Internal Controls

Learn It

An internal control is any process, rule, or safeguard that reduces the chance something goes wrong with the business's money or records. Controls exist because people make mistakes, and sometimes people are dishonest.

A control does not guarantee that nothing will go wrong. It reduces risk and makes problems easier to detect. That distinction matters. No system is perfect. The goal is to make it hard for errors or fraud to happen and easy to catch them when they do.

Prevention vs. Detection

Preventive controls stop a problem before it happens. Requiring approval before a payment is sent is a preventive control — the payment cannot go out until someone checks it.

Detective controls find a problem after it happens. A bank reconciliation is a detective control — it catches missing transactions or wrong amounts after they are recorded. Most businesses use both types together.

Separation of Duties

The most important control in bookkeeping is separation of duties. This means the person who records a transaction should not be the only person who approves it, pays it, or reconciles it. When one person controls every step, that person can create a fake transaction, approve it, pay it, and then hide the evidence.

The key duties to separate are:

• • Enter — recording the transaction or bill
• • Approve — authorizing the payment or entry
• • Pay — sending the money
• • Reconcile — matching the books to the bank
• • Review — an independent check of the results

When Separation Is Not Possible

Many small businesses have only one or two people. Full separation of duties is simply not possible. That does not mean you give up on controls. Instead, you use compensating controls — smaller checks that reduce risk when full separation is impossible.

Examples of compensating controls:

• • The owner reviews the bank statement each month before the bookkeeper reconciles
• • The owner approves payments above a certain dollar amount
• • An outside accountant reviews the books quarterly
• • The owner reviews exception reports for unusual transactions

Other Common Controls

• • Bank access: limit who can initiate transfers or sign checks
• • User permissions: give each user only the access they need in the accounting system
• • Check controls: lock up blank checks, restrict signature stamps, require dual signatures for large amounts
• • Vendor controls: require approval before a new vendor is added; verify vendor addresses
• • Customer refund controls: require approval before a refund is issued
• • Payroll controls: someone other than the person running payroll should review the payroll register
• • Documentation: keep supporting documents for every transaction so there is an audit trail
• • Three-way matching: match the purchase order, the receiving report, and the vendor invoice before paying a bill — see Accounts Payable

Reconciliations are themselves a control. When you reconcile the bank, the credit card, and loan accounts each month, you are running a detective control that catches errors and missing transactions. That is why reconciliation matters beyond just making the numbers match.

See It

Imagine a small business where one employee — let's call her Jan — can do all of the following:

Jan is hardworking and honest. But this setup is dangerous. If Jan ever made a mistake — or if she were not honest — she could create a fake vendor, enter a bill, approve it, pay it, and then reconcile the bank to hide the payment. No one would catch it because no one else is checking.

A better control structure separates the duties:

Now Jan cannot create and hide a fraudulent payment on her own. The owner is the independent check. This is separation of duties in action.

What if the business is too small for that? If Jan is the only employee, the owner can still add compensating controls: review the bank statement each month, approve any payment over $500, and have an outside accountant review the books quarterly. These do not fully replace separation, but they make it much harder for a problem to go unnoticed.

Do It

Review each situation below. Identify the duties that should be separated or assigned, and where separation is not possible, enter a compensating control.

Prove It

Answer each question, then read the explanation. There's no score — this is just to help the ideas stick.

Key Takeaways