Internal controls sound like something only large corporates need. They are really just the everyday rules that make it hard for money to leave your business by accident, and easy to prove where it went.
What a control actually does
A control does three things. It reduces the chance of an error, it increases the chance that an error is caught quickly, and it leaves a trail so anyone reviewing the business later can follow what happened. None of that requires software or a compliance department.
The controls that matter most in a small business
- Separate the person who approves a payment from the person who makes it
- Require a second signature above an agreed amount
- Reconcile the bank weekly rather than monthly
- Keep a fixed asset register and count against it once a year
- Give every staff member their own login instead of sharing one
Controls protect your people too
When one person handles everything, any shortfall points at them, whether or not they had anything to do with it. A clear separation of duties is as much a protection for a trusted employee as it is for the business.
A control is not a statement about trust. It is a structure that means nobody has to be trusted alone.
But we do not have the staff for this
That is the common objection, and in practice you rarely need more people. You usually need a different arrangement of the ones you have, plus an outside professional for the parts that genuinely need independence. That is often where we come in: reviewing the current setup, finding the two or three places where the risk actually sits, and building controls your team will follow rather than work around.
If you are not sure which controls your business is missing, that is a good reason to have the conversation.
