Effective Internal Controls for Very Small Businesses: Simple Controls That Actually Work

For a business with fewer than 20 employees, internal controls can feel unrealistic. There may not be an accounting department. One person may handle bookkeeping, deposits, bills, payroll, customer payments, and bank reconciliations. The owner may be busy selling, managing jobs, serving customers, and putting out daily fires.

But small size does not eliminate the need for controls. In fact, it usually makes controls more important.

The goal is not to build a big-company bureaucracy. The

goal is to create a few simple habits that protect cash, prevent avoidable mistakes, and make it harder for fraud or sloppy accounting to go unnoticed. For a very small business, the strongest internal control is active owner involvement.

Small businesses can overcome limited segregation of duties by using management oversight and informed review. In plain English, that means the owner or manager must regularly look at the money, ask questions, and not simply assume everything is fine.

Start With Cash

Cash is the first place to focus because most business activity eventually runs through the bank account. Every small business should have a written rule for who can approve spending, sign checks, initiate ACH payments, approve wires, and enter into contracts.

For a business under 20 employees, that policy can be simple:

The owner approves all new vendors, all large purchases, all contracts, and all electronic payments above a set dollar amount. No employee should be able to both set up a vendor and pay that vendor without review. No one person should be able to initiate and approve a wire transfer. If the business uses checks, blank checks should be locked up, and check numbers should be reviewed during the bank reconciliation.

The exact dollar limit depends on the business. For one company, $500 may be material. For another, $2,500 may be reasonable. The important thing is to set the rule in writing and follow it every time.

Banking controls are also worth using. ACH debit blocks or approved-vendor ACH controls can stop unauthorized electronic withdrawals. These tools are often inexpensive compared with the damage they can prevent.

Review the Bank Statement Yourself

In a very small business, the owner should personally review the bank activity every month. This does not mean the owner must do the bookkeeping. It means the owner should look at the bank statement, cancelled checks, ACH payments, wire transfers, payroll withdrawals, and unusual transactions.

The bank reconciliation should be prepared timely and reviewed by someone other than the person who handles deposits and payments. If there is no one else internally, the owner should review it. Better yet, an outside bookkeeper or CPA can reconcile the account, while the owner reviews the final report.

The review should not be a rubber stamp. The owner should ask:

Are there unfamiliar vendors?Are there round-dollar payments that look unusual?Are there transfers to unknown accounts?Does the ending cash balance make sense based on what happened during the month?

This is one of the simplest and most powerful controls a small business can have.

Separate Receiving Money From Recording Money

If customers pay by check, cash, credit card, ACH, or online payment, the business needs a way to confirm that money received actually gets deposited and recorded properly.

For a non-retail business, incoming checks should be logged when received. If possible, someone other than the bookkeeper should open the mail and list the checks. The deposit should later be compared to that list. If staffing is too limited, a bank lockbox or electronic payment system can reduce the risk by sending payments directly to the bank.

For a retail or service counter business, every sale should go through the register or point-of-sale system. Daily sales reports should be compared to cash, credit card deposits, and bank activity. Cash shortages should not be ignored.

Watch Accounts Receivable

If the business invoices customers, customer statements should be sent periodically. This is a simple control because customers will often report mistakes. If they paid and their statement still shows a balance, they will usually say something.

The owner or manager should also review the accounts receivable aging report each month. Old balances should be questioned. Credits, write-offs, and adjustments should require owner approval. This helps prevent an employee from hiding a diverted customer payment by writing off the customer’s balance.

Control Vendors and Bills

For accounts payable, the most important rule is this: do not pay vendors that have not been approved.

In a business under 20 employees, the owner should approve all new vendors. The owner should also periodically review the vendor list for names that do not belong. Fake vendors are a common way to steal from a business.

Bills should be paid only from original invoices or clearly verified electronic invoices. The person approving the invoice should confirm that the goods or services were actually received. Large payments should receive a second look before money leaves the bank.

Keep Payroll Tight

Payroll is often one of the largest expenses in a small business. The owner should review payroll before it is submitted, especially hours worked, overtime, bonuses, commissions, pay rates, and new employees.

No employee should be added to payroll without owner approval. This helps prevent “ghost employees” or unauthorized pay changes. Even when payroll is outsourced, the business owner is still responsible for reviewing what is being paid.

Review Financial Statements Monthly

Every month, the owner should review a basic financial package:

Profit and loss statementBalance sheetAccounts receivable aging, if applicableAccounts payable agingPayroll reportBudget-to-actual or month-to-month comparison

The purpose is not just tax compliance. The purpose is to spot problems while they are still small. If sales are up but cash is down, ask why. If margins changed, ask why. If expenses jumped, ask why. If receivables are growing faster than sales, ask why.

A small business owner does not need to be a CPA to ask good questions. But the owner does need to look.

Build a Culture Where Questions Are Welcome

Controls work best when employees understand that procedures exist to protect the business, not to create red tape. A small company should have basic written procedures for deposits, bill payments, payroll, customer credits, and vendor setup.

Employees should also feel comfortable telling the owner when something does not look right. Vendor complaints, customer balance disputes, unusual employee behavior, and unexplained delays should be taken seriously. In a small business, these are often the early warning signs.

Mandatory vacations are also useful. If one person handles the books and never takes time off, that is a risk. Someone else should perform that person’s duties while they are away. Fraud often depends on the same person being present every day to keep the scheme hidden.

The Bottom Line

A business with fewer than 10 employees does not need complicated controls. It needs practical controls that are actually followed.

The owner should approve important spending, review bank activity, control vendor setup, monitor payroll, review receivables, and look at financial statements every month. Duties should be separated where possible. Where they cannot be separated, owner oversight must fill the gap.

Small businesses are built on trust, but trust is not a control. Good controls protect honest employees, protect the owner, and protect the future of the business.

Scott C Turner, CPA

AccountingCompleted.com      

RecordsInOrder.com