Controller & CFOInternal Controls for Small Business: Fraud Prevention That Isn't Paranoid

Most offices have an honor-system snack box at some point. A basket of granola bars, a coffee can for dollar bills, and a sticky note that says "Thanks!" It works fine, mostly. Then one day someone notices the can feels light, and suddenly everyone is doing math about granola bars.

Nobody wants to run a business like that, suspicious of every coworker. The good news: internal controls are mostly routines that make mistakes easy to catch, and they happen to make fraud harder too.

This guide covers internal controls for small business that fit a team of five or fifty, without hiring a security guard for the snack box.

What are internal controls, in plain English?

Internal controls are the checks built into how money moves through your business. Who can add a vendor? Who approves a bill? Who sends the payment? Who looks at the bank statement afterward? Each answer is a control.

Their main job is catching errors: the duplicate payment, the invoice keyed in as $8,400 instead of $840, the deposit recorded twice. Preventing fraud is the second job, and the same routines handle both.

Segregation of duties for a small business

Segregation of duties means no single person handles a transaction from start to finish. In a big company, one person approves, another pays, a third records and a fourth reconciles.

A small business rarely has four people for that. So you split what you can and add owner review where you can't. Some practical splits:

1. The person who enters bills isn't the only person who can approve them.
2. The person who sends payments isn't the person who reconciles the bank account.
3. The owner, or someone outside the daily process, reviews the bank statement each month.
4. New vendors and changes to vendor bank details need a second person's sign-off.

If one bookkeeper truly does everything, the fix is review: the owner looks at the bank activity and a controller reviews the reconciliations. That's called a compensating control, a check that makes up for duties you can't separate.

A worked example: the vendor bank change

Imagine you run a 25-person landscaping supply company. Your bookkeeper gets a polite email from what looks like your largest supplier: "We've changed banks. Please update our details before paying invoice 4471 for $18,400." The logo looks right. The tone is right. The email address is one letter off.

Without a control, the bookkeeper updates the vendor record and the payment goes out. By the time the real supplier asks where their money is, it's gone.

With a simple control, the process looks different:

1. Any change to vendor payment details requires a phone call to a number already on file (not the number in the email).
2. A second person approves the change in the accounting system.
3. The first payment after a change is reviewed before release.

The phone call takes four minutes. The supplier says they haven't changed banks. The $18,400 stays where it belongs.

Notice what this control assumes: some outsiders are dishonest, and busy people click things. Nobody on your team is under suspicion.

A short internal controls checklist

Start with these. Most take an afternoon to set up:

• Turn on two-person approval for payments in your bank, if it offers it
• Limit who has admin access to the bank, payroll and accounting systems
• Have the owner review bank and credit card activity monthly
• Reconcile every balance sheet account monthly, from cash to loans
• Require a phone verification for any vendor bank change
• Review payroll changes (new hires, rate changes, terminations) before each run
• Keep a short list of approved vendors and review it twice a year
• Make sure everyone with financial access takes real time off, so someone else handles their work for a while

Reconciliation is the control that catches the most. Our guide to balance sheet reconciliation explains how it works account by account. Bills and payments are where most of the remaining risk lives, so our piece on accounts payable for small business covers approval flows that stop duplicate and fake payments.

How to prevent employee fraud without souring the culture

Tell people why. Controls feel less personal when everyone knows they protect the team too. Nobody wants to be the person who sent $18,400 to a scammer, and a phone-call rule means they won't be.

Apply controls to everyone, including longtime staff and family members. A control with exceptions isn't much of a control.

And review consistently, not dramatically. A monthly look at the bank statement is more useful than an annual audit-style panic.

Who should own internal controls?

In a small business, controls are typically designed and monitored by a controller. Our article on what a controller does in a small business covers that responsibility along with the monthly close. ABFI's controller services include setting up approval flows and reviewing reconciliations as part of a fractional accounting department, with duties split across bookkeeping and controller roles by design.