Internal Control for Small Business: Practical Controls When Segregation of Duties Is Thin

Internal control frameworks were written for large organizations, and a business with one bookkeeper and an owner cannot copy them. The principles still apply, scaled to what a small team can do. The most common failure in small companies is not an exotic scheme. It is one person who enters bills, signs checks and reconciles the bank account. This article lays out controls a CPA firm can recommend and test at a small client. For the framework behind them, see COSO internal control framework and the glossary entries on segregation of duties and compensating control.

The framework in one paragraph

COSO states that internal controls have value beyond compliance and external financial reporting, and its 2013 framework has five components and 17 principles: control environment, risk assessment, control activities, information and communication, and monitoring activities. For a small business, the components map to concrete habits: the owner sets expectations and behaves accordingly, someone asks what could go wrong, a small set of key controls runs on schedule, information moves to those who need it and someone checks that the controls actually ran.

Start with the owner's role

In a small company, the owner is the main control. Owner-performed review is more effective than a complex system nobody follows. The owner should:

• Review the bank statement and canceled checks or payment detail directly from the bank's website, not from a copy the bookkeeper prints.
• Approve new vendors and changes to vendor bank details.
• Review the payroll register each pay period, including new employees and rate changes.
• Review the monthly financial statements against expectations, and ask about unexplained differences.
• Control who has signing authority and who has online banking credentials.

Each review should leave a trace: a signature, initials, a date or an email.

Cash receipts

• Someone other than the person who records receipts opens the mail or reviews the deposit report.
• Deposits are made intact and promptly, and daily deposits agree to the receipt records.
• Credit memos, write-offs and discounts need the owner's approval.
• Customer statements go out monthly, and customer complaints about balances route to the owner, not to the bookkeeper alone.

Cash disbursements and payables

• A purchase order or approved request exists before the purchase.
• The person who approves a bill is not the person who enters it or signs the payment.
• Bank details for vendors are verified by a call-back to a known number before they change.
• Checks and payments are not made to cash, and blank checks are locked up.
• The vendor master file is reviewed for duplicates, employee addresses and vendors without activity.
• Payment runs are reviewed by the owner against the approved bills before release.

Payroll

• New hires and rate changes need written approval from the owner.
• The payroll register is compared with the previous period and with the employee list.
• Payroll is paid by direct deposit to accounts in the employee's name, and changes to bank details are verified.
• Payroll liabilities are reconciled to deposits and returns. See payroll tax deposits.

Bank reconciliation

The bank reconciliation is one of the most useful controls in a small business, and its value depends on who does it and who reviews it. The person who reconciles should not be able to record cash transactions or sign checks. If that cannot be arranged, the owner reviews each reconciliation, with the statement, within a set number of days after month end. See bank reconciliation and deposits in transit and outstanding checks.

Compensating controls when duties cannot be separated

When one person has to do incompatible tasks, add compensating controls:

Information technology controls

• Individual user accounts with no shared passwords.
• Multi-factor authentication on banking, payroll and the accounting system.
• Role-based access in the accounting software, with the owner as the only person who can change access.
• The audit log is turned on and reviewed for edits to closed periods and deleted transactions.
• Backups are tested.

See IT general controls and risk and control matrix guide for a way to map conflicts.

A control calendar

What the auditor looks for

Auditors evaluate the design of controls and whether they were implemented, and they test operation where they plan to rely on controls. For a small client, evidence of owner review is often the main control evidence. If reviews leave no trace, the auditor cannot rely on them. See control environment assessment and internal control questionnaire and walkthroughs.

FAQ

Do small businesses need all five COSO components?

The components are all present in an effective system, scaled to size.

Which control matters most for a small business?

An independently reviewed monthly bank reconciliation, where the reviewer looks at bank-sourced statements, is among the most valuable, because it tests the cash records against an outside source.

Who tests the controls?

The firm can test controls as a service. For an audit client, independence rules apply to design and operating assistance.

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

Sources

• COSO, Internal Control: https://www.coso.org/internal-control
• AICPA and CIMA, COSO Internal Control Integrated Framework: https://www.aicpa-cima.com/resources/landing/coso-internal-control-integrated-framework
• COSO, Fraud Deterrence and the Fraud Risk Management Guide, Second Edition: https://www.coso.org/frauddeterrence

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error