Internal controls are the policies, procedures, and structural separations that protect a business from error, fraud, and asset loss. In a Fortune 500 company they are formal, documented, audited, and extensive. In a small business they need to be lighter, but not absent. The absence of internal controls is the most common factor in small-business fraud cases, and the Association of Certified Fraud Examiners reports small businesses lose more per incident than large ones because they have fewer detective controls in place.
The challenge for small businesses is designing controls that add protection without adding bureaucracy that crushes operations. The answer is rarely "implement every control a public company has" and never "have no controls at all." It is a small set of high-leverage controls, the ones that block the most common fraud patterns and catch the most common errors, without elaborate documentation or approval chains that slow real work. Most small businesses can install meaningful control with 3–5 structural changes and a handful of routine review habits.
The Three Types of Controls
Not all controls are equal. Understanding the types helps focus attention on the right ones.
| Control Type | What It Does | Example |
|---|---|---|
| Preventive | Stops errors or fraud before they happen | Requiring two signatures on large checks |
| Detective | Catches errors or fraud after they happen | Monthly reconciliation finding unexplained entries |
| Corrective | Fixes and improves after a problem is found | Updated procedures following a reconciliation surprise |
Segregation of Duties: The Foundational Control
The single most important control in small business is segregation of duties, separating the activities that, when combined in one person, enable fraud.
Who Approves vs. Who Executes
The person who approves a payment should not be the same person who cuts the check. The person who approves an expense report should not be the same person who reimburses it. This single separation prevents the majority of occupational fraud patterns.
Who Records vs. Who Handles Assets
The person who records transactions (bookkeeping) should not be the same person who handles the assets (cash, checks). Combining these allows someone to take and simultaneously hide what they took.
Who Authorizes vs. Who Reconciles
The person who authorizes transactions should not be the same person who reconciles the accounts they flow through. If the same person does both, there's no independent check on what's been authorized vs. what's actually happening.
When You Can't Fully Segregate, Compensate
In a business with 2–3 employees, full segregation isn't always possible. The compensating control is owner review, the owner personally reviews bank statements, signs large checks, or reviews the full AP register monthly. Owner involvement in review is the small-business substitute for segregation.
The High-Leverage Controls
Beyond segregation, certain specific controls catch or prevent the most common small-business loss patterns.
(1) Owner reviews and signs all checks over a threshold (e.g., $2,500). (2) Owner receives bank statements and credit card statements directly (not through the bookkeeper). (3) Bank and credit card reconciliations are reviewed by someone other than who prepared them. (4) New vendor setup requires documented approval; changes to vendor bank details require phone verification. (5) Monthly financial review includes AP aging, AR aging, and variance analysis against budget. (6) Annual review of user access to financial systems. (7) Background checks on anyone handling cash or financial records. These seven controls prevent the most common small-business fraud and error patterns while requiring modest effort.
What the Controls Prevent
Controls target specific fraud and error patterns. Knowing the patterns makes the controls make sense.
Common Small Business Fraud Patterns
- Check tampering, altering payee or amount on legitimate checks
- Phantom vendor, fake vendor set up by an employee; invoices paid to employee
- Billing schemes, employee bills the business for personal purchases
- Payroll fraud, ghost employees or falsified hours
- Expense reimbursement fraud, falsified or inflated expense reports
- Cash skimming, cash received not recorded
- Check forgery or altered endorsements
Controls That Prevent Them
- Check signing review and bank statement review by owner
- Vendor approval and regular vendor list review
- Invoice approval by someone other than preparer
- Payroll review against actual employees and timecards
- Receipt requirement and supervisor approval on reimbursements
- Bank reconciliation, daily cash deposits, and cash handling segregation
- Dual signatures and bank positive-pay services where available
Documentation That Enables Controls
Controls work only when documentation supports them. The documentation itself is brief.
- Written policy on check signing authority and thresholds
- Written vendor setup and change procedure
- Written expense approval policy
- User access list for financial systems (reviewed annually)
- Documented segregation of duties in writing (roles and responsibilities)
- Written hiring procedures including background check requirements for financial positions
- Insurance coverage review, employee dishonesty bond or fidelity coverage
Internal controls in a small business don't need to be complex; they need to be thoughtful. A handful of specific controls, owner review of bank statements, segregation of approval from execution, vendor setup controls, and monthly reconciliation, prevent the majority of fraud and catch the majority of errors that harm small businesses. The cost is measured in minutes per month, not hours per day. The cost of not having them is measured in the median $150,000 loss per small-business fraud incident. The math favors installing controls; most businesses that experience fraud reflect afterward that the controls they needed were obvious in hindsight.
The single easiest control to install is having the bank statement go to the owner's personal email or home address rather than the bookkeeper. Opening and reviewing the statement yourself, even a quick scan for unfamiliar payees, unusual amounts, and expected deposits, is a 5-minute monthly habit that catches the most common fraud and error patterns. If the bookkeeper is trustworthy, this costs nothing. If the bookkeeper isn't, it's likely to catch the issue before material loss occurs.
Frequently Asked Questions
Yes. Controls protect trustworthy people as much as they catch untrustworthy ones. A bookkeeper with no one reviewing their work is a bookkeeper who, when an error occurs, has no backup to catch it. Controls are not a statement of distrust; they're a structural protection that benefits everyone.
Segregation is less achievable but not irrelevant. Use the bank and the software as your separator, bank statements and reconciliations still provide independent confirmation of what the business records say. An outside CPA reviewing books quarterly is another compensating control. Insurance (crime and errors-and-omissions coverage) is another.
Annually. Review who has access to what systems, who is authorized to sign what, and whether your controls still match your current operations. Businesses grow and roles shift; controls that made sense two years ago may have gaps now.
Employee dishonesty coverage (sometimes called a fidelity bond) is specific to this exposure. It's typically affordable, a few hundred to few thousand dollars per year depending on coverage limits, and a reasonable supplement to internal controls. It does not replace controls; it complements them.
Sources
- SMAART Company. Small Business Internal Controls Frameworks, 2026.
- Association of Certified Fraud Examiners. Report to the Nations, 2024 Global Study on Occupational Fraud. acfe.com
- Committee of Sponsoring Organizations of the Treadway Commission. Internal Control, Integrated Framework, 2013. coso.org
- American Institute of Certified Public Accountants. Small Business Internal Control Considerations, 2025. aicpa.org
Discussion
Comments
Leave a comment