ICoFR, internal control over financial reporting, asks for evidence that report numbers can be explained by people, rules, and a trail you can inspect. Auditors do not ask for a policy poster. They ask who matched, who approved the break, and why matching cannot be silently edited in a spreadsheet.
What is actually tested
Control design: is matching separated from exception approval. Control operation: did that happen in the audited period. Trail: is the evidence still there. A spreadsheet saved-as every night fails the third test even with good intent.
OJK Regulation 34 of 2025 on IT for rural banks takes effect on 18 December 2026 and requires, among other things, a core application and data backups. Reconciliation that lives only on a staff laptop is hard to explain as a recoverable control.
Reconciliation as a control, not homework
A late close often means matching is still fully human. ICoFR does not ban automation. It demands automation that is logged. Matching rules, rule versions, and exceptions that reach a person must be visible. “A machine we trust” with no log is an opinion, not a control.
Bank Indonesia’s PBI 10/2025 and PADG 32/2025 on the payment-system industry took effect on 31 March 2026. If you are a PSP or a PSP partner, settlement reconciliation belongs in the control story, not as a last-minute RBSP annex.
Evidence that usually suffices, and what does not
Enough: a dated reconciliation, an open-break list, named approvals, and source exports that can be rerun. Not enough: screenshots, final_final2.xlsx, and a verbal note that “A usually checks.”
OJK’s IASC, as reported by Kompas on 8 September 2026, blocked Rp 771.2 billion in fraud-related accounts. Movements that hang because of a freeze need an exception class, not a quiet journal to make the balance agree. Forcing a break closed is an ICoFR failure, not punctuality.
Segregation in a team of five
Five people cannot copy a large bank. They can stop the same person importing the statement, approving the break, and posting the journal. A second approval on exceptions above a written threshold is already much better than no threshold.
Do not wait for the auditor to tidy usernames. A shared “finance” login on a spreadsheet is a finding you can predict.
Frequently asked questions
What is ICoFR in finance-team language?
Evidence that report numbers come from rules and people you can inspect, not from a file anyone can edit with no trail.
Does reconciliation automation replace ICoFR?
No. Logged automation is part of ICoFR. Automation without a log adds opinion.
What do auditors ask first?
The period reconciliation, the exception list, who approved, and whether sources can be rerun.
Can Excel pass?
Rarely if it is the book of record. Sometimes as a worksheet exported from a system that logs.
What about blocked accounts?
Do not force a match. Named exception, status evidence, close after it is official.
Smallest step this week?
Kill shared logins, record break approvals, store source exports with the match result.