What is an ACH audit?

An ACH audit — often called a Nacha audit or an ACH rules-compliance audit — is a review of whether an organization follows the provisions of the Nacha Operating Rules that apply to its ACH activities. It is a distinct exercise from a financial-statement audit, from an ACH risk assessment, and from an examination performed by a banking regulator. Its single purpose is to answer one question: does what you actually do match what the Rules require of your role?

The requirement to conduct this audit lives in the Nacha Operating Rules at Article One, Subsection 1.2.2, “Audits of Rules Compliance.” (Rule locations can shift between editions, so confirm the exact citation in your current Rules book.) Historically, Nacha prescribed detailed, checklist-style audit procedures in Appendix Eight. Those prescriptive steps were eliminated effective January 1, 2021. The obligation to perform an annual audit remains firmly in place — but Nacha no longer dictates the exact procedures, which means each organization is responsible for designing a review that genuinely covers the Rules applicable to it.

Who needs an annual ACH audit?

The Rules require each participating Depository Financial Institution (DFI), each Third-Party Service Provider, and each Third-Party Sender to conduct an annual audit of compliance with the applicable provisions of the Nacha Operating Rules. The precise scope depends on which ACH functions the organization performs.

• A financial institution that originates and/or receives entries audits the rules that apply to ODFIs and RDFIs.
• A Third-Party Service Provider audits the functions it performs on behalf of its clients.
• A Third-Party Sender audits its origination activity, its origination agreements, and its oversight of the Originators it sends for.
• An ordinary business that simply originates its own payroll or collections is typically bound by the Rules through its ODFI agreement; it should confirm its specific obligations with its ODFI rather than assume the annual audit rule applies identically to it.

This nuance matters. A common mistake is for a small business Originator to assume it must produce a formal Nacha audit identical to a bank’s, or conversely for a Third-Party Sender to assume it has no obligation at all. The correct move is always to map your role first, then confirm the scope with your ODFI and your own reading of the current Rules.

When is the ACH audit due?

The annual audit of Rules compliance must be completed by December 31 of each year. There is no single prescribed start date, so organizations are free to schedule the work whenever suits them — but the review, its findings, and evidence of completion must all be in place by year-end. Treating December as the deadline rather than the start date is one of the most common and avoidable sources of year-end scramble.

What an ACH auditor specifically checks

Because Nacha no longer prescribes exact steps, the substance of the audit is defined by the Rules that apply to your role. In practice, a thorough review examines the following areas, gathering evidence for each rather than relying on attestation.

• Authorization: that debits and credits are properly authorized under the correct standard, that authorizations are readily identifiable, and that copies can be produced on request.
• Record retention: that records of entries and authorizations are retained for the required periods (six years for records of entries; two years after termination or revocation for consumer debit authorizations).
• SEC code usage: that each entry carries the correct Standard Entry Class code and meets that code’s format and authorization requirements.
• Returns and Notifications of Change: that returns are transmitted within the Rules’ timeframes and that NOCs are acted on correctly.
• Prenotifications and account validation: that prenotes and, for WEB debits, commercially reasonable account validation are handled as required.
• Data security: that account numbers and other sensitive data are protected at rest and in transit, consistent with the Rules’ security requirements.
• Origination controls: that origination agreements, exposure limits, and Third-Party Sender oversight and registration are documented and enforced.
• Return-rate monitoring: that unauthorized, administrative, and overall return rates are tracked against Nacha’s thresholds.

Who can perform the audit

Nacha does not mandate a specific auditor or credential. The review can be performed internally by qualified staff who are independent of the function being audited, by an internal audit department, or by an external firm or payments association. Many organizations use staff who hold Nacha’s Accredited ACH Professional (AAP) or Accredited Payments Risk Professional (APRP) credentials, but that is a best practice, not a requirement. What the Rules care about is competence, independence from the audited activity, and documented evidence that the audit was genuinely performed.

An example in practice

Consider a mid-sized software company that debits customers monthly for subscriptions using the WEB SEC code. Its annual audit would, at minimum: pull a sample of customer authorizations and confirm each can be produced and matches the WEB standard; verify that the company runs a commercially reasonable account-validation and fraud-detection process for WEB debits; confirm that returns (including any unauthorized returns) are monitored against the 0.5% unauthorized, 3% administrative, and 15% overall thresholds; and confirm that authorization records are retained for two years after a customer cancels. Findings — say, a batch of authorizations that could not be located — would be documented with an owner and a remediation date, and the completed workpapers would be retained for six years.