Internal control

What it means

Internal control is the set of everyday measures meant to stop errors and fraud before they happen: approving spending, separating incompatible duties, reconciling balances, keeping asset records and limiting access.

At its core is a simple rule: whoever orders should not also approve, pay and post. A small company cannot separate everything, so the missing separation is replaced by review from the director or the external accountant.

Internal control should not be confused with an audit. An audit looks at the outcome afterwards and on a sample, while internal control is built into everyday work and forms part of corporate governance. Some measures prevent an error, such as approval before payment, others detect it later, such as a monthly reconciliation. A sound system needs both, because not everything can be stopped in advance.

How it works in practice

In practice it is a handful of routines: dual authorisation limits at the bank, reconciling the sub-ledger with partners, checking bank balances monthly, stocktaking assets and inventory, and looking at the audit log regularly.

The routines belong in writing as SOPs, not in someone’s head. In an inspection, an audit or an insurance claim, a documented process is what defends the company.

In a small company the external accounting firm is often the only second pair of eyes. When processing documents we point out what does not fit: a payment without an invoice, a duplicate invoice, a new supplier with no contract, round cash withdrawals with no cash voucher. It is not suspicion of anyone, just a way of making sure someone asks about an unusual item in time.

What to watch out for

The biggest gap in small companies is payments: one person has access to the bank, to the invoices and to supplier details. Changing a bank account number on an invoice is the commonest fraud, and the defence is verifying the change by phone with a known contact.

A control that exists only in a policy is worse than none, because it creates a false sense of security. The typical case is a director who signs a whole stack of invoices at once without looking at them, or a limit that is bypassed when a payment is urgent. After a loss or a tax inspection it then turns out the procedure was written down but nobody followed it.