The Passbook Is Money Until It Isn't
Passbooks, receipt books, cheque leaves and ATM cards are accountable documents, not consumables — and a stock count that agrees on quantity while nobody knows which numbers went where is not a control at all.
A blank numbered receipt book is not stationery. In the hands of somebody collecting deposits at a branch counter, it is an instrument for issuing an official-looking acknowledgement of money that never reaches the SACCO — and the only thing standing between that book and a member's savings is whether anyone can say who was holding it. Most SACCOs control these documents by quantity. The store says four hundred passbooks; the count says four hundred passbooks; the file is signed. Nobody asked which four hundred.
The distinction that matters is between a consumable and an accountable document. Detergent, printer paper and pens are consumables: you care how many you have, you reorder at a level, and a small unexplained variance is a cost of doing business. An accountable document is one where the identity of the individual item carries authority. Receipt number 40871 is a claim on the SACCO. If it is used and unrecorded, the SACCO owes money it never received. If it is destroyed and undocumented, an audit cannot distinguish that from concealment.
This is why the control for accountable documents is a numbered range and a named holder, not a shelf quantity. Every printer's delivery arrives as a continuous span. That span is broken into sub-ranges, each issued to a named person at a named branch, and each person accounts for their span completely — used, spoiled, or still blank. The arithmetic is unforgiving in a useful way: opening range, minus issued, minus voided, equals what should be in the drawer, and the numbers either line up or somebody has a conversation.
Where the chain breaks in practice
What gets recorded
The receiving end, where a document arrives and someone signs
- The printer's delivery note and invoice, against a purchase order
- The total quantity received into the head-office store
- The serial span, if somebody thought to write it on the goods-received note
- A stock figure that will reconcile on a count for the next two years
What decides an audit finding
The issuing end, where the document becomes an instrument
- Which sub-range went to which branch, and on what date
- Which teller signed for it, and whether they still work here
- Which numbers within that range are used, spoiled or blank today
- What happened to the eleven books that were in the Nakuru safe before the fire
What has to cross the seam for the control to exist
- A range, not a quantity — 40801 to 40900, not "one hundred"
- A named custodian who signed, with a date and a reversal path
- A void register, because a spoiled document must be provably spoiled
- A periodic sighting: not "the total agrees" but "I saw numbers 40863 to 40900 in this drawer"
Almost every SACCO records the left column well and the right column on a photocopied form in a folder. The folder is the actual control system, and it is worth knowing that before you assume software has replaced it.
What the system will and will not hold
Be specific with any vendor here, because serial-number tracking and serial-number custody sound identical in a sales conversation and are completely different capabilities. Ours is a case in point, and it is worth walking through honestly rather than in a footnote.
An item can be flagged for serial tracking, and each individual serial can be recorded against the item, its batch, a warehouse, a storage location, the supplier it came from and the purchase order it arrived on, with a received date. That is a real and useful receiving register: three years later you can establish that serial 40871 entered the organisation on a specific order from a specific printer. What does not exist is any movement after that. A serial is written once, with a status of "available", and nothing in the system ever changes it — there is no issue-to-a-person action, no transfer of a range between branches, no void, no spoiled, no used. So the register can tell you where a document was received, and cannot tell you where it is.
| Control | Quantity stock | Serial register | Asset register |
|---|---|---|---|
| How many do we hold | Yes | Partly — configurable by you | Partly — configurable by you |
| Which numbers arrived, and on whose order | No | Yes | Yes |
| Which branch holds a given range now | Partly — configurable by you | No | Yes |
| Which named person signed for it | No | No | Yes |
| Movement history when it changes hands | Partly — configurable by you | No | Yes |
| Date it was last physically sighted | Partly — configurable by you | No | Yes |
| Provable destruction of a spoiled document | No | No | Partly — configurable by you |
| Practical at five thousand passbooks | Yes | Yes | No |
Built and maintained Configurable by you, not maintained by us Not built
Read that last row against the row above it and you have the whole design problem. The asset register is the only place in the system with named custody, movement history and a last-verified date — everything an accountable document needs — and it is built for things you register one at a time. Registering five thousand passbooks individually is not a control, it is a data-entry project that will be abandoned in week three.
