statement feed that identify bounced cheques and returned NEFT/IMPS credits, so the reversal can be automated on the receiving side of the bank feed rather than left to a manual sweep at month-end.
Where to look. The bank statement return-reason codes and the AR receipt journal for the same date. Any dishonour code without a matching reversing entry sits in bucket 4 and is an immediate audit-file addition.
Bucket 5 — treasury sweep documentation gaps
End-of-day cash sweeps between operating current accounts and overnight investment or fixed-deposit accounts must have a documented treasury approval trail. Where a Rs 15 crore end-of-day sweep from a mother account to a subsidiary FD is happening automatically without a corresponding treasury protocol on file — or where the sweep is showing on the reconciliation as an unmatched item because the counter-account posting was not made — the auditor’s SA 240 fraud-consideration procedures will flag it. Bucket 5 is where the reconciliation intersects with the auditor’s assessment of the entity’s cash management controls, and the finding is often less about the rupee value and more about the absence of documentary evidence.
Where to look. The treasury policy file, the sweep instruction letter to the bank, and the reconciliation working paper. Any sweep without a matching approval reference and a matching book-side counter-entry sits in bucket 5.
Which one to close first
Bucket 4 — unreversed bounced cheques — is the only one of the five that directly misstates the closing balance sheet. It moves out of “control deficiency” territory and into “misstatement” territory. Every other bucket is a process-quality issue that surfaces in the ICFR opinion. Bucket 4 surfaces in the main audit opinion.
Close bucket 4 first, in the audit-file working paper. Post the reversing entries. Trace every dishonour code on the bank statement for the audit period to a matching book-side reversal. Then work backwards through buckets 3, 2, 1, and 5 in the days remaining before sign-off. The bank reconciliation runbook for Days 1 to 5 of the monthly close is the operational cadence that prevents the bucket from re-opening in the following period, and the invoice-to-bank reconciliation failure modes treatment catalogues the upstream failure modes that produce each bucket in the first place.
When the monthly manual reconciliation outgrows itself
For a company with fewer than 2,500 bank transactions per month across its material operating accounts, a well-designed Excel-based monthly reconciliation prepared on Days 1 to 3 and reviewed by the controller on Day 4 will hold — the SA 315 design attributes are met, the operating-effectiveness test survives, and the audit closes clean. Above 2,500 transactions per month, or where the previous year’s audit report already carried an aging-tail observation and the current year is expected to show visible improvement, the manual workbook starts producing exactly the aged unmatched items that keep the audit finding open period after period.
At that scale, moving the reconciliation off the analyst’s spreadsheet and onto continuously refreshed detection — where Terra Insight’s reconciliation software treats the exception queue and the aging tail as first-class continuously-refreshed outputs — is what removes the observation from the audit report at the design layer. The statutory audit preparation kit is the interim template for the working paper structure the auditor expects to see either way.
Go deeper
- CARO 2020 bank reconciliation audit — the full technical treatment
- Bank reconciliation runbook — Days 1 to 5 of the monthly close
- Invoice-to-bank reconciliation failure modes — the design-layer treatment
- Unreconciled bank credit decision tree
- HDFC bank reconciliation — narration patterns and MT940 mechanics
- Statutory audit preparation kit
Content authored by practitioners with experience at Amazon India, Intuit QuickBooks, and the Tata Group. Meet the team →
- ▸ Companies (Auditor's Report) Order 2020, Ministry of Corporate Affairs — Issued on 25 February 2020 under Section 143(11) of the Companies Act 2013 and applicable to the auditor's report on the financial statements of every company for the financial year commencing on or after 1 April 2021. CARO 2020 expands the auditor's commentary to twenty-one clauses covering fixed assets, inventory, loans and guarantees, statutory dues (clause vii), default in repayment of borrowings (clause ix), reporting of fraud (clause xi), and internal audit systems (clause xiv) — each of which requires the auditor to trace balances and movements through the bank ledger before signing the report. A weakness the auditor identifies in bank reconciliation upstream typically surfaces on the CARO annexure through clause vii on statutory-dues remittance timing, clause ix on borrowing repayment tracking, or clause xi where an unexplained bank-side entry meets the reporting threshold for fraud.
- ▸ Section 143(3)(i), Companies Act 2013 — The auditor's report shall also state whether the company has adequate internal financial controls with reference to financial statements in place and the operating effectiveness of such controls. This is the anchor for the ICFR opinion the statutory auditor issues alongside the main audit opinion. Bank reconciliation is a keystone financial reporting control — its failure at the design or operating-effectiveness layer will surface on the ICFR opinion as a Significant Deficiency, a Material Weakness, or (at the worst end) an Adverse ICFR opinion under the Guidance Note on Audit of Internal Financial Controls Over Financial Reporting issued by the Institute of Chartered Accountants of India.
- ▸ SA 315 (Revised), Standards on Auditing — Institute of Chartered Accountants of India — Identifying and Assessing the Risks of Material Misstatement Through Understanding the Entity and Its Environment. The auditor is required to obtain an understanding of the entity's internal control relevant to the audit, including whether reconciliations are performed regularly, at the appropriate level of precision, by personnel with the requisite competence, and with evidence retained for the auditor's inspection. Bank reconciliation is a routinely cited example in the ICAI illustrative implementation guidance — a monthly frequency, aging on reconciling items, and documented resolution are the SA 315 default expectations.
- ▸ SA 330, Standards on Auditing — Institute of Chartered Accountants of India — The Auditor's Responses to Assessed Risks. Where the auditor has identified a control deficiency in bank reconciliation at the SA 315 stage, SA 330 requires a substantive-procedures response that either tests the reconciling items directly to source documentation, extends the confirmation procedures under SA 505 for cash and bank balances, or (in severe cases) modifies the audit opinion. The audit-file working paper must document the reconciliation deficiency, the extended procedures performed in response, and the residual audit-risk conclusion.
- ▸ ICAI Guidance Note on Audit of Internal Financial Controls Over Financial Reporting — Issued to support the Section 143(3)(i) opinion. Classifies bank reconciliation as a period-end financial reporting control and lists its expected design attributes — performed at least monthly, prepared by an independent person, reviewed by a supervisor, reconciling items aged and pursued to closure, evidence retained in the audit file. A design deficiency (control does not exist or does not meet the standard) is scored separately from an operating-effectiveness deficiency (control exists but has failed in the period). Two or more Significant Deficiencies in a related area typically aggregate to a Material Weakness for ICFR reporting.
- ▸ Rule 3(1), Companies (Accounts) Rules 2014 (as amended) — Every company that uses accounting software for maintaining its books of account shall use only such accounting software which has a feature of recording audit trail of each and every transaction, creating an edit log of each change made in books of account along with the date when such changes were made and ensuring that the audit trail cannot be disabled. Effective 1 April 2023. Section 143(3)(g) of the Companies Act 2013 requires the auditor to report on whether the company has complied with this audit-trail obligation — a bank-book edit made after the reconciliation date without an audit-trail record is a direct trigger for the audit-trail exception in the auditor's report.