Academy/Banking, Cash & Internal Controls
Online banking access
Who can log into the association's bank portal, what they can do once they're in, and why that list needs to shrink the moment someone leaves the board.
Online banking access means the logins into the association's bank portal, and it is separate from who signs paper checks. Give each login only the permission level it needs (view, initiate, or approve), turn on multifactor authentication for anyone who can move money, and remove a login the same day that person leaves the board.
Access and signing authority are not the same list
Most banks let an association set up several online banking logins, and each one can carry a different permission level: view only, able to initiate a payment, or able to approve one before it releases. A person can have a login without being an authorized check signer, and a signer does not automatically need the power to move money online alone.
The same idea that keeps one person from controlling a paper check start to finish applies to the portal.
"Segregation of Duties is a system designed to prevent theft and fraud."
Source: Segregation of Duties, Personal MBA (Josh Kaufman)
Applied to a bank portal, that means the person who initiates a transfer online should not be the same person who can approve and release it. See Dual approvals and Separating duties for how to set the thresholds.
Turn on multifactor authentication for anyone who can move money
Federal bank regulators have pushed banks away from a password as the only thing standing between a login and a transfer.
"multifactor authentication or controls of equivalent strength can effectively mitigate customer and user unauthorized access."
Source: Bulletin 2021-36, Information Security: FFIEC Statement on Authentication and Access to Financial Institution Services and Systems, OCC / FFIEC
That guidance is aimed at the bank, telling it what to offer, not at the association directly. In practice, ask your bank what authentication options its business online banking supports (a code texted to a phone, an authenticator app, a physical token) and turn on the strongest one for every login that can initiate or approve a payment, not only the treasurer's.
Declining a stronger login option the bank offers, in favor of something cheaper or more convenient, can weigh against the association later if a fraud loss is disputed with the bank. Ask your bank what its agreement says about this.
Shut off access the day someone leaves the board
A login left active after someone stops serving is not a signing-authority problem, it is an access problem, and it is one of the easiest controls to let slide. When an officer's term ends, or they resign, or they are removed, their online banking login should be disabled that same day, not queued up for the next board meeting.
No source reviewed for this Course sets a specific legal deadline for removing a departed officer's bank access, and the process is often set by the bank's own account rules rather than by state law. Check with your bank and your governing documents. See Changing signers after elections for how to plan the handoff, and Emergency access to association funds for what to do if the only active login becomes unreachable without warning.
Check yourself
Answer before you read the explanation, recalling it is what makes it stick.
A treasurer resigns in March. In April, the board discovers her online banking login can still view balances and submit transfers. What risk does this create?
The bank offers a free upgrade from password-only login to a one-time code sent to a phone, for anyone who can initiate transfers online. The treasurer says the current password works fine. What should the board do?
The board sets up online banking so one officer can initiate a transfer and a different officer must separately approve it before it releases. What control does this reflect?
Sources
- Bulletin 2021-36, Information Security: FFIEC Statement on Authentication and Access to Financial Institution Services and Systems, OCC / FFIEC
- Segregation of Duties, Personal MBA (Josh Kaufman)
- UCC Article 4A: Funds Transfers, Protections and Liability, LegalClarity
Banking, Cash & Internal Controls
Read Dual approvals next to see how initiating and approving a payment split across two people.
Which authentication methods a bank offers, and how a declined security upgrade affects loss allocation if fraud occurs, are set by the association's own agreement with its bank. Whether any deadline applies to removing a departed officer's access is set by your bank's own account rules and, in some states, statute.