What is internal control?
Internal control is the set of policies and procedures a business puts in place to achieve three goals: protecting its assets from loss and misuse, ensuring its financial data is accurate and reliable, and keeping operations compliant with applicable policies and regulations. Controls usually fall into two types: preventive controls that stop an error before it happens, such as requiring a manager's approval before payment, and detective controls that catch an error after it happens, such as bank reconciliation, stock counts and report reviews. A business needs both, because no preventive control stops everything, and late detection alone is not enough.
Segregation of duties: the most important principle
The idea of segregation of duties is simple: no single person should control a financial transaction from start to finish. A sensitive transaction usually involves four functions that should be split: • Authorisation: approving the transaction, such as approving a purchase order or payment. • Execution: carrying it out, such as releasing the payment or issuing goods. • Recording: entering it in the books. • Custody and reconciliation: holding the asset or reconciling its balance, such as the cashier or whoever prepares the bank reconciliation. An employee who can create a new supplier, record its invoice and execute the payment to it has everything needed to pay a fictitious supplier without anyone noticing. Spreading these permissions across more than one person makes that impossible without collusion.
The authority matrix and approval limits
An authority matrix is a management-approved document stating who may approve each type of transaction, and up to what limit. Examples of what it covers: • Approving purchase requests by value: the department manager up to a certain limit, then the finance manager, then the general manager. • Approving payments: one signature up to a certain limit, and two above it. • Approving customer discounts and credit limits. • Approving manual journal entries and document cancellations. • Adding suppliers and customers and changing their bank details. The matrix's real value appears when it is enforced in the system itself, so that every transaction is automatically routed to the right approver and cannot be bypassed with a paper signature afterwards.
User permissions in the finance system
Many businesses give users broad permissions at go-live to avoid friction, and then never review them. It is better to build permissions on job roles rather than individuals: • Define clear roles, such as payables accountant, cashier and purchasing officer. • Give each role only the minimum permissions its work requires. • Prevent users from holding conflicting roles, such as creating a supplier and paying it. • Do not use accounts shared by more than one employee; every user must be a specific person. • Deactivate the accounts of departing employees as soon as their employment ends. • Review the list of users and their permissions periodically, every six months for example. Remember that anonymous access and shared accounts are also practices that conflict with the requirements for e-invoicing solutions.
The audit trail: who did what, and when?
The audit trail records, for every transaction in the system, who created it, when, who changed it, the value before and after the change, and who approved it. It is an important detective control, and it protects employees themselves because it pins down responsibility precisely. For it to do its job: • Make sure it is enabled for sensitive transactions and cannot be disabled except with documented senior authority. • Prevent editing or deleting posted documents, and use reversing documents or credit and debit notes instead. • Periodically review exception reports, such as large manual entries, entries recorded at unusual times, and changes to supplier bank details.
Control in small businesses
In a business with a single accountant, duties cannot be fully segregated, but compensating controls can make up for it: • The owner or manager approves all payments personally in online banking, while the accountant prepares them. • The owner receives bank statements directly and reviews them before handing them to the accountant. • A monthly review of the aged receivables report, the list of new suppliers and manual journal entries. • Mandatory annual leave during which someone else takes over the work, since many irregularities come to light when the person hiding them is away. • Engaging a periodic external review of sensitive transactions. These controls do not cost much, but they change the level of risk considerably.
Warning signs that deserve attention
There are indicators that point to weak control or a possible problem, including: • Late bank reconciliations or unexplained differences that keep recurring. • An employee who persistently refuses leave or to hand their work to someone else. • New suppliers with generic names, unclear addresses or personal bank accounts. • Many manual entries and document cancellations at period-end. • Repeated payments for amounts just below the higher approval limit. A single sign does not necessarily mean wrongdoing, but it deserves a calm review and a strengthening of the related control.
Where to start: practical steps to strengthen control
A business does not need a huge project to improve its control, but ordered steps starting with the highest risk: • Extract from the system the list of users and their current permissions, and identify obvious conflicts. • Start with the payment cycle, which is the most exposed to risk, and separate supplier creation from payment in it. • Write a short authority matrix, have management approve it, then enforce it in the system. • Activate exception reports and decide who reviews them and when. • Document the key procedures in short pages a new employee can understand. Then review what has been achieved after a few months, and move on to the next cycle, such as sales and inventory. Continuous gradual improvement is more useful than a comprehensive plan that is never carried out.
Frequently asked questions
Does internal control slow work down? Well-designed control applied inside the system does not; approvals arrive electronically and are given with a click. It is separate paper-based control that causes delays. Who is responsible for internal control? Senior management is responsible for its existence and effectiveness, the finance function designs many of its controls, and every employee is responsible for applying their part. Is the system alone enough to ensure control? No. The system is a powerful tool for enforcing controls, but it needs well-designed permissions, periodic review and a culture of compliance in the business.
Conclusion
Effective internal control rests on segregation of duties, an authority matrix enforced in the system, role-based user permissions and an audit trail that is reviewed periodically. In small businesses, compensating controls make up for what headcount does not allow. The result is protection for the business's money, greater confidence in its numbers, and a fair working environment for its staff. At Shams Solutions, we help businesses design permissions, approval matrices and audit trails and implement them in finance and ERP systems, from analysing the risks in current processes to setup, training and periodic review. Contact us to review your business's setup and agree on the right next steps.