Treasury policies and controls are the rules and enforcement mechanisms that govern how a company holds, moves, and invests cash. Policies set parameters, such as liquidity minimums, permitted investments, payment approval thresholds, and who can open accounts or sign for them. Controls enforce those parameters through dual approval in bank portals, segregation of duties, signer mandates, and daily reconciliations. Together, policies and controls enable a company to say exactly how much cash it has and who can move it.

Below, we cover the components of a treasury governance framework, how approval workflows and segregation of duties stop bad payments, and how to keep everything current as your company grows.

Key takeaways

• Treasury policies set the rules for company cash. Controls, such as dual approval and signer mandates, enforce those rules. Policies define liquidity minimums, permitted investments, payment approval thresholds, and who can open accounts. Controls make those policies stick, giving the company a clear understanding of its cash position and who can move that cash.

• Splitting duties such as vendor setup, payment initiation, payment release, and reconciliation across different people is an effective way to combat fraudulent payments because a successful criminal would have to compromise multiple people or systems instead of just one. An approval matrix that ties payment size to sign-offs, enforced through dual control, adds protection.

• Annual treasury reviews catch when procedure slowly diverges from policy, but an immediate policy review is in order when a company is dealing with new markets, entities, banks, or acquisitions. Quarterly user access reviews remove signers and portal users who’ve left or changed roles. Testing a sample of payments each quarter confirms that approvals happened as required and gives auditors, lenders, and investors the evidence that matters to them.

Why do treasury policies and controls matter?

Treasury policies and controls matter because they create the consistency a business needs to see its cash position clearly. A 30-person startup, for example, can run treasury from one bank account and the founder’s judgment; however, when it adds finance staff in three regions, each with different habits, inconsistencies can wreak havoc on the business. Staff in one region might require two approvals for wire transfers over $25,000, while those in another office might have no threshold, and those in a third might pay vendors from a local account that never reaches the consolidated cash report. Without treasury policies and controls, a business will reach a point where no one knows how much cash the company has or who can move it.

What’s included in a treasury governance framework?

A treasury governance framework answers four questions: who sets policy, who carries it out, what limits apply, and how does one check that those limits were enforced.

Many companies build their framework from the following six components:

• Delegation of authority: The board or audit committee approves the treasury policy and caps borrowing and investing. A delegation of authority document assigns specific powers and dollar limits to the chief financial officer (CFO), treasurer, and named staff.

• Approval workflows: Each payment type follows a defined path from request to release, with thresholds that indicate how many approvers must sign off and what seniority level they must have. These approval paths live in your bank portal and payables system rather than in email threads.

• Segregation of duties: Incompatible tasks go to different people. Whoever adds a vendor can’t pay that vendor, and whoever releases payments doesn’t reconcile the bank statement.

• Cash handling procedures: These procedures outline daily treasury work, including when the cash position is pulled, how incoming funds are applied, which payment cutoffs apply, and how physical checks are stored and logged.

• Risk controls: Risk controls limit capital exposure. Examples of risk controls include enforcing counterparty limits on cash held at any single bank, using Positive Pay as a tool to combat fraud on checks and direct debits, and maintaining liquidity minimums.

• Documentation and monitoring: Written policies, procedure manuals, and a review calendar make the rules auditable. Exception reports tell management when someone breaks a rule.

How do approval workflows and segregation of duties protect your cash?

Approval workflows and segregation of duties are among the strongest defenses against bad payments. They force a criminal to compromise multiple people or multiple systems instead of one. For example, an approval matrix ties payment size and type to required sign-offs: one approver for amounts under $10,000, two for amounts from $10,000 to $250,000, and the CFO or treasurer plus one additional approver for amounts above $250,000. The exact thresholds matter less than the act of enforcing them in your bank portal through dual control, where a payment entered by one user remains pending until a second user releases it. Also, urgent payments will need a defined exception path, such as phone confirmation from a named executive and review within 24 hours.

Segregation of duties covers everything related to the payment.

The classic segregation setup separates the following four responsibilities:

• Vendor setup: One person creates or edits vendor records, including bank details. Changes to existing vendor records are verified by calling the vendor at a number already on file, never one included in the change request.

• Payment initiation: A second person builds payment batches from approved invoices; this person can’t edit vendor data.

• Payment release: A third person—who has no ability to alter payments—reviews and releases payment batches in the bank portal.

• Reconciliation: A fourth person—who has no other role in the payment process—matches bank activity to the ledger on a daily or weekly basis, catching anything that shouldn’t be there.

What do common treasury policies cover?

Companies often end up with a core set of treasury policies. Each one targets a different way cash can go wrong.

Liquidity management

This policy sets the minimum amount of cash the company must hold, expressed in dollars or weeks of operating expenses. It defines how often treasury forecasts cash (13-week rolling forecasts are common), who can draw on a credit line, and what happens when the forecast dips below the designated minimum, such as a CFO alert within one business day and a freeze on discretionary spending.

