Financial controls a small business actually needs

What a control is, and what it is not

A financial control is a step in a process that makes it materially harder for money or goods to leave the business without someone noticing. That is the whole definition. It is not a policy document, it is not a signature on a form nobody reads, and it is not a piece of software. Controls live inside how work is actually done, which is why the ones written in a manual and never performed provide no protection at all while creating a comfortable illusion that they do.

Small businesses are more exposed than large ones for a structural reason. Control depends heavily on more than one person being involved in a transaction, and a business with four people in the office cannot separate every duty. It is also the environment where losses hurt most, because there is no reserve to absorb them and the person best placed to take money is usually the person the owner trusts most. Trust is not a control. It is what makes controls feel unnecessary right up until they were needed.

The other reason controls matter is less dramatic than fraud and far more common: error. Duplicate payments, invoices never raised, stock delivered and never billed, credit notes issued twice, an entry posted to the wrong period. None of that is dishonest and all of it costs real money. A good control system catches both, and most of what it catches will be mistakes.

The aim is not to eliminate risk. It is to make the loss from any single failure small, and to make it visible quickly. A control that would prevent every possible problem is usually a control that stops the business functioning, and it will be worked around within a month.

The four places money actually leaves

Rather than starting from a list of best practices, start from where losses in small businesses actually occur. There are four, and if your controls cover these you have most of the value of a much larger framework.

Notice how many of those involve a bank detail change or a document that nobody matched to anything. Two controls, verifying changes to payment details through a channel you already had, and matching every payment to a purchase order and a goods receipt, cover a large proportion of the total risk. If you only ever implement two things, implement those.

• Outgoing payments. Payments to suppliers who do not exist, to real suppliers for goods never received, to changed bank details, or the same invoice paid twice.
• Incoming cash and receipts. Cash sales not rung up, customer payments diverted, credit notes and refunds issued to cover a shortfall.
• Inventory and assets. Goods walking out, deliveries short-received and signed for anyway, write-offs used to conceal earlier losses.
• Payroll. Staff who have left still being paid, hours or overtime inflated, changed bank details on an employee record.

Segregation of duties when you only have four people

The textbook rule is that no one person should control a transaction from start to finish: the person who authorises should not be the person who executes, who should not be the person who records, who should not be the person who holds the asset. In a business with four office staff, applying that rule strictly is impossible, so the useful question is not how to achieve full segregation but which specific combinations are dangerous enough to break up.

Three combinations do most of the damage. First, one person who can both set up a supplier and pay it: that person can create a payee and send money to it. Second, one person who both receives customer payments and posts them to the sales ledger: that person can take a payment and write off the balance. Third, one person who both counts the stock and adjusts the stock records: that person can remove goods and correct the book to match. If you break only those three, you have addressed the majority of realistic exposure.

Where a genuine separation cannot be made, the substitute is owner review after the fact. This is called a compensating control, and it works provided it is real: the owner looking at every supplier added this month, every credit note over a threshold, and every stock adjustment, with enough consistency that staff know it happens. Detection is weaker than prevention, but a detective control that is genuinely performed beats a preventive control that exists only in a document.

One more point that owners find uncomfortable. Segregation is as much a protection for staff as for the business. A bookkeeper who is the only person who touches the bank has no way to demonstrate their own honesty if something goes wrong. Framing it that way usually removes the awkwardness of introducing controls into a small, close team.

• Supplier master file changes must be made by someone who cannot release payments, and every change should generate a notification the owner sees.
• The person who prepares a payment run must not be the person who approves and releases it.
• The person who allocates customer receipts must not be the person who can authorise a write-off or a credit note.
• The person who performs a stock count must not be the person who posts the adjustment.
• The person who reconciles the bank account must not be the person who makes payments.
• Payroll changes, particularly new starters and bank detail changes, must be approved by someone outside payroll.

Approval limits

An approval limit converts spending from a matter of judgement into a matter of authority. It is one of the cheapest controls available, because it requires no software and no extra staff, only a written schedule that everyone knows. The schedule should cover purchase commitments, payments, credit notes, write-offs, discounts and new customer credit limits, and it should name roles rather than individuals so that it survives someone leaving.

An illustrative schedule for a small business might read: purchases up to 5,000 SAR approved by the department supervisor; from 5,000 to 50,000 SAR approved by two people, one of whom must be the finance manager; above 50,000 SAR approved by the owner. Credit notes up to 2,000 SAR by the sales manager and above that by the owner. Stock write-offs of any size by the owner. Customer credit limits above 25,000 SAR by the owner. The exact figures matter far less than having them, applying them, and setting them at a level that does not paralyse ordinary work.

Two failure modes are worth guarding against. Splitting, where a 60,000 SAR purchase becomes two orders of 30,000 SAR to stay under a limit, which is why a periodic review of purchases by supplier is worth more than it looks. And the standing exception, where one supplier or one manager is quietly outside the schedule for historical reasons. Every exception should have a reason and an end date, or it becomes the rule.

