Signer Management and Authority Matrices

Why Signer Management and Authority Matrices Matter

Every dollar that leaves an organization does so because someone was authorized to release it. The question of who may commit the company to a payment, open or close a bank account, execute a derivative, or draw on a credit facility sits at the very heart of treasury control. When this question is answered poorly, the consequences are severe: unauthorized transactions, internal fraud, duplicate or erroneous payments, regulatory penalties, and audit findings that damage management credibility. When it is answered well, the organization enjoys clean audit trails, faster bank onboarding, smoother successions when staff leave, and strong defenses against both internal and external fraud.

For the AFP Certified Treasury Professional (CTP) exam, this topic falls under Internal and External Relationships because signer management is where treasury's internal governance (board, finance leadership, internal audit) meets its external counterparties (banks, custodians, brokers, and payment providers). A treasury professional must be able to translate the company's internal delegation of authority into instructions that banks can actually act upon, and keep both sides perfectly synchronized over time. Examiners test this because it is a daily operational reality for treasury departments of every size and because weaknesses here are a leading root cause of financial control failures.

What Signer Management Is

Signer management is the set of policies, procedures, and records that govern which individuals are authorized to act on behalf of the organization with financial institutions and in financial transactions, what they are authorized to do, up to what dollar limits, and under what conditions (for example, alone or jointly with another authorized person). It covers the full lifecycle of an authorized signer:

1. Appointment – formally granting authority, typically through a board resolution or a delegation under a board-approved policy.
2. Documentation – communicating that authority to banks and counterparties through signature cards, bank mandates, incumbency certificates, and account resolutions.
3. Maintenance – periodically confirming that the list of signers is accurate and that limits remain appropriate.
4. Modification – adjusting authority when roles change, limits are revised, or new accounts are opened.
5. Revocation – promptly removing authority when a person leaves the company, changes jobs, or is otherwise no longer appropriate to hold it.

The term signer originated with wet-ink signatures on checks, but today it encompasses anyone with authority to initiate, approve, or release electronic payments (ACH, wire, RTP, card programs), to execute treasury contracts (ISDA agreements, loan documents, investment trades), or to administer bank portals and treasury management systems.

What an Authority Matrix Is

An authority matrix (also called a delegation of authority matrix, DOA, signing authority schedule, or approval matrix) is a structured document, usually presented as a grid, that maps types of transactions against the roles or individuals who may approve them, with corresponding dollar thresholds and any joint-approval requirements. A simplified example might look like this:

- Wire transfers up to $50,000: Treasury Analyst initiates, Treasury Manager approves.
- Wire transfers $50,001 to $1,000,000: Treasury Manager initiates, Assistant Treasurer or Treasurer approves.
- Wire transfers above $1,000,000: Treasurer initiates, CFO approves; two approvers required above $5,000,000.
- Opening or closing a bank account: Treasurer and CFO jointly, with board notification.
- Executing a hedging contract: Treasurer within board-approved hedging policy limits; CFO above those limits.
- Borrowing under the revolving credit facility: Treasurer up to the committed amount; board approval for new facilities.

The matrix serves several purposes at once. It operationalizes the board's governance decisions, it gives staff clear guidance on what they may and may not do, it gives auditors a benchmark against which to test transactions, and it provides banks with a reference for what instructions they should honor. Well-designed matrices are role-based rather than name-based wherever possible, so that a change in personnel does not require a rewrite of the policy itself, only an update to the roster of people occupying each role.

How Signer Management and Authority Matrices Work in Practice

1. Source of authority: the board and corporate governance. Ultimate authority to bind a corporation rests with its board of directors. The board typically passes resolutions authorizing specific officers (often the CFO and Treasurer) to open accounts, designate signers, and enter into financing arrangements, and it approves the treasury policy that defines limits. The board may delegate the power to designate lower-level signers to the CFO or Treasurer, but that delegation itself must be documented. Banks will insist on seeing evidence of this chain of authority, typically in the form of a certified board resolution and a secretary's or incumbency certificate confirming who holds which officer title.

