Cash Control

Org Unit Responsibilities

Each organizational unit that handles cash must minimize the risk of theft to the cash while maximizing the safety of the individuals handling the cash. It is the responsibility of the organizational unit to:

• Allow cash operations only in those organizational units or affiliates who have the ability to physically secure the cash, implement safeguarding practices, and enforce control procedures, and then limit cash to the minimum amount necessary.
• Identify the purpose for which cash is maintained or received.
• Identify cash locations (i.e., know where cash is at all times).
• Assign a single individual, referred to as the custodian, to be responsible for cash.
• Ensure all cash receipt functions are properly authorized.
• Document the steps and associated internal controls that occur from the beginning of the cash handling process to its conclusion, for each type of cash location.
• Train all individuals assigned responsibility for cash.

Cash Handling

• Minimize cash at each location to the amount necessary to accomplish operations.
• Implement appropriate security over the cash (e.g., locks, alarms, cameras, armored car) at all times including when cash is being transported.
• Ensure cash is not disbursed unless specifically authorized per university policy and procedures (limited to petty cash funds, change funds, cash advances, refunds.)
• Assign roles and duties on an individual basis to persons involved in the cash handling process (custodians).

Receipting

• Record receipts in the Finance System.
• Record authorized disbursements in the Finance System.

Reconciliation

• Provide for the reconciliation of cash activity to the Finance System through the financial report review process.
• Do this process no less often than monthly.
• Ensure that any discrepancies noted in the reconciliation are investigated and corrected.

Separation of Duties

• Maintain separation of duties throughout the cash handling process. Staff authorized to physically handle cash should not: reconcile monthly financial reports to verify that all cash was properly deposited; have access to accounts receivable records; be involved in the accounts receivable billing process; or, be involved in the disbursement function (authorizing expenditures).
• Where separation of duties is not possible due to the small size and limited staffing of an organizational unit, implement compensating controls appropriate for the nature and size of the operations.

Ensure that the above steps are consistent with the requirements set forth in this procedural statement related to collection, deposits, custody, refunds, and voided transactions.
Ensure that key personnel are considered to have security-sensitive positions and are subject to background checks as required by the appropriate Administrative Policy Statement. Furthermore, ensure that such individuals take leave, as granted by university policy, at a minimum of at least once per year.

• Continuously assess internal controls over cash and take appropriate action to remediate any concerns noted.

Individual Accountability and Responsibility

Each individual who receives (or has custody of) cash is responsible and accountable for the cash under her or his control, and individual accountability must be maintained and documented for all cash handling procedures. Specifically:

• Designate each cash location (e.g., cash register drawer, safe, locked box, bag, drawer, or cabinet) as being the responsibility of a single person, and that person should be the only one able to access the designated cash.
• Restrict authority to get into cash registers and locked boxes, bags, drawers, or cabinets.
• When using a safe to secure cash, limit the number of people who know the combination to the safe.
• Ensure the combination to the safe is changed periodically and whenever there is turnover in key staff.
• Limit the number of keys to locked boxes, drawers, cabinets, bank bags, or other containers used to secure cash.

If access to cash cannot be restricted to a single individual, then the organizational unit should deploy appropriate mitigating controls, such as:

• Logging transactions by individuals
• Using a camera to record access
• Reconciling the cash between individuals having access to the cash.

Cash typically is received by the University in one of three ways: from in-person cash sales, through the mail, or via electronic means. No matter how cash is received, the requirements below must be followed:

• Accept only U.S. currency when collecting cash. If the organizational unit has a revenue contract with a foreign entity, then it may accept the following risk for accepting foreign currency or foreign checks (regardless of currency). The organizational unit will be at risk of loss for the foreign item until the item is fully collected, and any such items received will be handled as collection items per the University's bank's foreign item collection policy then in place. 
• Accept only payments for official university business. If, for example, the organizational unit is involved in a non-university activity that generates funds (such as soliciting contributions for a retirement function), instruct people not to make the checks payable to the University of Colorado because the University cannot endorse these over to an individual or to an organization, nor can these be deposited into a university SpeedType for subsequent withdrawal.
• Maintain separation of duties whenever cash is collected. A single person must not have complete control over collecting cash, issuing cash receipts, and depositing cash. Any individual involved in the cash handling processes should not perform tasks such as collecting accounts receivable and maintaining the accounts receivable records or performing the financial report review process.
• Use a cash receipt log. Whether cash is received in person or by mail, there must be a system to record all cash as soon as it is received. Examples of such systems include writing out manual sales slips, preparing a log of receipts as the mail is opened, or using a cash register.
  A cash receipt log can be used in either of the following ways:
  • If two or more individuals are involved, one individual collects the cash and places it in a secure container, and the other individual records the amount and type of payment received along with the payee's name and date.
  • If only one individual is involved in collecting the cash, then a receipt from a receipt book containing pre-numbered, duplicate receipts must be completed by the individual. The receipt should note the payee name and date, amount, and type of payment. One copy of the receipt should be provided to the customer and another copy of the receipt should be maintained in the receipt book. If only one individual is involved in receipting cash due to the small size and limited staffing of an organizational unit, then compensating controls appropriate for the nature and size of the operations must be implemented.
• Document cash sales with duplicate, pre-numbered sales receipts or through the use of a cash register. Whether the process used is manual or automated, the documentation for cash received from sales must include the name of the organizational unit, the date the cash was received, and the form of payment (e.g., cash, check, credit card). If possible, the documentation should also include a description of the items sold, the quantity sold, the unit price, and the extended price.
  When cash collection involves a cash register, assign each cashier a unique identifier. This identifier must not be shared with or accessible to other individuals.
  Provide each cashier with a cash drawer to which only that cashier has access.
  Instruct cashiers to lock all cash in the drawer or in a secure receptacle whenever they leave the immediate cash collection area.
  Maintain the numerical sequence of sales receipts from one sale to the next.
  Provide each customer with a copy of the cash register receipt.
• Endorse checks received through the mail immediately upon receipt.
• Do not retain copies of checks once the monthly reconciliation process has shown that the checks have been appropriately deposited.
• Do not disburse cash from a cash location (e.g., cash box, cash register drawer) that is not an authorized change fund unless the disbursement is for the purpose of making change for a transaction in process or issuing a refund.

