Internal Controls for Small Businesses: Closing the Leaks

The largest financial losses I have seen in small companies were not the product of clever schemes. They were the product of a few simple controls that were never put in place. This article is for owners and managers of small businesses, and it explains how to build a structure that reduces error and closes opportunity even with a very small team.

Why small businesses are more exposed

Three factors usually appear together: pressure on an individual, opportunity created by missing controls, and rationalisation ("I am only borrowing it"). Of the three, the only one management can directly control is opportunity.

Small companies are weak at precisely that point: one person raises the invoice, collects the money, records the entry and prepares the bank reconciliation. High trust makes it worse. In the files I have handled, the person involved was almost always the longest-serving and most trusted member of staff. This is not an argument for suspicion — internal control does not replace trust, it protects it.

Five places money leaves the business

The first principle: segregation of duties

Four functions should never sit with the same person: authorising a purchase, discount or payment; custody of cash, cheques and goods; recording the transaction; and reviewing through reconciliation and independent checks.

If all of these currently sit with one person, remove at least one. The smallest effective change is usually to take bank signing authority and payment credentials away from the bookkeeper.

Compensating controls for very small teams

1. The owner receives and reviews bank statements monthly, directly from the bank.
2. Payments above a set threshold require the owner's signature.
3. Reconciliations are prepared by someone other than the person recording entries, and signed off by the owner.
4. Finance staff take mandatory annual leave, with duties handed to a substitute.
5. Inventory counts are performed by someone outside the warehouse.
6. New suppliers are reviewed periodically by the owner.
7. An independent external accountant reviews the books quarterly.

Point four looks trivial and is unusually effective. Many schemes only surface when the person is away for a few days and someone else does the work.

Cash, purchasing, inventory and payroll

Cash carries the highest risk because it leaves no trail. Close the till daily and reconcile the balance to a physical count, match card settlements to system sales reports daily, run petty cash on an imprest basis with a fixed ceiling and settlement against supporting documents, and bank receipts by the next working day at the latest. Personal card readers have no place in a business. The mechanics are covered in cash and petty cash control.

Purchasing is where the largest amounts leave. Establish the classic three-way match — purchase request, goods receipt, invoice — and pay only after all three agree. Require at least two quotations above a set value, review the supplier list periodically for addresses that match employee addresses or vendors known to only one person, and configure the system to reject duplicate invoice numbers. The same documentation standard is what a tax assessment requires, as described in proper accounting documentation.

Inventory should never leave without an issue note, and counts should be part of the monthly routine rather than a year-end event. Recurring shortages and above-normal wastage should be investigated, not absorbed through adjusting entries. The counting procedure is set out in year-end stock counting.

Payroll should be matched to the insurance filings and employment contracts. Pay by bank transfer to the individual from the company account, never in cash, and require independent approval for overtime.

Warning signs

• Margins falling with no change in prices or input costs
• Small but persistent cash or inventory shortages
• A high volume of adjusting entries at period end
• Bank reconciliations chronically late
• A new supplier taking a large share of purchases quickly
• Customer balances that constantly move but never clear
• A lifestyle out of proportion to salary in someone with financial access

None of these proves anything alone, but two or three together deserve investigation.

If you discover fraud

1. Restrict the person's access to systems, accounts and records before any confrontation.
2. Secure backups of the data and related documentation.
3. Establish the scope with an independent, neutral person.
4. Assess the financial and tax consequences of the corrections required in the books.
5. Decide on the disciplinary or legal route once the facts are clear.
6. Fix the control weakness that made it possible.

Step six is the one most often skipped. If the structural gap stays open, replacing the individual only changes who walks through it.

If you would like an internal control structure designed around your actual headcount and transaction volume, that usually starts with a short on-site review.

Key takeaways

• Opportunity is the only side of the fraud triangle management can control.
• Authorisation, custody, recording and review should never sit with one person.
• Small teams substitute compensating controls: owner review, reconciliation by a second person, mandatory leave.
• The three-way match is the single most effective purchasing control.
• After a fraud, fixing the structural weakness matters more than replacing the person.