Bank reconciliation discipline

Bank reconciliation is the single most valuable control in a small business, and it is routinely treated as a bookkeeping chore to be done whenever there is time. Its value comes from the fact that the bank statement is the one record no one inside the business can alter. Everything else can be adjusted. Reconciling the ledger to the statement, completely, is therefore the only test that proves the recorded position matches reality.

Frequency matters more than sophistication. Monthly is a minimum; weekly is much better, and with electronic feeds it costs very little. The discipline is that every difference must be identified, not netted off. Unreconciled items should be listed individually with an age, and any item outstanding for more than a month should be explained to the owner. A reconciliation that ends with an unexplained balancing figure is not a reconciliation.

The same logic extends to supplier statements. Reconciling to a statement issued by an external party tests your payables ledger against a record you did not create, which is how duplicate payments, missing credit notes and payments to the wrong account are usually found. Doing this for your ten largest suppliers quarterly takes a couple of hours and reliably finds money.

• Reconcile every bank account, including dormant ones and cards, on a fixed schedule.
• The person reconciling should not be the person making payments.
• List uncleared items individually with dates. Old uncleared cheques and long-standing deposits in transit are a classic place to hide a shortfall.
• Have the owner look at the reconciliation itself, not just the closing balance, at least quarterly.
• Reconcile the merchant card settlement to till takings daily or weekly, because the gap between takings and settlement is where card refunds hide.
• Reconcile the payroll control account and the tax accounts as well, not only the bank.

Payments and the supplier file

The supplier master file is the most sensitive data set in a small business, because a payment goes wherever it says. Adding a supplier and changing bank details should both be treated as privileged actions, restricted to someone who cannot release payments, and every change should be visible to the owner without being asked for.

Bank detail changes deserve a specific rule, because the fraud that exploits them is common, cheap to run and works on careful people. An email arrives, apparently from a known supplier, on plausible letterhead, saying the account has changed. The rule is that a change is only made after verbal confirmation on a phone number already held in your records, never a number given in the request, and never on email alone. Write that rule down and treat it as absolute rather than as a guideline, because the pressure in the moment is always to be helpful and fast.

Keep an eye on the shape of the spend as well as the individual transactions. Payments that are round numbers, repeated at the same amount, just under an approval threshold, or to a supplier with no purchase orders behind them are all worth a question. None of those is proof of anything, and all of them are cheap to look at.

• Three-way match before payment: purchase order, goods received note, supplier invoice. No match, no payment.
• Payment runs prepared by one person, reviewed against supporting documents and released by another.
• Duplicate invoice number checking on entry, which catches the most common cause of paying twice.
• New supplier setup requires a trading address, tax registration and bank details from a document, not from an email signature.
• Bank detail changes verified by voice on an existing number, recorded, and notified to the owner.
• A monthly report of new suppliers and changed bank details, read by the owner.
• A periodic check for suppliers whose bank details match an employee bank account.

Cash, receipts and credit notes

Where a business takes physical cash, the control is a chain of custody: cash counted and signed for at each handover, banked intact and promptly rather than used to pay expenses, and a till reconciliation performed by someone other than the person who operated the till. Petty cash should be run on an imprest system, where the float is a fixed amount, say 3,000 SAR, and it is topped back up to that amount by reimbursing exactly the receipts presented. That way the cash in the tin plus the receipts always equals 3,000 SAR, and any difference is visible immediately.

Customer receipts are the more common exposure in a business that trades on credit. The risk is that a payment is taken and the customer balance is cleared by a credit note or a write-off rather than by the money reaching the bank. The control is that whoever allocates receipts cannot authorise credit notes or write-offs, and that a report of all credit notes and write-offs is reviewed by the owner every month with the reason for each.

Watch the ageing report as a control, not only as a cash management tool. Balances that stay old, get partly settled and reappear, or repeatedly attract small adjustments are a pattern worth understanding. A customer who says they paid an invoice your ledger shows as open is either a systems problem or something more serious, and both need the same immediate answer.

Stock counts

For any business holding inventory, the stock count is where recorded reality meets physical reality. An annual count is the audit minimum and a poor control, because it tells you a year late and gives you no ability to identify when a loss occurred. Cycle counting, where a portion of lines is counted every week or month on a rota so that high-value and fast-moving lines are counted several times a year, is far more useful and less disruptive than closing for a full count.

Take an illustrative example. A business counts a section with a book value of 412,000 SAR and finds physical stock worth 397,400 SAR. The shrinkage is 14,600 SAR, which is 3.5 percent of book value. Now translate it into the language that matters: at a 35 percent gross margin, replacing 14,600 SAR of lost gross profit requires about 41,700 SAR of additional sales. A shrinkage figure that sounds small as a percentage is usually a large number of extra sales once expressed that way.

The same thinking applies to fixed assets. A register that is reconciled to what is physically present, once a year, catches equipment that has quietly left. It takes an afternoon and it is very rarely done in small businesses.

