Separate ownership, signing authority and online access
An owner, authorized signer and online-banking user are not necessarily the same thing. Banks can require formal documentation for changes to legal signers, while digital users may receive narrower permissions. Document which people can open or close accounts, sign checks, initiate payments and approve transactions.
Use this section as a control checkpoint. In a 22 person agency with a controller and three department leads, where monthly payroll near $105,000 and vendor payments near $70,000, decide who monitors separate ownership, signing authority and online access, who can approve an exception and what evidence is retained after the action is complete. If only one person understands the process, document a backup. If the rule depends on a threshold, set an alert before the threshold is reached. Those steps turn the banking choice into a repeatable process that strengthens access control, fraud prevention and clear accountability.
Use role-based permissions
A bookkeeper may need to view statements and prepare ACH files without the ability to release wires. A controller may approve payments but not change user administration. Role-based access reduces the risk created by shared credentials and gives the business a better audit trail. A bank may offer several technical roles, but the business still needs its own documented approval policy. Internal authority, bank signer status and online entitlements should be reviewed as separate layers.
Before opening or changing the account, ask the bank one concrete question about use role-based permissions and verify the answer in writing. For a 22 person agency with a controller and three department leads, the operating context is monthly payroll near $105,000 and vendor payments near $70,000. A written answer matters because the company may rely on it months later when a fee, limit or approval issue appears. Add the verified rule to the banking checklist and review it after major growth.
Dual approval for higher-risk payments
Wires, ACH batches and large transfers deserve stronger controls than routine debit-card purchases. Where the bank supports it, require one user to initiate and another to approve high-risk payments. This is especially useful when accounting staff and owners are in different locations.
Revisit this rule whenever the business changes materially. For a 22 person agency with a controller and three department leads, monthly payroll near $105,000 and vendor payments near $70,000 today, but a new location, employee, processor or owner could alter the answer under dual approval for higher-risk payments. Put a review date on the banking file and identify the metric that would justify an earlier review. Periodic checks are especially valuable for access control, fraud prevention and clear accountability, since account terms and operating patterns can drift apart gradually without producing one obvious failure.
Employee cards need explicit limits
Additional debit or purchasing cards can be useful, but each card should have a business purpose, spending limit and review process. Remove access promptly when a person changes roles or leaves the company.
The useful question is what happens next if this rule is missed. With a 22 person agency with a controller and three department leads and monthly payroll near $105,000 and vendor payments near $70,000, a small banking constraint can flow into payroll timing, supplier payments, tax transfers or the month end close. Write down the trigger, the likely consequence and the fallback channel at the bank. Reviewing employee cards need explicit limits this way connects the account to access control, fraud prevention and clear accountability and exposes weaknesses that a feature table will not show.
Review access on a schedule
At least periodically, export or review the bank’s user list and compare it with current staff responsibilities. Access that made sense a year ago can become a control weakness after organizational changes.
Use this section as a control checkpoint. In a 22 person agency with a controller and three department leads, where monthly payroll near $105,000 and vendor payments near $70,000, decide who monitors review access on a schedule, who can approve an exception and what evidence is retained after the action is complete. If only one person understands the process, document a backup. If the rule depends on a threshold, set an alert before the threshold is reached. Those steps turn the banking choice into a repeatable process that strengthens access control, fraud prevention and clear accountability.
Build an access review into the close process
Before opening or changing the account, ask the bank one concrete question about build an access review into the close process and verify the answer in writing. For a 22 person agency with a controller and three department leads, the operating context is monthly payroll near $105,000 and vendor payments near $70,000. A written answer matters because the company may rely on it months later when a fee, limit or approval issue appears. Add the verified rule to the banking checklist and review it after major growth. This keeps access control, fraud prevention and clear accountability tied to current terms rather than an old sales conversation.
For this business, the review should be repeated after any material change in access control, fraud prevention and clear accountability, so the bank setup continues to match actual activity rather than the assumptions made at opening.
Prioritize role based permissions and approval discipline.
The practical answer depends on whether the account supports role based permissions and approval discipline without creating hidden work elsewhere. Compare the normal month with a stressed month, document the thresholds that matter and keep a fallback for the most important payment path. If the arrangement only works when one person is available or when balances stay unusually high, that weakness should count against it even when the published fee looks favorable. Start the review with separate ownership, signing authority and online access, and finish by checking build an access review into the close process.