Most business owners do not wake up one morning and decide to commission an internal audit. They spot something small first: a report that arrives late, a figure that will not reconcile, a supplier who insists an invoice was already settled. Individually these look like noise. Together they usually mean the controls around your money have loosened.
The signs we see most often
- Reports arrive weeks after the period they cover, too late to act on
- The same person raises the invoice, receives the payment, and updates the ledger
- Variances get explained verbally, with nothing written down to trace later
- Bank reconciliations are behind, or nobody is sure when the last one was done
- Stock, cash, and fixed assets have never been counted against the records
- Filings and remittances happen at the last minute, or after a regulator's reminder
- Growth has outpaced the systems that worked when the team was a quarter of the size
None of these on its own proves anything is wrong. Two or three together usually mean the business is carrying a weakness it cannot see.
This is not about catching people out
A structure where one person controls a whole cycle is not an accusation about that person. It is simply a structure with nothing in it to catch an honest mistake. It also leaves that employee exposed, because any shortfall points at them by default.
If a number cannot be traced back to a document, it cannot be defended to a lender, an auditor, or a tax authority.
What a review actually involves
An internal audit does not have to mean months of disruption. In most cases we start with a focused review of the areas carrying the most risk, agree what needs to change, and hand you a short list of practical fixes in priority order.
If two or three of these signs sound familiar, get in touch and we will talk through what a review would cover for your business.
