Run a Treasury User Access Audit Conversation

Access audits are most useful when they describe real work rather than a list of names. Ask who can view information, initiate payments, approve activity, change users, and review exceptions. Then ask when those roles were last checked. A treasury specialist should not assume an employee’s title proves the right level of access.

Harbor Foods discovers that a former controller still appears in its access list. The specialist asks who owns offboarding and who verifies the change after a departure. The operations manager admits there is no recurring check. That finding identifies an internal process issue and does not establish that a loss occurred.

Have the customer assign a business owner for each role and identify a review cadence. Explain that bank access changes follow verified authority and current procedures. Avoid promises that a setting alone solves an internal governance problem.

The next step is a clear roster with role descriptions, approvers, and backup coverage. This gives the approved review team usable information and gives the customer a repeatable audit habit. Good access conversations protect continuity as well as control, because teams know who can act when a primary user is unavailable.

Ask Harbor Foods to choose one recent departure and trace every action related to access from notice to confirmation. If an approval or confirmation is missing, document the gap and assign a process owner. The customer can correct its internal routine through its own governance process, while bank changes remain subject to verified authority. This example turns a broad audit request into an observable, repeatable check.