When working with checks, credit cards, and/or debit cards, keep in mind the following

• Occasionally, checks accepted for payment will be returned by the bank due to insufficient funds or a closed account. This forces an involuntary credit-granting situation on the part of the organizational unit. Therefore, as described in the Administrative Policy Statement Collection of Personal Data from Students and Customers, sufficient information should be obtained for each check accepted to facilitate the collection process should that become necessary. At a minimum this information would include name, address, phone number, and other identifying information, as appropriate, based upon the amount of the check.
• Personally identifiable information that may be received during the cash collection process must be secured and protected from unauthorized use. When payments are made by check or other negotiable instrument, state law does not permit the cashier to record, or to require the maker of the check to record, a credit card number or Social Security Number as identification or proof of creditworthiness.
• A cashier is not prohibited from requesting the purchaser of goods or services to display a credit card as indication of creditworthiness or identification. It is permissible to record the type of credit card and the issuer of the credit card on a check.
• Per State Law CRS 6-1-711 organizational units that accept credit, charge, or debit card payments and print receipts electronically must:
  • Print no more than the last four digits of a customer's card number or print the card expiration date on the customer's card receipt.
  • Transmit the credit/debit card information to the University's financial institution using the approved system. (See Treasury procedures.)
  • Obtain the authorization number and record it in the cash register or receipt log.
  • Not retain the full credit card information outside of the approved Treasury credit card procedures.

Before cash can be deposited, cash receipts must be balanced daily to the sales records.

• This process includes daily balancing of cash drawer receipts with sales records or cash register tapes, and balancing cash received through the mail with the mail log. A totaling of a cash register tape is referred to as a “Z” reading. An “X” reading is a subtotal of a cash register tape.
• Include in the daily balancing, among other items, the daily recording of the tape number and the cumulative total.
• Cash custodians should sign the form used to record this balancing.

When the balancing process is complete, cash can be prepared for deposit.

• Cash should be deposited on a daily basis to a university SpeedType using the process outlined for the respective campus. Deposits should be made more frequently if the cash (not including any approved change fund) is greater than $200.
• The deposit of university cash to outside bank accounts is prohibited unless authorized by the University Treasurer.
• Daily cash receipts must be deposited as they were collected and must not be used to pay expenses, create unauthorized petty cash or change funds, or as a source of funds for personal check cashing. Checks cannot be substituted for cash.
• Designate an individual to be responsible for preparing the daily deposit. When the individual preparing the deposit transfers the cash to a second individual, require the individual receiving the cash to count and acknowledge the amount of cash he or she is given. This acknowledgement denotes the approval of cash count totals and the transfer of custodianship.

Some organizational units take in small amounts of cash on a sporadic basis. In this case, it is permissible to hold the cash in a secure manner until the amount of the cash on hand is $200.00. Once this dollar ceiling is reached, the deposit must be made. However, deposits must be made by the end of each week even if the total is less than $200.00. No cash or checks are permitted to remain in the organizational unit over the weekend, unless the organizational unit has been designated as an authorized weekend cash location by the respective campus controller. Also, all cash/checks must be deposited during the month in which they were received, which means they must be deposited by the month-end cutoff regardless of the day of the week.

As stated above, individual accountability must be maintained and documented for all cash handling procedures, and each individual who receives (or has custody of) cash is responsible and accountable for the cash under her or his control. Thus, any change in the custody of cash must be documented (e.g., a receipt acknowledging the transfer that is signed and dated by both parties) because the responsibility for the cash switches from one individual to another.

Refunds made from a cash location (e.g., cash box, cash register drawer) must be approved by an authorized individual other than the employee making the refund and must be documented with a receipt. Receipts must include the customer's signature, date of the transaction, reason for the refund, and the signature of the individual who made the refund.

Consider requiring a counter-signature approval from a supervisor for refunds exceeding a set amount. If only one individual is involved in making refunds due to the small size and limited staffing of an organizational unit, then implement compensating controls appropriate for the nature and size of the operation. For large operations, refunds should be handled at a separate customer service location.

Updates 3/1/18: Revisions ar

Supersedes PSC Procedural Statement Cash Control dated 1/1/2012.

Questions about these procedures should be directed to the appropriate campus controller, who will consult with the Associate Vice President & University Controller, as appropriate.