Treasury and FX governance: who decides what, and how to evidence it

In most of the mid-market companies we work with, FX and investment decisions are taken sensibly — and written down nowhere. That works until one of three things happens: the statutory auditor asks for the framework, the person who decided leaves, or a transaction goes wrong and nobody can find who approved it.

1. Scope

The first section, the shortest and the most often rushed. It lists what the policy covers: which entities, which currencies, which instruments, which investment vehicles. Anything not listed is forbidden by default.

That closed-list wording is what actually protects you. A policy listing forbidden instruments will always be circumvented by an unlisted product; a policy listing authorised instruments will not.

2. Objectives, stated so they can be checked

« Minimise currency risk » is not an objective: it cannot be verified. A usable wording looks more like: « the average rate achieved over the year stays within 2 % of the budget rate adopted ».

The difference is operational: the second statement lets you say at year-end whether the objective was met. The first allows no assessment, and therefore no improvement.

3. Limits

This is the heart of the document. Four families of limits, each quantified.

• Hedging limits: the ratios by horizon and by nature of flow, with their tolerance band.
• Counterparty limits: the maximum exposure per institution, so that all the risk does not concentrate on one bank.
• Investment limits: maximum amount and share per instrument and per issuer, with the maximum lock-up period.
• Instrument limits: maximum notional per transaction and maximum total notional outstanding at any time.

4. Delegations

A table with three columns — which act, who decides, who checks — beats three pages of prose.

The quality test for a delegation table is simple: take the last five transactions and check each one fits a line. Those that do not reveal the gaps.

5. Segregation of duties

This is the requirement auditors raise systematically and that small teams find hardest to satisfy: the person deciding a transaction should not be the one confirming it to the bank, nor the one recording it.

In a team of two or three, full segregation is impossible. The acceptable answer is not to pretend, but to compensate with documented after-the-fact controls:

1. A monthly reconciliation between recorded transactions and bank confirmations received, signed off by someone other than the dealer.
2. A quarterly review of the position book by a third party — accountant, outside adviser, board member.
3. Dual signature above a threshold, set directly in the bank's authorisations: this is the most robust control, because it is executed by a third party.

6. Review and evidence

The last section: who reviews the policy, how often, and where the records are kept. A policy not reviewed for four years loses its evidential value, because the auditor will find it no longer describes the actual business.

• Annual review by the finance committee, formal approval by the board or managing director.
• Bank confirmations, hedge documentation and committee minutes kept in one file, retrievable on a single request.
• A decision log: one line per significant transaction, with the date, the decision-maker, the amount and the reason. That log is the first thing to produce in an audit.

The format: one page, not thirty

A thirty-page document will not be read, therefore not applied, therefore worthless as evidence. Policies that work run to one or three pages: scope as a list, limits as a table, delegations as a table, review in three lines. Anything beyond that belongs in technical annexes, not in the policy itself.