Run a Treasury User Access Audit Conversation

A treasury user access audit conversation sounds routine until you actually sit down to have it. You ask a business who can view balances, who can initiate payments, who can approve them, who can add or remove users, and who reviews exceptions. Then you ask when anyone last checked that list against what people actually do all day. That second question is where the real conversation starts, because most businesses have never compared their access list to their current staff.

Why This Conversation Goes Wrong

People treat access audits like a compliance form. They read off a list of names and titles and expect that to satisfy you. But a title tells you what someone is supposed to do, not what the bank system actually allows them to do. A former controller can sit in the approver list for months after leaving, because nobody owns the job of removing access when someone departs. When you point that out, the conversation can turn defensive fast. The business hears you have a security problem and responds by minimizing it or asking you to just fix the setting and move on. Neither reaction gets you what you need. Your job is not to assign blame for a gap in their internal process. Your job is to find the gap, name it clearly, and get the business to own a repeatable check going forward.

How to Prepare Before the Call

Walk in with the five functions clear in your head. You need to know who can view information, initiate payments, approve activity, add or change users, and review exceptions. Know which of those functions the customer's current setup actually separates, and which ones one person can do alone. Pull whatever record you have of recent access changes on the account, so you are not relying only on what the customer tells you. Decide in advance what a good outcome looks like. It is not a corrected settings screen. It is a roster with a named business owner for each role, a review cadence written down somewhere, and a backup person identified for every function that only has one owner today. If the account has had turnover in finance roles recently, expect to find gaps, and plan to ask about the most recent departure specifically rather than the roster in general.

What to Say

Start with the list, not with a challenge. You might open with, "Walk me through who can view account activity, who can initiate a payment, who approves it, and who can add or remove users." Let them answer in their own words first. When Harbor Foods answers, the operations manager reads off four names, and one of them is a controller who left the company two months ago.

You ask, "Who owns removing access when someone leaves the company, and who checks that it actually happened?"

The operations manager pauses and says, "Honestly, nobody owns that. IT usually turns off email and building access. I guess we assumed the bank access got handled at the same time."

That answer is the finding. You do not need to escalate your tone or suggest anything was stolen. You say, "That's a process gap, and it's a common one. Nothing here tells me money moved that shouldn't have. It tells me the account access list and your actual staff list can drift apart, and right now nothing catches that drift." Then you move to the fix. You continue, "Let's pick one person, the controller who left, and trace every step from the day you knew they were leaving to today. Who was notified, who requested the access change, and who confirmed it went through."

Walking through that one case with them, in the room, does more than any general policy discussion. It shows them exactly where their process has a hole, whether that is a missing notification step, no confirmation step, or no single owner for the request. You close the conversation by asking them to assign a name to each of the five functions and set a date for the next review, not by promising to change anything on the bank side yourself.

Mistakes to Avoid

Do not assume a job title tells you the true access level. Titles change slower than responsibilities, and responsibilities change slower than actual system permissions. Do not let one bad finding turn into an accusation. The former controller sitting in the approver list is a process failure, not proof that anyone did anything wrong, and treating it like an accusation just makes people defensive and less forthcoming. Do not offer to solve the customer's internal governance problem for them. You can explain what the bank requires for a change and how verification works, but who owns offboarding inside their company is their decision to make and enforce. Do not accept a vague answer like "we review this periodically" as a real cadence. Ask for a specific interval and a specific owner, and if they cannot name one, that is itself the finding. Do not skip the single case trace. A roster review tells you what should be true. Tracing one actual departure tells you what is true.

How to Practice and Score This Conversation

This conversation is hard to get right the first time you have it live, because the defensive reaction from the customer catches most specialists off guard. A manager can run a short role play where they play an operations contact who minimizes the finding or gets irritated at the suggestion that their process has a gap. Score the specialist on whether they asked about all five access functions specifically, rather than accepting a general answer. Score them on whether they asked for an owner and a cadence, rather than settling for "we handle it." Score them on whether they picked one real case and traced it step by step rather than staying at the policy level. And score them on tone, did they name the gap plainly without turning it into blame, and did they avoid promising to fix the customer's internal process themselves.

You can rehearse this scenario and others like it through DealSpeak's Banking practice conversationswhich score you on exactly these behaviors before you run the real thing with a customer. If the audit turns up gaps in how new employees learn their access responsibilities in the first place, follow it with a plan to Build a Treasury User Training Plansince a training gap and an access gap usually travel together. And when the access review touches who can initiate payments near a deadline, it is worth the time to Plan Around Treasury Wire Cutoffs so approval authority and timing constraints stay lined up.

A good access audit does not end with a corrected spreadsheet. It ends with the customer able to answer, on their own, who can act on their account and who checks that the list stays accurate. Practice the harder middle of the conversation, the moment when the customer gets defensive, because that is the part that decides whether the audit actually changes anything.