• Count by rota, with high-value and fast-moving lines counted most often.
• Counters should not be the people who normally control that stock, and should count blind, without the book quantity printed on the sheet.
• Investigate variances above a set threshold before posting any adjustment.
• Stock adjustments must be approved by someone who did not count and does not hold the stock.
• Track shrinkage as a trend by location and by product group, not as a single annual number.
• Control goods inwards: count and check deliveries against the purchase order before signing, and record short deliveries at the point they occur.

Payroll

Payroll is usually the largest single payment a small business makes and often the least examined, partly because it is sensitive and partly because it is processed by one trusted person. The two controls that matter most are that someone outside payroll approves new starters, leavers and any change to bank details, and that the owner periodically compares the payroll list to the actual list of people working in the business.

Beyond that, look at the movement rather than the total. A month-on-month comparison of gross pay by employee, with an explanation for every change, catches inflated overtime, unapproved increases and payments continuing after someone has left, and it takes a few minutes. Duplicate bank accounts across employee records, and employee accounts matching supplier accounts, are both worth a periodic check.

Where payroll is outsourced, the control does not disappear, it moves. The provider processes what you send them, so approval of the changes you send is still yours, and reconciling what was paid to what you approved is still yours. Outsourcing a process never outsources responsibility for it.

Controls that catch things, and controls that only create paperwork

Not all controls are worth their cost, and small businesses often end up with an unbalanced set: heavy procedure around small, visible transactions such as expense claims, and almost nothing around large, invisible ones such as supplier bank details. It is worth being explicit about which is which.

The test for any proposed control is simple. What specific thing would this have caught, and how would we know it worked? If nobody can answer, the control is decoration. The related test is whether it is actually performed: a control performed nine months out of twelve is not a control that works most of the time, because anyone motivated to exploit it only needs to know which months.

A word on system access, which is where controls in a small business most often quietly fail. Everyone starts with the access they need and accumulates more over time, until several people can do everything and the segregation designed on paper no longer exists in the system. Reviewing who can approve, post, pay and change master data, once or twice a year, restores it. Skyline Nexus supports role-based permissions and records an audit trail of who changed what and when, which is what makes such a review possible; deciding who should have which role remains an owner decision, and it is the part that actually determines whether the control holds.

• Works: three-way matching before payment. It is the single most effective control over outgoing money.
• Works: verifying bank detail changes by voice on a number you already hold.
• Works: separating the person who reconciles the bank from the person who pays.
• Works: blind stock counts by someone who does not control the stock.
• Works: owner review of an exception report, meaning credit notes, write-offs, manual journals, new suppliers and stock adjustments, every month.
• Works: mandatory annual leave for anyone in a finance role, because most long-running schemes need daily maintenance and unravel when the person is away.
• Mostly paperwork: a second signature on documents nobody reads, applied uniformly regardless of value.
• Mostly paperwork: detailed approval procedures for very small expenses while large transfers go unreviewed.

What the owner should personally review every month

The most effective control in a small business is a well-informed owner who is known to look. It does not need to take long. What follows is a short monthly list that can be worked through in an hour and that covers the main exposures described in this guide.

The value of this list is only partly in what it finds. Most months it will find nothing, and that is a legitimate outcome. Its larger value is that everyone knows it happens, which changes behaviour before anything is attempted, and that the owner stays close enough to the numbers to notice when something looks unfamiliar. That familiarity is the thing no procedure can replace.

Add one annual item to the monthly routine: read your own control arrangements as though you were trying to get money out of the business. Where would you start? Who would have to be away for it to work? What would nobody notice for six months? That exercise, done honestly for half an hour a year, tends to produce a better list of priorities than any generic checklist, including this one.

• The bank reconciliation itself, not just the closing balance, with the list of uncleared items and their ages.
• Every new supplier added and every bank detail changed this month.
• All credit notes and bad debt write-offs, with a reason for each.
• All manual journal entries, particularly any posted around the period end.
• Stock adjustments and the shrinkage trend by location.
• Payroll gross pay by employee compared with last month, with every change explained.
• The receivables ageing, with attention to the over-90 bucket and any balance that keeps reappearing.
• The largest twenty payments made this month, with a glance at what each was for.

Writing it down and keeping it alive

Controls should be written down, but briefly. Two pages covering who approves what, who can change master data, who reconciles, how counts are done and what the owner reviews monthly is more useful than a fifty-page manual, because it will be read and it can be kept current. Name roles rather than people so the document survives staff changes, and review it whenever someone joins, leaves or changes job.

Expect to be tested by ordinary operational pressure. Someone will be on leave, an urgent payment will need releasing, a delivery will need signing for without a count. Handle those with a documented exception and a review afterwards, rather than by quietly abandoning the control, because a control suspended for convenience is very rarely reinstated on its own.

Finally, keep the ambition proportionate. A small business does not need the control environment of a listed company, and attempting one produces cost, resentment and workarounds. What it needs is that no single person can move money out unnoticed, that the bank is reconciled by someone who cannot pay, that stock is counted by someone who does not hold it, and that the owner looks at the exceptions every month. Those four things, done consistently, are worth more than any amount of documentation that describes something nobody does.