Internal Controls for Small Business: Practical Examples

What are internal controls?

Internal controls are the policies, procedures and habits a business uses to protect its assets, keep its records accurate, follow the rules and run reliably. They include things like requiring two people to approve a large payment, reconciling the bank account every month, or limiting who can change payroll details.

Internal controls are not only for large companies. A small business has fewer people and less oversight, which can make errors and fraud easier to miss. Simple controls help make up for that.

What do internal controls aim to achieve?

Common objectives, which echo widely used frameworks, are:

Reliable records. Financial information is accurate and timely.
Protecting assets. Cash, inventory, equipment and data are safeguarded.
Efficient operations. Processes are consistent and mistakes are caught.
Compliance. The business follows relevant laws, tax requirements and contracts.

What are the main types of internal control?

The most common way to group them is by when they act.

Preventive controls

These stop problems before they happen. Examples include approvals before purchases, passwords and access limits, and separating duties.

Detective controls

These find problems after they have occurred. Examples include bank reconciliations, reviewing exception reports and stock counts.

Corrective controls

These fix problems once found, such as correcting an entry, recovering funds, restoring data from backup or changing a procedure after an incident.

Some sources also add directive controls (such as written policies and training) or compensating controls (an alternative safeguard used when the ideal control is not practical). Lists of “four types” or “five components” vary by source, so check which framework you are following.

Practical examples for a small business

Cash and banking

Reconcile bank accounts monthly, ideally by someone who does not make payments. Keeping personal and business money apart, as explained in the business entity concept, also makes records easier to check.
Have the owner review the bank statement directly, at least occasionally.
Deposit takings promptly and keep cash in a secure place.
Require two signatures or two approvals for payments over a chosen amount, if you have enough people.

Payments and purchasing

Use purchase orders or written approvals for spending above a set limit.
Match invoices to orders and delivery records before paying.
Verify any change to a supplier’s bank details by calling a known number, since changed bank details are a common fraud method.
Keep a list of approved suppliers.

Sales and receivables

Issue numbered invoices and keep them in order.
Review overdue accounts regularly and follow up consistently.
Have someone other than the person taking payments approve credit notes and write-offs.

Payroll and staff

Have the owner or a manager approve payroll before it is paid.
Keep personnel and pay-rate changes documented and approved.
Check that everyone on the payroll is a current employee.

Inventory and equipment

Count stock periodically and compare it with records. (Cycle counting is one method.)
Keep a register of valuable equipment and who holds it.
Limit access to stock rooms and keys.

Technology and data

Use unique passwords and multi-factor authentication where available.
Give staff only the access they need for their jobs.
Back up important data and test that it can be restored.
Remove access promptly when someone leaves.

Separation of duties when you only have a few people

The ideal is that no one person handles a transaction from start to finish, for example approving, recording and paying. With a tiny team this is hard. Practical workarounds:

Have the owner review and sign off on key records.
Share tasks between two people so each checks the other’s work.
Use an outside bookkeeper or accountant to reconcile or review.
Use software settings that limit who can approve, edit or delete.

Where should you start?

Start with the areas where the most money and risk sit, usually cash, payments and payroll. Then:

List how money and information move through the business.
Identify where one person has unchecked control or where mistakes would be costly.
Add a simple check at each weak point.
Write the procedures down briefly and tell staff.
Review them at least yearly, and when the business changes.

Matching controls to the size of the risk avoids bureaucracy that slows work without adding protection. This approach is a small-scale version of the thinking in risk assessment.

Limits of internal controls

Controls reduce risk but cannot remove it. Collusion between employees, management overriding controls, and simple human error can all defeat them. This is why they work best alongside business continuity and risk management practices that prepare for problems that controls do not stop.

For specific accounting, tax or legal obligations, consult a qualified accountant or adviser, as requirements differ by location and business type.