Quick answer: Internal controls are the routines that make sure money is handled correctly and that mistakes or theft get caught quickly. For a small business, the most effective controls are separating who handles money from who records it, having the owner review bank statements and reconciliations every month, requiring approval for payments and vendor changes, and verifying any change to payment instructions by phone. None of these require a large staff or expensive software.

Most small business owners trust the people they work with, and usually that trust is earned. But in our years as a controller and in public accounting, we have seen what happens when one long-time, well-liked employee handles every part of the money with nobody looking over the work. Good controls protect the business, and they also protect honest employees from suspicion when something goes wrong. That is as true for a ten-person shop in Central New York as it is for a large company.

What internal controls actually are

Internal controls are not a binder of policies. They are a handful of habits built into daily work so that:

  • Transactions are authorized by the right person
  • Every transaction is recorded accurately and promptly
  • Assets such as cash, inventory, and equipment are protected
  • Errors are caught before they compound

The goal is not to eliminate all risk. It is to make fraud hard to commit and hard to hide, and to catch honest mistakes while they are still small.

Segregation of duties, even with a small staff

The core idea is that no single person should be able to start a transaction, record it, and reconcile it. If the same bookkeeper writes checks, enters them in the books, and reconciles the bank account, a problem can stay hidden indefinitely.

Small businesses rarely have enough people for textbook segregation, so the owner usually fills the gap. Practical arrangements include:

  • The bookkeeper prepares payments, but the owner approves and releases them.
  • Someone other than the bookkeeper opens the mail or reviews the online deposit detail.
  • The owner receives bank and credit card statements directly, or has their own online access, and looks at them before anyone else.
  • An outside accountant reconciles accounts or reviews the reconciliations each month.

Even two or three of these steps sharply reduce risk.

Controls over cash and payments

Cash is where most small business losses occur. A few controls do most of the work:

  1. Reconcile every bank and credit card account monthly, and have the owner review and initial the reconciliation.
  2. Review the actual bank statement, not just the report from the accounting software. Look at payees, endorsements on check images, and any transfers you do not recognize.
  3. Require dual approval for wires, ACH batches, and payments above a set amount. Most business banking platforms support this.
  4. Use positive pay or ACH filters if your bank offers them. These services flag checks or debits that do not match what you authorized.
  5. Lock down check stock and signature stamps, and avoid pre-signed checks.
  6. Deposit receipts promptly and keep cash on hand to a minimum.
  7. Limit company credit cards and require receipts and monthly review for each cardholder.

Vendor, payroll, and payment-instruction risks

Some of the most costly frauds today involve no insider at all. Business email compromise schemes send convincing emails, apparently from a real vendor or even the owner, asking to change bank details or rush a wire.

Controls that help:

  • Verify any change in vendor bank information by calling a known phone number, never one listed in the email requesting the change.
  • Restrict who can add or edit vendors in your accounting system, and review a report of vendor changes each month.
  • Review payroll registers before each payroll is released, watching for new employees you do not recognize, unusual rates, or changed direct deposit accounts.
  • Be skeptical of urgency. A request to skip normal approval "just this once" is a classic warning sign.

The IRS also warns about scams involving payroll data and W-2 requests. Its tax scams and consumer alerts page is worth sharing with your office staff. If you outsource payroll or bookkeeping, ask your provider what controls they apply. Our own bookkeeping and payroll services are set up so the owner keeps approval authority.

Warning signs owners should not ignore

Fraud and serious error often leave traces. Pay attention when you see:

  • Bank reconciliations that are late, missing, or always "almost done"
  • An employee who refuses to take vacation or share duties
  • Unexplained drops in gross margin or rising "miscellaneous" expenses
  • Customer complaints about payments they made that were not credited
  • Vendors you do not recognize, or several vendors sharing an address
  • Frequent voided checks or manual journal entries without explanation

None of these prove wrongdoing, but each deserves a question. Requiring every employee who handles money to take at least one full week of vacation, with someone else covering their duties, is an old-fashioned control that still works.

Starting small

You do not need to do everything at once. A sensible first month might be:

  1. Get your own online access to every bank and credit card account.
  2. Turn on dual approval for electronic payments.
  3. Write a one-line policy that vendor bank changes require phone verification.
  4. Start reviewing and initialing bank reconciliations monthly.

From there, controls fit naturally into a regular monthly close and owner review. Our guide to the financial statements owners should read every month pairs well with these steps.

Frequently asked questions

Can a business with only one or two employees have internal controls?

Yes. With a very small staff, the owner becomes the main control. Reviewing bank statements personally, approving every payment, and having an outside accountant review the books each month provides meaningful protection.

How often should bank accounts be reconciled?

At least monthly, for every bank, credit card, and loan account. The reconciliation should be done promptly after the statement arrives and reviewed by someone other than the person who records transactions.

What is the most common way small businesses lose money to fraud?

Common schemes include altered or forged checks, fake vendors, payroll manipulation, and payment instruction changes sent by email. Monthly review of bank activity and verification of payment changes by phone stop many of these.

Does insurance cover employee theft?

Standard business policies often do not. Coverage for employee dishonesty, sometimes called crime or fidelity coverage, is usually separate. Ask your insurance agent what your policy includes, and remember that insurers may expect basic controls to be in place.

This article is general information for 2026, not tax or legal advice for your situation. Tax rules and figures change; confirm current amounts with the IRS, New York State, or your accountant before acting.

Related service: Controller & CFO Services