Internal controls are the simple habits and rules that stop money from being lost to mistakes, theft or fraud. Every small business should have a basic set, no auditor required: split money duties where you can, review what you can't split, reconcile accounts monthly, require approval for payments and refunds, and verify any change to where money is sent.
This guide is for owners with anywhere from one to about 25 employees who trust their team but know that trust isn't a system. You'll get a practical list of controls sized for a small team, a way to put a dollar figure on the risk, and a monthly routine that takes less than an hour.
What counts as an internal control?
An internal control is any step that makes it harder for an error or theft to happen, or more likely that it gets caught quickly. Controls fall into two groups:
- Preventive controls stop a problem before it happens. Examples: requiring two approvals for large payments, limiting who can add a new vendor, locking the cash drawer.
- Detective controls catch a problem after the fact. Examples: monthly bank reconciliations, reviewing a report of refunds and voids, comparing payroll to the staff schedule.
Large companies lean on preventive controls because they can separate duties across departments. Small businesses usually can't, so they lean more on detective controls, reviewed by the owner. That's fine. A thief who knows the owner looks at every refund each Friday is far less likely to try.
Worked example: putting a dollar figure on a missing control
Owners often skip controls because the risk feels abstract. Here's how to make it concrete.
Imagine a hypothetical dental practice where one front-desk employee handles patient payments, issues refunds and posts adjustments in the practice software. Nobody reviews refunds. Suppose that person starts processing fake refunds of about $85, three times a week, to a card they control.
- Weekly loss: 3 × $85 = $255
- Annual loss: $255 × 52 = $13,260
- Revenue needed to replace it: if the practice keeps about 12% of revenue as profit, it would need $13,260 ÷ 0.12 = $110,500 in extra revenue to make up the loss.
Now look at the cost of the control that would catch it: the owner spends about 15 minutes every Friday reviewing a report of refunds and adjustments, checking a few against patient records. That's 15 × 52 = 780 minutes, or 13 hours a year. Thirteen hours to protect against a five-figure loss is one of the best trades a small business owner can make.
The same logic applies to any control. Estimate what could plausibly go wrong, how often, and what it would cost to catch. Most basic controls cost minutes, not money.
The core controls, sized for a small team
You don't need all of these on day one. Start with the first five, then add the rest as the team grows.
| Control | What it protects against | How to do it with a tiny team |
|---|---|---|
| Owner reviews bank and card statements monthly | Unauthorized payments, errors, forgotten subscriptions | Have statements sent to you directly. Scan every line, not just the total. |
| Monthly bank reconciliation, reviewed by someone other than the spender | Hidden theft, recording errors | If your bookkeeper reconciles, you review and sign off. See our bank reconciliation guide. |
| Approval thresholds for payments | Large unauthorized or mistaken payments | Anything above a set amount needs your approval, or two people's. |
| Verify any change to vendor bank details by phone | Fake invoice and payment-diversion scams | Call a number you already have on file, never one in the email requesting the change. |
| Weekly review of refunds, voids, discounts and write-offs | Fake refunds, sweetheart discounts, skimming | Run the exception report from your point-of-sale or billing software every week. |
| Daily cash count and same-day deposit | Cash going missing between sale and bank | Two people count when possible. Compare the deposit with the day's sales report. |
| Payroll register review before each run | Ghost employees, padded hours, rate changes | Compare names and hours with the schedule. Question any new name or changed rate. |
| Unique logins and role-based access | Untraceable changes, too-broad access | No shared passwords. Give each person only the access their job needs. |
| Lock closed accounting periods | Quiet edits to past records | Most accounting software has a closing date setting. Use it. |
| Cross-training and time off | Schemes that need constant hands-on concealment | Have someone else cover key money tasks for at least a week each year. |
When you can't separate duties
The textbook ideal is that no single person can start, approve, record and reconcile a transaction. With three employees, that's often impossible. The practical substitute is a compensating control: if one person does several steps, someone else, usually you, reviews the result on a regular schedule. The review has to actually happen and be visible, or it deters nothing.
A monthly controls routine in under an hour
Put this on your calendar for the first week of each month:
- Read the bank and credit card statements line by line. Circle anything you don't recognize. (15 minutes)
- Review and sign off on the bank reconciliation. Check that old outstanding items are being cleared. (10 minutes)
- Scan the vendor list for new vendors or changed bank details. Confirm each one was legitimate. (5 minutes)
- Compare payroll totals with last month and with the schedule. Question unexplained increases. (10 minutes)
- Review the month's refunds, voids and write-offs if you haven't been doing it weekly. Look for patterns by employee or customer. (10 minutes)
- Check who has access to banking, payroll and accounting. Remove anyone who has left or changed roles. (5 minutes)
Write down that you did it, even in a simple checklist. A visible, consistent review is itself a deterrent. Folding this into a regular monthly business review makes it harder to skip.
Common internal control mistakes
- Relying on trust alone. Most people are honest, but controls also catch innocent mistakes and protect honest employees from suspicion. Frame them that way to your team.
- Letting one long-time employee handle everything. The most dangerous setup is a trusted person who never takes vacation and does all the money tasks alone. Cross-train and require time off.
- Setting controls and never checking them. An approval rule nobody enforces is worse than none, because it creates false comfort. Spot-check that controls are actually followed.
- Changing payment details based on an email. Payment-diversion fraud depends on this. Our explainer on business email compromise walks through how these scams work.
- Sharing logins. If three people use the same account, you can't tell who did what. Unique logins cost little and make every other control more effective.
- Keeping controls in someone's head. Write them down as part of your standard operating procedures so they survive staff changes.
Where AI can help
AI tools are good at scanning exported data for patterns a busy owner would miss. You can export a year of payments, refunds or payroll and ask an assistant to flag duplicate invoice numbers, payments just under your approval threshold, vendors sharing a bank account or address with an employee, refunds concentrated on one staff member, or round-number transactions at odd hours. It can also draft a written controls policy from the list you choose.
Anything it flags is a question, not a conclusion. Many anomalies have innocent explanations, so verify quietly before raising concerns with anyone, and be careful about what employee or customer data you upload. If you do suspect fraud, speak with your accountant and an attorney before confronting anyone.
Frequently asked questions
What's the most important internal control for a very small business?
The owner personally reviewing bank and credit card statements every month. It costs nothing, takes minutes and catches a wide range of problems, from errors to fraud to forgotten subscriptions.
How do I introduce controls without offending my staff?
Present them as standard business practice that protects everyone, including employees who might otherwise be suspected if something goes wrong. Apply them evenly to everyone, including yourself, and explain the reason for each one.
What approval threshold should I set for payments?
Pick an amount that catches meaningful spending without making you approve every small purchase. Many owners start with a figure around the size of their largest routine bill and adjust after a few months based on how many approvals come through.
Do I need an audit to have good controls?
No. An audit tests controls and financial statements, but controls themselves are just habits you set up. A CPA can review your setup and suggest improvements without doing a full audit.
Key takeaways
- Internal controls are simple habits that prevent or catch errors and theft.
- When you can't separate duties, have the owner review the results on a regular schedule.
- Start with statement review, reconciliation, approval thresholds, vendor change verification and refund review.
- Put a dollar figure on the risk. Most controls cost minutes and protect thousands.
- Never change payment details based only on an email request.
- Write controls down, check that they're followed and require key staff to take time off.
Comments
Post a Comment