Internal controls for a growing company: the few that keep the numbers clean and cash safe

Controls are habits that protect cash and make the numbers believable

The internal controls a growing company needs first are clear approval limits for spending and payments, a separation between the people who record transactions and the people who move money, monthly reconciliation of every bank and balance sheet account, a verified process for any change to vendor bank details, and a dependable month-end close with a review by someone senior. These few routines prevent most errors and most fraud, and they are what make your financial statements credible to a bank, an investor or a buyer.

I have built procedures and internal controls with finance teams in startups, private equity-backed firms and multinationals, and on interim engagements it is usually the second thing I do, right after stabilizing cash. As a partner at ECFO I work with companies in Dallas and elsewhere, and the point I make to every owner is that controls are not about distrust. They protect your people as much as your money, because clear procedures mean nobody is left carrying a risk alone.

Why controls slip as a company grows

In a small company the owner sees everything. Every invoice crosses the desk, every payment is familiar, and errors are caught because the owner knows what the numbers should look like. Growth breaks that. There are more transactions, more people, more vendors and more systems, and the owner can no longer see it all. Yet the processes often stay exactly as they were when the company was a fraction of its size.

The result is predictable: one person who orders, receives, records and pays; bank accounts reconciled when someone has time; payments approved by email with no record; and month-end numbers that change every time someone looks at them. None of this requires dishonesty to go wrong. Ordinary mistakes compound when nobody is checking.

Signs your controls have fallen behind the business

You can usually tell from the outside whether controls are keeping up. The signs are rarely dramatic. They are small frictions that everyone has learned to live with: a reconciliation that is always a month late, a supplier who was paid twice and had to be chased for a refund, a report that gives a different answer each time it is run. Each one is minor on its own. Together they mean the numbers cannot be relied on, and that the company would struggle to spot a real problem quickly.

Outside parties notice too. A bank that starts asking for more frequent reporting, or for reviewed or audited statements, is often reacting to the same signals. An auditor explains what that request involves in what happens when the bank asks for audited financials, and much of that work goes more smoothly when the routines below are already in place.

• One person can set up a vendor, approve its invoice and release the payment.
• Bank accounts are reconciled irregularly or only at year-end.
• Former employees still have system or banking access.
• Month-end numbers change after they have been shared.
• Nobody can say quickly who approved a particular payment.

Approval limits that fit how you actually operate

Every company should have a written list of who can commit the company to spending, up to what amount, and who must approve above that. It does not need to be complex. It needs to be clear, followed and updated when roles change. The same applies to payments: who can release a payment, and at what level a second approval is required.

Approvals work best when they are built into the system rather than remembered. Most accounting and ERP systems can enforce approval workflows on purchase orders, bills and payments, which leaves a record and removes arguments about who agreed to what.

Set the limits at levels that let people do their jobs. If every small purchase needs the owner, approvals become a bottleneck and people start working around them, which is worse than having no rule at all. Review the thresholds once a year as the business grows.

• A written approval matrix for purchases, contracts and payments.
• A second approval for payments above a set level.
• Approvals recorded in the system, not in scattered emails.
• Signatory and online banking access updated whenever someone joins or leaves.
• Owner review of payments to new vendors.

Separating duties when you only have a small team

Segregation of duties means that no single person controls a transaction from start to finish. The person who sets up a vendor should not be the person who pays it; the person who records customer receipts should not be the person who reconciles the bank account. In a large company this is easy. In a small finance team of one or two people, it takes some creativity.

When full separation is impossible, compensate with review. The owner or a senior manager can review the bank statement directly each month, approve new vendors, look at a payment register before release and receive the reconciliation for sign-off. These steps take little time and close most of the gaps that a small team cannot.

Reconciliations: the control that catches everything else

If I could install only one control, it would be a monthly reconciliation of every balance sheet account, reviewed by someone other than the person who prepared it. Reconciling the bank accounts, credit cards, loans, receivables, payables and inventory to outside evidence catches duplicate payments, missed invoices, posting errors and theft, usually within weeks rather than years.

Reconciliations also make every other part of finance faster. Forecasts built on reconciled balances are reliable. Audits and due diligence move quickly. And when a lender or buyer asks how a number was produced, the answer is already documented.

• Bank and credit card accounts reconciled monthly to statements.
• Loan balances reconciled to lender statements.
• Receivables and payables subledgers tied to the general ledger.
• Inventory counted and reconciled on a regular schedule.
• Each reconciliation signed off by a reviewer, with unexplained items followed up.

Vendor bank changes and payment fraud

One of the most common ways companies lose money today is a simple request to change where a payment goes. An email that appears to come from a known vendor, or from the owner, asks for an invoice to be paid to a new account. The FBI's Internet Crime Complaint Center advises verifying all payment changes and transactions in person or via a known telephone number. In practice, that means calling the vendor on a number you already have on file, never the number in the email asking for the change.

Make this a written rule with no exceptions, including for requests that appear to come from senior management. Combine it with a short hold on the first payment to any new or changed bank account, and require a second person to approve the change in the system. These steps cost almost nothing and stop a type of loss that is very hard to recover.

A month-end close you can rely on

A dependable close is itself a control. When the books are closed on a fixed schedule with a checklist, reconciled and reviewed, errors surface while they are still small and recent. When the close is late and improvised, problems hide for months. I aim for a close calendar that every member of the finance team knows, with named owners for each step and a senior review of the final statements.

The close should include the recurring tax obligations as well, so that payroll deposits, sales tax and the franchise tax report are never missed; my guide to building Texas taxes into the finance calendar covers that rhythm. If the close is slow because data moves between disconnected tools, the process or the system may need work, which I discuss in outgrowing QuickBooks.

Writing it down: procedures that outlast any one person

Controls that live only in someone's head disappear when that person leaves or goes on vacation. Short written procedures for the core processes, such as paying bills, invoicing, payroll, the close and vendor setup, are what make the controls stick. They also make training faster and give an auditor or buyer confidence that the company runs the same way regardless of who is in the seat.

Keep procedures short and practical. A one-page checklist that people actually use is worth more than a binder nobody opens. Review them once a year, or whenever a system or role changes.

• Procure to pay: ordering, receiving, approving and paying.
• Order to cash: quoting, invoicing, collecting and applying receipts.
• Payroll: changes, approvals, processing and tax deposits.
• Month-end close: checklist, reconciliations and review.
• Vendor and customer master data: setup and changes.

Getting help to set it up

Most owners know their controls are thin; the hard part is finding the time to fix them while running the business. This is a common reason companies bring in a fractional or interim CFO: to design the controls with the existing team, write the procedures, set up approval workflows in the system and make sure the routine is running before stepping back. If you are considering that kind of help, my guide on questions to ask before hiring a fractional CFO will help you find the right person.

If you would like a second set of eyes on how your company's controls work today, I am glad to help. I work with companies across the Dallas–Fort Worth area and remotely, including companies with finance teams in more than one country, where consistent controls across regions matter even more.

Questions people ask me