How do you prepare for an ACH audit?

A well-run ACH audit is mostly preparation. The annual audit of Rules compliance must be completed by December 31, and if you gather the right evidence and test the right controls throughout the year, the review becomes a confirmation rather than a scramble. This guide walks through a practical, checklist-driven approach you can adapt to your role — Originator, ODFI, RDFI, or Third-Party Sender.

Start with scope

Before gathering a single document, define what the audit must cover. Scope is driven entirely by role, so pin that down first.

1. Confirm your role(s): Originator, ODFI, RDFI, Third-Party Sender, or a combination — this scopes the entire audit and tells you which Articles of the Rules apply.
2. Obtain the current year’s Nacha Operating Rules and note any amendments that took effect this year, especially in fraud monitoring and risk management.
3. List the SEC codes you use and the channels you collect authorization through, so you know which authorization standards are in scope.

Assemble your evidence

The audit is an evidence exercise. Gathering these items before the review starts is what separates a smooth audit from a painful one.

• Origination agreements and any Third-Party Sender agreements, plus registration records where applicable.
• A representative sample of authorizations across each SEC code you use, with proof each can be produced.
• Return reports and the return-rate calculations for the unauthorized (0.5%), administrative (3%), and overall (15%) thresholds.
• Exposure limits and evidence they are monitored and enforced.
• Your written ACH risk assessment and evidence of its most recent review.
• Data-security documentation showing how account numbers are protected at rest and in transit.
• Records of Notifications of Change and how they were applied.

What to test

With evidence in hand, test the controls that matter most — the ones that generate findings when they fail.

• Sample authorizations and confirm each can be produced, matches its SEC code, and states amount, timing, and revocation terms.
• Verify returns and Notifications of Change were handled within the Rules’ required timeframes.
• Recalculate your three return rates and confirm they are monitored on an ongoing basis, not just at audit time.
• Confirm account data is protected at rest and in transit and that access is appropriately restricted.
• Check that exposure limits exist, are monitored, and are enforced.
• Review Third-Party Sender registration, due diligence, and ongoing oversight.
• Confirm records of entries are retained for six years and consumer debit authorizations for two years after revocation.

Document findings and close the loop

Findings only matter if they are fixed. For each issue, record what was found, assign an owner and a remediation date, and track it to completion. Keep this tracking alongside the audit workpapers so that next year’s reviewer — and any request from your ODFI — can see both the finding and its resolution. This is also where a “last reviewed” discipline pays off: noting the Rules edition you audited against makes it obvious next year what has changed.

Build a year-round calendar

The best-prepared organizations do not treat the audit as an event. They monitor return rates monthly, refresh the risk assessment on a schedule, sample authorizations quarterly, and track rule changes as their effective dates approach. By December, the annual audit is largely a matter of assembling evidence that already exists. That is the difference between an audit that confirms a healthy program and one that discovers problems too late to fix before year-end.