2. Communicating authority to banks: mandates and signature cards. For each bank account, the bank maintains a mandate (also called account resolution or signature card) listing who may sign, their specimen signatures, and any conditions such as dual-signature requirements above a stated amount. For electronic channels, the equivalent is the bank portal's user entitlement setup, which defines who can initiate, approve, and release payments, with what limits, and whether dual approval is enforced. Treasury is responsible for ensuring that the bank's records mirror the internal authority matrix exactly. A mismatch in either direction is a control gap: if the bank allows more than policy permits, unauthorized payments can occur; if the bank allows less, legitimate payments are delayed.

3. Core control principles embedded in the matrix.
- Segregation of duties: the person who initiates a payment should not be the same person who approves or releases it, and neither should perform the bank reconciliation. The matrix should make these separations explicit.
- Dual control / dual authorization: requiring two independent approvers for high-value or high-risk transactions (wires, new vendor setups, template changes, account openings).
- Tiered limits: authority increases with seniority, and the number of approvers increases with transaction size.
- Least privilege: each person holds only the authority needed for their role, no more.
- Restriction of system administrators: those who can create users or change entitlements in bank portals and treasury management systems should not also be able to initiate or approve payments, or at minimum should be subject to independent review.

4. Onboarding a signer. When a new person requires authority, treasury verifies the request against the matrix, obtains approval from the delegating officer, prepares updated bank documentation (which may require notarization, specimen signatures, identity documents, and KYC information for the bank's compliance process), submits it to each affected bank, sets up portal entitlements and security tokens, and records the change in the internal signer register. Banks must complete their own know-your-customer and beneficial-ownership checks on new signers, which can introduce delays that treasury should anticipate.

5. Offboarding a signer. This is the step most frequently found deficient in audits. When a signer resigns, is terminated, or transfers roles, authority must be revoked at every bank, every account, and every system on or before the effective date. Best practice ties signer revocation into the HR termination workflow so treasury is notified automatically. Hardware tokens and digital certificates must be recovered or deactivated. The internal register is updated and a confirmation is obtained from each bank.

6. Periodic review and certification. At least annually (quarterly for many organizations), treasury should obtain from each bank a complete list of authorized signers and portal users on every account and reconcile it against the internal authority matrix and HR records. Discrepancies are investigated and corrected. Many companies require each signer to recertify annually that they understand their authority and obligations. Internal audit typically tests this process.

7. Technology enablers. Electronic Bank Account Management (eBAM) uses standardized ISO 20022 messages to open, close, and modify accounts and signer mandates electronically, replacing paper forms and giving treasury a real-time view of entitlements across banks. Treasury management systems (TMS) can embed the authority matrix as workflow rules, so a payment exceeding a user's limit is automatically routed to the correct approver. Digital signature platforms allow legally binding electronic execution of resolutions and mandates. A centralized bank account database or signer register, whether in a TMS or a dedicated tool, is considered a baseline control for any organization with more than a handful of accounts.

8. Legal and regulatory considerations. Under the Uniform Commercial Code (UCC) Article 4A, a bank is generally protected when it executes a payment order that passes an agreed commercially reasonable security procedure, even if the order was not actually authorized by the customer. This means that if a company fails to remove a departed employee from the bank's authorized list, the company, not the bank, typically bears the loss. Sarbanes-Oxley Section 404 requires public companies to maintain and test internal controls over financial reporting, and signer controls are routinely within scope. Bank KYC and anti-money-laundering rules require banks to identify and verify signers, so documentation quality directly affects account opening speed.

Common Weaknesses Examiners Expect You to Recognize

- Former employees remaining on bank mandates months or years after departure.
- Name-based matrices that become outdated with every personnel change.
- Dual-control requirements that exist on paper but are not enforced in bank portal settings.
- Concentration of authority in one person (key-person risk and fraud risk), especially in small subsidiaries or foreign locations.
- System administrators who also hold payment authority.
- Internal matrix and bank mandates that have drifted apart because changes were made at one but not the other.
- Lack of a complete inventory of bank accounts, making it impossible to know where signers exist.
- Missing board resolutions or expired incumbency certificates that stall bank transactions at critical moments.

