Internal controls for growing businesses

Controls are usually introduced after a loss, which is the most expensive way to do it. They are also usually introduced badly — a policy document nobody follows, or so many approval layers that work grinds to a halt and staff route around them. Good controls are few, specific, enforced by the system where possible, and proportionate to the risk.

These are the controls that matter most as a business grows past the point where the owner can see everything.

Segregation of duties

The single most important control, and the one most often sacrificed for convenience. No individual should be able to initiate, approve, record and reconcile the same transaction. In practice the dangerous combinations are: someone who can set up a supplier and also approve payment to that supplier; someone who receives cash and also records it; someone who processes payroll and also reconciles the payroll bank account; someone who can both create and approve a journal.

Small businesses cannot fully segregate everything. Where that is the case, compensate: independent review of bank reconciliations, periodic supplier list review, mandatory leave for people in sensitive roles, and direct oversight of master data changes.

Approval authority

A written delegation of authority: who may approve what, at what value, with what evidence, and who acts in their absence. Then enforce it in the system rather than by policy document, because a control that depends on discipline decays and a control the system enforces does not. Include what happens when the approver is unavailable — most approval bottlenecks exist because nobody defined a deputy.

Supplier and customer master data control

Fraud most often enters through master data: a supplier bank account changed, a duplicate supplier created, a customer credit limit raised. Changes to bank details, tax details and credit limits should require independent verification and be logged with an audit trail. A monthly review of changes to the supplier list takes ten minutes and prevents the most common payment fraud.

Bank reconciliation discipline

Every bank and payment account reconciled monthly, by someone who does not handle the cash or initiate the payments, with differences investigated and cleared rather than carried forward. A reconciling item that has been open for three months is not a reconciling item; it is an unresolved problem. Review reconciliations for completeness and for stale items.

Three-way matching

For purchases, match the purchase order, the goods received note and the invoice before payment. It prevents payment for goods not received, payment at the wrong price, and duplicate payment. Where full three-way matching is impractical, at minimum require a purchase order above a threshold and evidence of receipt.

Stock and asset control

For businesses holding stock: cycle counting on a defined schedule, investigation of variances rather than write-offs, controlled goods movement, and secure storage of high-value items. For fixed assets: a register, physical verification periodically, and controlled disposal with evidence. Stock is the asset most easily lost and the one most often written off without investigation. See our retail and distribution page for how this works in practice.

System access and audit trails

Named user accounts for every individual — never shared logins, which destroy the audit trail and make investigation impossible. Least-privilege access, reviewed when roles change. Immediate removal of access when someone leaves, which is missed surprisingly often. Audit logging enabled and reviewed periodically, not only after an incident.

Journal entry control

Manual journals are how accounts are manipulated, deliberately or accidentally. Require approval above a threshold, require a documented reason for each journal, restrict who can post, and review the journal listing monthly. A large journal posted late in a period with no explanation is worth a question every time.

Cash handling

For cash-receiving businesses: daily reconciliation of takings to banked cash, cash limits, secure storage, dual custody for significant amounts, and rotation of duties. Cash controls are unglamorous and they work.

Exception and surprise review

A short monthly exceptions report — unreconciled accounts, journals above threshold, credit notes issued, discounts given, stock variances, master data changes — reviewed by someone senior. Add occasional unannounced checks: a surprise cash count, a sample of supplier payments traced to approval, a review of access rights. Predictable controls are worked around; unpredictable ones are not.

How to implement without paralysing the business

Start with the highest-risk processes, not everything. Document each control with an owner. Enforce in the system wherever the platform allows. Test periodically and record the result — a control that is never tested is an assumption. And review the whole set annually, because controls designed for thirty staff are wrong for a hundred.

Our business process improvement service covers designing, documenting and testing this framework, and our audit and assurance service covers independent testing of whether it actually operates.