Investment of excess cash

This policy lists permitted instruments, such as Treasury bills, government money market funds, and highly rated commercial paper. It also sets minimum credit ratings, maximum maturities, and concentration limits (such as no more than 5% to 10% with any single nongovernment issuer, so treasury doesn’t reach for yield with money the company might need next quarter).

Payments

This policy matches payment methods to purposes and sets the approval matrix, payment run schedule, and protocol for changing vendor bank details. It also names who can request a same-day wire transfer and what documentation that request needs.

Bank account management

This policy establishes protocols for managing bank accounts. Only named officers should be able to open or close accounts, and a central inventory should list every account. Signer lists should be checked against HR records at least annually, as well as any time a signer leaves. Dormant accounts should be closed before they become easy targets for bad actors.

Financial oversight

This policy defines what treasury reports, to whom it reports, and how often it reports. A typical policy would require a daily cash position report for the treasurer; a monthly CFO report on liquidity, investments, and exceptions; and a quarterly audit committee summary. A security breach that’s reported and explained shows governance working, while one discovered in an audit is a failure.

How do treasury controls support compliance and risk mitigation?

Regulators and auditors evaluate documented and tested controls to prove that a company handles cash properly. The benefits of treasury controls show up in four places.

Public company compliance

Section 404 of the Sarbanes-Oxley Act requires companies that file reports with the US Securities and Exchange Commission (SEC), including foreign issuers of securities, to perform annual assessments of internal controls over financial reporting. Accelerated and large accelerated filers (i.e., companies that are required to file on an accelerated schedule) also need auditor attestation. Many companies model their treasury controls on the Internal Control-Integrated Framework created by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). This framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

Private company scrutiny

Lenders often write minimum liquidity covenants into credit agreements, and treasury controls ensure that the business maintains sufficient cash reserves to meet these financial obligations. Investors request the treasury policy during due diligence, looking to see if strong treasury policies are in place. And auditors’ management letters call out gaps such as missing segregation of duties; these gaps won’t be present if the business has sufficient treasury policies and controls in place.

Fraud exposure

Dual control prevents a compromised account from sending a wire transfer on its own. Callback verification defeats a classic business email scam: a spoofed request to send payment to a new bank account. Positive Pay catches altered or counterfeit checks, and direct debit blocks put a stop to unauthorized account withdrawals.

Better decisions

When cash is reconciled daily and reported consistently across entities, the CFO can pay down a credit line or delay a hire based on numbers they can trust. No one will end up counting cash that’s sitting in an unreconciled subsidiary account—because there will be no unreconciled accounts.

How do you build and maintain a governance framework that keeps pace with growth?

Here are the steps for building and maintaining a governance framework that works for your business.

• Take inventory of what exists: List each bank account, each person with portal access or signing authority, and each system that can initiate a payment. This is where you’ll discover things that might have otherwise been overlooked, such as accounts a regional team opened or users who left months ago.

• Write policies, then procedures: Policies set rules and limits, while procedures explain exactly how staff should enforce those rules and limits. Keeping policies and procedures separate allows procedures to change without the board approval that’s typically required for policy changes.

• Configure controls in your systems: Set approval thresholds, dual control, and user permissions in your bank portal and enterprise resource planning (ERP) system so the policies are enforced by default.

• Extend controls to your payments account: In the Stripe Dashboard, for example, predefined roles such as Administrator, Developer, Analyst, and View let you limit who can manage application programming interface (API) keys, view financial reports, and edit payout bank details. Developer and Analyst roles can’t change bank details. Reserve the Administrator role, which can both manage API keys and edit bank details, for as few people as possible. The payout reconciliation report ties each automatic payout to its underlying transactions.

• Test payments, and keep evidence: Pull a sample of payments each quarter and confirm that each had the required approvals, since auditors will ask.

• Review on a set schedule and when key events occur: Revisit the full policy annually and run user access reviews quarterly. Also do a review whenever the company enters a new market, adds an entity, opens accounts with a new bank, completes an acquisition, or grows headcount enough that finance responsibilities split.

How Stripe Treasury can help

Stripe Treasury brings payments and finances together on Stripe, so businesses can receive, store, send, and spend funds in one place. It’s built for startups and growing businesses that want to move money faster and spend less time managing financial operations. Platforms, marketplaces, and fintechs can also offer financial services to their users with Treasury for platforms.

Treasury can help you:

• Simplify your financial operations: Manage money, payments, card spend, payouts, and more from the Stripe Dashboard.

• Move money faster: Access settled Stripe earnings right away and send instant transfers to other businesses on Stripe without cost.

• Get more from your money: Earn cashback on card spend and Stripe fee credits on qualifying balances.

• Operate globally with ease: Hold balances in multiple currencies, convert only when needed, and send payouts to recipients in 160+ countries.

• Automate financial operations: Use agents to analyze cash flow and automate tasks such as paying invoices, moving money, and converting currencies within limits you set.

Learn more about how Stripe Treasury can help you manage your finances and payments in one place, or get started today.

FAQs about treasury policies and controls