Best Practices Summary

- Anchor all authority in board resolutions and a written, board-approved treasury policy.
- Build the authority matrix on roles and tiered dollar limits with mandatory dual approval above defined thresholds.
- Maintain a single, centralized register of all bank accounts, signers, and system entitlements.
- Integrate signer changes with HR onboarding and termination processes.
- Reconcile bank-provided signer lists to the internal matrix at least annually and document the review.
- Use eBAM and TMS workflow rules to automate enforcement and reduce paper.
- Ensure segregation of duties among initiation, approval, release, administration, and reconciliation.
- Keep board resolutions and incumbency certificates current and readily available for banks.

Exam Tips: Answering Questions on Signer Management and Authority Matrices

Tip 1 – Look for the control weakness first. Many CTP questions present a scenario and ask what is wrong or what should be done. Scan for classic red flags: one person initiating and approving, a terminated employee still listed at the bank, no dollar limits, or the system administrator also releasing payments. The correct answer almost always introduces segregation of duties, dual control, or a prompt revocation process.

Tip 2 – Know who holds ultimate authority. If a question asks where the authority to open bank accounts or designate signers originates, the answer is the board of directors (through resolutions), which may delegate to officers such as the CFO or Treasurer. The treasurer administers; the board authorizes.

Tip 3 – Remember that the company bears the loss for stale signers. Under UCC 4A, if the bank follows an agreed security procedure, the customer generally bears the loss for a payment initiated by someone the company failed to remove. Any answer choice that blames the bank for honoring an instruction from a still-listed former employee is usually wrong.

Tip 4 – Prefer role-based over name-based answers. When asked how to design a sustainable authority matrix, choose the option that assigns authority to positions or roles with defined limits, rather than to named individuals.

Tip 5 – Match internal and external records. Questions about periodic review are testing whether you know that bank mandates, portal entitlements, and the internal authority matrix must be reconciled regularly, typically annually at minimum. The answer emphasizing a documented reconciliation to bank-provided lists is the strongest control.

Tip 6 – Connect to eBAM and technology. If a question describes a company with hundreds of accounts across many banks struggling to track signers, the best answer usually involves a centralized bank account management tool or eBAM, not simply adding more staff or more spreadsheets.

Tip 7 – Watch for the timing word. Offboarding questions hinge on timing: authority should be revoked immediately or on the effective date of departure, not at the next annual review. Eliminate answers that defer revocation.

Tip 8 – Distinguish the levels of payment workflow. Know the difference between initiation (creating the payment), approval (authorizing it), and release (transmitting it to the bank). The exam may ask which roles should be separated; the ideal is that no single person can perform all three, and that approval limits step up with transaction size.

Tip 9 – Do not over-control in the wrong direction. Occasionally a question tests practicality: requiring the CEO to sign every $500 payment is not a best practice. The right answer balances control with operational efficiency through tiered limits.

Tip 10 – Read for the stakeholder relationship. Because this topic sits under Internal and External Relationships, questions may ask what documents a bank needs (board resolution, incumbency certificate, signature card, KYC identification) versus what internal audit needs (the authority matrix, signer register, evidence of periodic review, and evidence of timely revocations). Keep the two audiences straight.

Sample Question Walkthrough

A treasury manager discovers during the annual review that a regional controller who resigned eight months ago still appears as an authorized approver on three foreign bank accounts. Which of the following represents the most significant control deficiency?

A. The annual review was performed too late in the year.
B. There is no process linking HR terminations to signer revocation.
C. Foreign accounts should not have local approvers.
D. The bank failed to remove the signer.

Analysis: Option A addresses a symptom, not the root cause. Option C is incorrect because local approvers are common and appropriate with proper controls. Option D is wrong because the bank acts on the company's instructions and bears no duty to independently discover resignations. Option B identifies the missing control that allowed the lapse: the absence of a linkage between HR events and signer revocation. B is correct.

Final Takeaway

Signer management and authority matrices are where governance becomes action. The CTP exam rewards candidates who can trace authority from the board through policy and delegation to bank mandates and system entitlements, who recognize that the company owns the risk of stale or excessive authority, and who can identify the control that fixes a given weakness. Master the lifecycle (appoint, document, maintain, modify, revoke), the core principles (segregation of duties, dual control, tiered limits, least privilege), and the review discipline (reconcile bank records to the internal matrix), and you will handle any question in this area with confidence.