The Clusia resource collection
The ACH audit
library
Ten focused resources, each answering a single question. Start at the top for the foundations, or jump to the topic you need.
ACH audit and compliance resources
Foundations 5 min read
What is the ACH Network?
The rails behind direct deposit, bill pay, and most business-to-business payments in the United States, and how a single transaction actually moves.
Foundations 4 min read
What is NACHA?
The nonprofit that writes and enforces the rulebook the entire ACH Network runs on — and why its rules function like private law.
Audit 7 min read
What is an ACH audit?
Understand annual ACH and Nacha audit requirements: who needs a review, the December 31 deadline, what auditors examine, and which records to keep.
Rules 4 min read
How do the Nacha Operating Rules work?
The structure of the rulebook, how amendments become effective, and how obligations flow from the network down to individual originators.
Foundations 4 min read
Who are the parties in an ACH transaction?
Originator, ODFI, Operator, RDFI, Receiver, and the Third-Party players — a map of who does what and who is accountable for what.
Reference 4 min read
What are Standard Entry Class (SEC) codes?
The three-letter codes that classify every ACH entry — PPD, CCD, WEB, TEL and more — and why using the right one is an audit issue.
Rules 4 min read
What counts as valid ACH authorization?
How Originators must obtain, document, and retain authorization for debits — the single most scrutinized area of any ACH audit.
Risk 4 min read
What are ACH return rates and thresholds?
The return-rate limits Nacha enforces — unauthorized (0.5%), administrative (3%), and overall (15%) — and what happens when an Originator exceeds them.
Risk 4 min read
What does an ACH risk management program look like?
The risk assessment, exposure limits, and monitoring the Rules expect from ODFIs and Third-Party Senders, and how they show up in an audit.
Audit 5 min read
How do you prepare for an ACH audit?
A practical, checklist-driven approach to the annual review — the documents to gather, the controls to test, and the findings to fix before the December 31 deadline.