What Are Internal Controls for a Small Business?
Internal controls are the simple checks and routines that protect your money and keep your records accurate. They include who can approve payments, who reconciles the bank account, and who reviews the monthly reports. In a small business, a few well-chosen controls help prevent mistakes and make misuse harder.
What are internal controls?
An internal control is any step built into how you handle money that reduces the chance of error or misuse. Nothing about it needs to be complicated. Asking a second person to look at a large payment before it goes out is an internal control. So is comparing your books to the bank statement every month.
Controls matter because small businesses often have few people handling a lot of trust. One person might enter bills, pay them, and reconcile the bank. That is efficient, and it is also the setup where errors and misuse can go unnoticed.
What are the main types of internal controls?
| Type | What it does | Small business example |
|---|---|---|
| Preventive | Stops a problem before it happens | Payments above an agreed amount need a second approval |
| Detective | Finds a problem after it happens | Monthly bank reconciliation, review of unusual items |
| Corrective | Fixes a problem and prevents a repeat | Correcting an error and changing the process that caused it |
What is segregation of duties?
Segregation of duties means no single person controls a whole transaction from start to finish. The person who approves a bill is not the person who pays it. The person who handles cash is not the person who reconciles the account.
In a very small team you cannot always separate everything. When you cannot, add a review step, such as the owner looking at the bank statement and the list of payments each month. That is a substitute control.
What internal controls should a small business have?
A starter list that fits many small businesses:
- Separate roles where you can. Entering, approving, paying and reconciling should not all sit with one person.
- Approval limits. Set an amount above which a second person approves.
- Bank reconciliation every month. Done by someone other than the person who writes the checks, if possible.
- Owner review of bank statements. Read the actual statements, not only the reports.
- Vendor setup checks. A second look before adding a new vendor or changing bank details on an existing one.
- Limits on who can use company cards. Review statements and receipts monthly.
- Payroll review. Check payroll lists for names and amounts that should not be there.
- Restricted access. Give each person only the accounting-system access they need, and remove it when they leave.
- Locked periods. Lock closed months so old numbers cannot be changed unseen. The month-end close checklist shows where that fits.
- Written steps. A short note on how things are done, so it does not depend on one person's memory.
Is there a small business internal controls checklist?
Use this as a yes/no review. Each "no" is a gap to look at, not an emergency.
| Self-check question | Yes / No |
|---|---|
| Does someone other than the payer reconcile the bank account? | |
| Is there a second approval for large payments? | |
| Does the owner read the bank statements each month? | |
| Are new vendors and changed bank details checked by a second person? | |
| Are months locked after close? | |
| Is accounting-system access limited and reviewed? | |
| Are company card receipts reviewed monthly? | |
| Are processes written down? |
Who sets up internal controls?
The owner is ultimately accountable for the business's finances. In practice the work often falls to a controller, because designing and checking controls is part of that role. Our fractional controller service includes internal controls and process improvement, along with bookkeeping oversight, receivables and payables oversight, and cash management. See what a fractional controller is and how it differs from the CFO role.
A bookkeeper does the recording; a controller reviews it and builds the checks. The bookkeeper vs accountant vs controller guide explains the split. If you want to know what that costs, see how much a fractional controller costs and our pricing.
Can internal controls stop every problem?
No. Controls reduce risk. They do not remove it, and a determined person working together with others can get around them. What they do well is catch honest mistakes quickly and make misuse harder and easier to spot.
When are formal internal controls not worth it?
If you run a one-person business with few transactions, heavy controls may cost more time than they save. A monthly bank reconciliation and a habit of reading your statements may be a reasonable starting point. As you add staff, cards, payroll and vendors, the case for more controls grows.
We do not prepare tax returns, audit or give investment advice, and we work alongside your CPA or tax professional. This is general information, not legal or tax advice.
Need this done for you? See our Fractional Financial Controller service, or pricing. English Oak Financial does not prepare tax returns, perform audits or give investment advice. This guide is general information, not tax, legal or investment advice.
Related pages
Common questions
What are internal controls in simple terms?
They are the checks built into how you handle money so mistakes and misuse are less likely and get caught sooner.
What are the three common types of internal controls?
Preventive controls stop problems, detective controls find them, and corrective controls fix them and stop a repeat.
What internal controls does a very small business need?
At minimum: a monthly bank reconciliation, owner review of bank statements, approval for larger payments, and limited access to the accounting system and bank accounts.
What is the difference between internal controls and an audit?
Internal controls are your own day-to-day safeguards. An audit is an independent examination of financial statements. We do not perform audits.
Who should review the books?
Someone other than the person who records them. In a small business that is often the owner or a controller.
Talk it through with us
Schedule a free introductory consultation. No surprise bills. No unnecessary services.
Schedule Consultation