CPFA cheat sheet

CPFA stands for Certified Public Finance Administrator; ACPFA is the Advanced Certified Public Finance Administrator, an elevated credential for experienced public finance professionals.

CPFA is administered by the Association of Public Treasurers of the United States and Canada (APT US&C); the exam is delivered in English and candidates register through the association.

Eligibility centers on public-sector treasury or finance employment plus a defined minimum of years of qualifying experience; ACPFA requires the CPFA plus additional documented experience and education.

Candidates typically submit an application, employer verification of duties, and payment before scheduling the exam; incomplete applications are not reviewed.

The CPFA body of knowledge covers treasury and investment management, cash handling, internal controls, fraud prevention, and customer service - the same domains used for exam weighting.

A passing score is set by a cut score established through standard-setting; scaled scoring is used so a raw percentage is not the reported result.

Recertification is required on a fixed cycle (commonly three years) and is earned through continuing education plus evidence of professional practice.

Use the official candidate handbook for current fees, exam windows, and the exact number of questions; these details change and superseded materials should not be relied on.

Recertification runs on a fixed cycle, commonly three years from the certification date; the expiration date is printed on the certificate and tracked by the certifying body.

Credit is earned in continuing professional education (CPE) hours; a common requirement is 30-60 hours per cycle, with a portion tied specifically to treasury, cash, or investment topics.

CPE hours must come from recognized providers and be documented with certificates showing provider, title, date, hours, and topic.

Some bodies require ethics or fraud-related hours inside the total; check the current requirement because the split changes.

Carryover of excess hours from one cycle to the next is usually capped or disallowed; excess hours do not roll over indefinitely.

Late recertification commonly triggers a reinstatement fee plus a grace period; letting the credential lapse past the grace period may require re-examination.

Audits of CPE records are random; retain certificates and agendas for at least one full cycle after the cycle closes.

Teaching, publishing, or serving on relevant committees may earn credit at a conversion rate (for example, one hour of instruction equals two CPE hours); the rate is set by the certifying body.

An investment policy is a governing document adopted by the elected body; it states objectives, permitted instruments, maturity limits, credit limits, diversification, and reporting.

Core objectives are ranked: safety of principal first, then liquidity, then yield - yield is never the primary objective for public funds.

Permitted investments are listed explicitly; anything not listed is prohibited, so the policy should be a whitelist, not a blacklist.

Maturity limits are expressed as a maximum weighted average maturity (WAM) and a maximum maturity for any single security; typical public-fund limits are short (for example, 1-5 years).

Credit quality limits use the highest short-term rating categories (for example, A-1/P-1 or equivalent) and cap exposure to any single issuer.

Diversification rules cap the percentage of the portfolio in a single issuer, sector, or instrument type, excluding U.S. Treasury and agency obligations where permitted.

The policy names authorized dealers, requires competitive bids where practicable, and prohibits speculative instruments such as derivatives used for leverage.

Reporting is periodic (often monthly or quarterly) and includes holdings, market value, yield, maturity distribution, and compliance with policy limits; an annual independent review is common.

Policy review occurs annually, and any deviation must be documented and reported to the governing body rather than resolved informally.

Segregation of duties is the core rule: the person who receives cash should not also record the receivable, reconcile the bank account, or authorize write-offs.

Dual custody applies to high-value counts - two people verify and initial the count, and both sign the deposit record.

Deposits are made intact and timely; currency is never used to cash checks or make petty-cash disbursements from receipts.

A pre-numbered receipt is issued for every over-the-counter payment, and the receipt sequence is accounted for daily.

Daily cash reconciliation compares receipts, the cash drawer, and the deposit slip; differences are investigated the same day, not carried forward.

Petty cash operates on an imprest basis: a fixed fund, vouchers for every payout, and replenishment equal to the vouchers submitted.

Physical controls include locked drawers, safes with dual control and time delays, limited key distribution, and alarmed cash-handling areas.

Electronic payments carry their own controls: segregation of ACH initiation from approval, callback verification of bank-detail changes, and daily positive pay matching.

The fraud triangle: pressure (incentive), opportunity, and rationalization. Controls attack opportunity, which is the element the organization can most directly reduce.

Occupational fraud is most often detected by tips, not by auditors or internal controls; a confidential reporting hotline is a high-value control.

Common public-sector schemes include fictitious vendors, duplicate payments, check tampering, payroll ghosts, skimming of receipts, and expense reimbursement abuse.

Red flags: an employee living beyond means, refusing to take vacation, unusual closeness to a vendor, vendor addresses matching employee addresses, and sequential invoice numbers from unrelated vendors.

Data analytics detect fraud: duplicate invoice numbers, payments to the same bank account across different vendors, round-dollar amounts, and payments just under approval thresholds.

Vendor master file changes are a high-risk event; require independent verification of new vendors and of any change to bank details.

Segregation of duties, mandatory vacation rotation, surprise cash counts, and management review of exception reports are preventive controls.

Detection metrics to monitor: voided receipts, refunds, write-offs, adjustment journal entries, and after-hours system access.

COSO defines five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

Preventive controls stop errors before they occur (approvals, segregation of duties); detective controls find them afterward (reconciliations, audits).

Segregation of duties splits authorization, custody, and recordkeeping among different people; where staffing is thin, compensating controls (independent review, logs) substitute.

Approval thresholds and dollar limits define who may commit funds; the same person must not approve and pay.

Bank reconciliations are performed by someone independent of cash receipts and disbursements, and are reviewed and signed by a supervisor.

Physical and IT controls include access restrictions, unique user IDs, no shared passwords, and periodic access reviews for terminated employees.

Documentation standards: every transaction is supported by an invoice, approval, and proof of receipt; the audit trail must allow reconstruction.

Monitoring includes management review of budget-to-actual reports, exception reports, and periodic internal audits; findings are tracked to closure.

Service standards should be written and measurable: response times, phone answer targets, and counter wait times are examples of published commitments.

Customer expectations in public finance center on accuracy, timeliness, transparency, and consistent treatment of all taxpayers.

Complaint handling follows a defined path: log the complaint, acknowledge within a set period, investigate, respond in writing, and record the resolution.

Confidentiality rules limit what staff may disclose about a taxpayer's account; identity verification precedes any account discussion.

Accessibility and language access are legal obligations in many jurisdictions; offer translated materials and alternate formats on request.

Cross-training and documented procedures reduce service variation and keep counters open when a staff member is absent.

Measuring satisfaction through short surveys and tracking first-contact resolution gives actionable data rather than anecdote.

De-escalation technique: listen without interrupting, restate the issue, state what can be done and when, and follow through on the commitment.