So the workable split is by volume, and it is genuinely worth doing rather than a consolation prize. Register the book, not the leaf. A receipt book covering numbers 40801 to 40900 is one asset, named for its range, with the branch as its location and the teller as its custodian. Fifty receipt books a year is fifty asset records, which is nothing, and you get real custody, real movement history when it transfers, and a verification date you can stand behind. High-volume items that are only meaningful once issued to a member — passbooks, cards — stay as quantity stock, and their numbered register stays where it already is: a bound book at the branch, which is a perfectly respectable control provided you stop describing it as something the software does.
Four questions for anyone selling you serial tracking
Show me issuing serials 40801 to 40900 to a named teller at a named branch, in one action.
What a real answer looks like
A range-issue screen, one custodian, one date, and a resulting record you can query by number.
What a vague answer is hiding
If they issue one serial at a time, the feature exists and is unusable at your volumes. If they issue a quantity, there is no serial custody at all.
Void number 40863 as spoiled, with a reason, and then show me it in a void register.
What a real answer looks like
A status change that is irreversible without a second person, and a report listing every voided document for a period.
What a vague answer is hiding
No void state means a spoiled document is indistinguishable from a stolen one, which is precisely the gap fraud lives in.
The teller has resigned. Show me every number still outstanding against them.
What a real answer looks like
A per-custodian outstanding list produced from movement history, not from a spreadsheet somebody keeps.
What a vague answer is hiding
This is the exit-day question, and it is the one that most systems answer with a shrug and a search screen.
Do a physical verification of the Nakuru safe and record what was sighted.
What a real answer looks like
A verification record with a date, a person, and the specific ranges seen — not a quantity confirmation.
What a vague answer is hiding
A count that reconciles totals while the numbers are unexamined is the exact control failure this whole discipline exists to prevent.
The procurement side is the easy half
One part of this is genuinely well covered and worth saying plainly. Ordering controlled stationery is a procurement transaction like any other, and the governance around it holds: a requisition that cannot skip its approval chain, competitive quotations compared on the record, an approval threshold that routes a large print run to whoever should be seeing it, and a supplier record with a prequalification history behind it. For accountable documents that matters more than for detergent, because the security printer is a control point — an organisation that changes printers casually, or lets one branch order its own receipt books directly, has a much larger problem than a missing book.
A practical rule that costs nothing: controlled stationery is ordered centrally, always, and the serial span goes on the goods-received note as a matter of policy. If the span is not recorded at the moment of receiving, no downstream control can reconstruct it, and you will be reconciling ranges from printer invoices during an audit.
What AWRA OpsHub does today
- Serial-level recording, with an item flagged for serial tracking and each number held against its batch, warehouse, storage location, supplier, purchase order and received date. Genuinely useful for establishing provenance.
- Quantity stock per location, with blind cycle counting and valued variance, so the total on the shelf is a controlled figure.
- Batch tracking with expiry and traceability events, which is the same machinery serials sit inside.
- An asset register with named custodians — person, branch, location — with movement history, a last-verified date and retirement with a reason. This is the only surface in the product with real custody, and it is the recommended home for low-volume accountable documents registered by the book.
- Procurement governance on the print run: requisition approval, RFQ comparison, value thresholds, supplier prequalification and a full audit trail.
What it does not do
- A serial's status never changes. Each number is written once with the status "available" and nothing in the system transitions it. There is no issue, no used, no void, no spoiled and no returned. The status field exists and is read-only in practice.
- No range operations. You cannot issue, transfer or void 40801 to 40900 as a span. Everything is per-number, which makes serial custody impractical above a few hundred items even if the actions existed.
- No serial custody by person. Custody applies to assets, not to stock or serials, so no number is ever attributable to a named teller.
- No void or cancelled-document register, so a spoiled document cannot be proved spoiled — the single most important control for accountable stationery.
- No member entity, so a passbook can never be linked to the member it was issued to. That link lives in your core banking system or nowhere.
- No dual-custody or two-signature requirement anywhere on stock movement, so the two-person discipline around a stationery safe is a manual control.
The honest summary is that we can tell you what you bought and from whom, and hold the total on your shelf under a proper count — and we cannot tell you which numbers are in which drawer. If controlled-stationery custody is the problem you are trying to solve, the asset register handles it well at low volume by registering the book rather than the leaf, and at high volume the answer is a bound register at the branch — the same custody logic our SACCO asset register guide applies to equipment. Do not let anyone, us included, tell you that a serial list on a receiving screen is a custody chain.
Our take
Sort your accountable documents by volume before you sort them by software. The fifty receipt books belong in the asset register with a named custodian, because that is where custody actually works. The five thousand passbooks belong in quantity stock plus a numbered register at the branch, and the honest reason is that nothing here issues a range to a person. A SACCO that knows exactly which of those two regimes each document family sits in has a better control than one that believes a serial column on a receiving screen is doing the work.
Control the print run and the custody separately
Governed procurement on the security printer, counted stock per branch, and an asset register with named custodians and movement history for documents registered by the book. Serial issuing and void registers are not built — the note above is specific about it.
See AWRA for SACCOsFrequently asked questions
Is controlled stationery really worth this much attention in a small SACCO?
It is worth more attention in a small SACCO, because a small SACCO has fewer people and therefore less natural separation of duties. Where one person receives the receipt books, issues them, and reconciles the collections, the numbered range is the only independent check that exists. The effort is small — a bound register and a monthly sighting — and it is the difference between a loss that surfaces in a month and one that surfaces in an audit three years later.
Our receipts are printed from the core banking system. Does this still apply?
The exposure shrinks and does not disappear. System-generated receipts are sequenced and reconcilable by the core system, which removes most of the risk. What remains is the manual fallback: the book kept for network outages, mobile collection days and field recruitment. That book is usually uncontrolled precisely because it is exceptional, and exceptional is where losses live. Treat the fallback book with more discipline than the routine one, not less.
What is the difference between a batch and a serial, and which do we need?
A batch identifies a group that shares an origin — one print run, one delivery. A serial identifies one individual item. For accountable documents you need both, and for different reasons: the batch tells you which print run a suspect document came from, and the serial is the unit of accountability. Our system holds both as receiving data, and neither as custody, which is the limitation to design around.
Can we treat every passbook as an asset to get the custody we want?
Technically yes and practically no. Asset records are designed for individual registration with a custodian, a location and a verification rhythm — excellent for fifty receipt books, unworkable for five thousand passbooks. The failure mode is predictable: the register is created in an enthusiastic first month, falls behind, and then becomes actively misleading because it looks authoritative and is stale. A register you can maintain beats a register that is theoretically complete.
Who should hold the stationery safe key?
Not the person who collects money, and not the person who reconciles the collections. That is the whole principle, and it survives any software decision. In practice most SACCOs land on the branch operations officer holding the safe with the branch manager as the second signature on issues, and the internal auditor sighting ranges on an unannounced rhythm. What matters is that the three roles — issue, use, verify — are three people.
How do we handle documents destroyed by fire, flood or a genuine accident?
With a written destruction record made at the time, listing the specific ranges, signed by two people, and reported to the supervisory committee at its next sitting. The reason to insist on ranges rather than quantities is that "eleven books were destroyed" is unverifiable forever, while "numbers 40801 to 41900 were destroyed" can be tested against every document that surfaces afterwards. Losses happen; undocumented losses become allegations.
Does SASRA look at this specifically?
Controls over accountable documents fall squarely inside the internal-control expectations that inspections and external audits examine, and a missing or unmaintained stationery register is a routine management-letter point rather than an exotic one. The practical reason to fix it is not the inspection though. It is that the register is the evidence that protects your staff: a teller who can account for every number in their span is defended by the record, and one who cannot is exposed by its absence.
