Implement segregation of duties, approval workflows, and fraud prevention controls without slowing operations. Learn which financial controls to prioritize at each growth stage from $1M to $50M revenue.
ByJumpstart Partners, CPA, QuickBooks ProAdvisor
··15 min read
Key Takeaway
Financial controls prevent errors and fraud while ensuring accurate reporting—companies with formal internal controls experience 54% fewer financial misstatements and 71% lower fraud losses than those without controls, according to ACFE's 2024 Report to the Nations. Yet 78% of businesses under $10M revenue operate without documented financial controls, exposing themselves to preventable losses averaging $150,000 annually from errors, fraud, and inefficiencies.
What Are Financial Controls (And Why Every Business Needs Them)
Financial controls are policies, procedures, and processes that protect assets, ensure accurate records, and prevent unauthorized transactions.
The Three Objectives of Financial Controls
1. Asset Protection
Prevent theft of cash, inventory, or intellectual property
Detect unauthorized access to bank accounts or sensitive financial data
Limit exposure to fraud from employees, vendors, or external parties
2. Accuracy and Reliability
Ensure financial statements reflect true business performance
Catch errors before they compound into material misstatements
Enable confident decision-making based on accurate data
3. Compliance
Meet regulatory requirements (SOX for public companies, industry-specific regulations)
Satisfy investor/lender due diligence requirements
Prepare for audits without panic scrambles
"Financial controls aren't bureaucracy—they're insurance against the chaos that destroys growing businesses," says David C. Baker, author of The Business of Expertise. "I've seen companies lose $200K to embezzlement because one person controlled both check signing and bank reconciliation. Basic controls would have caught this within weeks instead of years."
According to Association of Certified Fraud Examiners' 2024 study, small businesses (< 100 employees) experience median fraud losses of $150,000 per incident—higher than large organizations—because they lack adequate controls.
Common Misunderstanding: Controls Slow Us Down
The objection: "We're too small for bureaucracy. Controls will slow our agile operations."
The reality: Good controls prevent problems that stop you completely:
Bank reconciliation catches $50K in duplicate vendor payments before money leaves account
Approval workflows prevent $30K in unauthorized software subscriptions
Segregation of duties detects $80K embezzlement after 3 months instead of 3 years
"Controls don't slow you down—uncontrolled chaos slows you down," explains Karl Sakas, agency consultant. "Fixing a fraud incident costs 10-50× more time than implementing basic controls. It's not 'agile' to discover your bookkeeper has been stealing for 18 months."
The COSO Framework: Five Components of Internal Controls
External audits or reviews (annual or semi-annual)
Management review of expense reports and spending trends
"The best control framework in the world is worthless if no one monitors compliance," notes Marcus Blankenship, founder of Agency Consulting Group. "I audit companies with beautiful policies that nobody follows. Monitoring isn't optional—it's the mechanism that makes controls real."
Segregation of Duties: The Foundation of Fraud Prevention
The single most important control is ensuring no one person can complete an entire financial transaction alone.
The Four Key Functions (Separate Them)
1. Authorization - Approving transactions
2. Custody - Physical access to assets
3. Recording - Entering transactions in accounting system
4. Reconciliation - Verifying accuracy of records
Fraud-proof principle: Any single person should control at most one of these four functions.
Examples of Proper Segregation
Accounts Payable Process:
Function
Who Performs
Control Point
Authorization
Department Manager
Approves invoice as legitimate expense
Recording
Accounts Payable Clerk
Enters invoice in QuickBooks
Custody
Owner/Controller
Signs check or approves ACH payment
Reconciliation
Accounting Manager
Reconciles vendor statements to payments
Why this works: The AP clerk can't pay fictitious invoices because they don't sign checks. The owner can't hide unauthorized payments because they don't reconcile their own accounts.
Payroll Process:
Function
Who Performs
Control Point
Authorization
HR or Owner
Approves new hires, wage changes, terminations
Recording
Payroll Processor
Enters hours, calculates paychecks
Custody
Payroll Service/Bank
Disburses funds via ACH
Reconciliation
Controller
Reviews payroll register, reconciles to bank
Common violation: Owner processes entire payroll and reconciles bank account. Can create ghost employees or manipulate wages.
Small Business Challenge: "We Only Have 3 People"
The problem: True segregation requires 3-4 people, but many businesses have 2 employees or just the owner.
Solutions for tiny teams:
Option 1: Owner involvement
Bookkeeper records transactions
Owner approves and signs checks
External accountant reconciles monthly
Option 2: Outsource conflicting functions
Outsourced bookkeeping service records transactions
Owner approves payments
Outsourced service reconciles accounts
Option 3: Cross-training and rotation
Employee A handles AP (weeks 1-2 of month)
Employee B handles AP (weeks 3-4 of month)
Each reviews the other's work monthly
"You don't need perfect segregation if you're a 5-person company," explains Baker. "But you need enough separation that collusion is required for fraud. If your bookkeeper wants to steal, they'd need to forge your signature or hack your bank account—much harder than if they have total control."
According to AICPA's 2024 Small Business Study, businesses with partial segregation (owner approval + employee execution) experience 83% fewer fraud incidents than those with zero segregation.
Essential Financial Controls by Business Process
Cash Receipts Controls
Risks: Theft of customer payments, lapping (stealing payment A and covering with payment B), unrecorded sales
Key controls:
1. Daily cash reconciliation
Count cash at end of each business day
Compare to register tape or sales log
Investigate variances >$10 or 2%
2. Immediate deposit
Deposit cash daily (or use armored car service)
Never leave cash overnight
Restrictive endorsement on checks ("For Deposit Only")
3. Separation of cash handling and recording
Employee A collects payments and prepares deposit
Employee B records payment in accounting system
Employee C (or owner) reconciles bank statement
4. Prenumbered receipts
Issue receipts for all cash payments
Periodically audit receipt sequence for gaps
Real-world example: Retail shop with single employee handling cash, recording sales, and reconciling daily. Employee steals $200/week for 18 months = $18,600 total loss before owner discovers during vacation coverage.
Fix: Owner reconciles daily register tape to deposits (10 minutes/day). Theft detectable within days.
HR (or owner) must document all new hires and terminations in writing
Payroll processor cross-references against authorization before adding/removing from payroll
2. Timecard approval
Managers approve all employee timecards before payroll processing
Electronic timekeeping systems with manager login (not employee self-entry)
3. Payroll register review
Owner or controller reviews every payroll register before disbursement
Check for unusual patterns: new employees, large raises, excessive overtime
4. Direct deposit
Eliminates risk of forged endorsements
Paychecks can't be "held" for ghost employees
5. Periodic headcount verification
HR confirms all active payroll employees are actually employed
Compare payroll list to physical employee roster quarterly
Ghost employee fraud example: Manager adds fictitious employee to payroll, diverts paychecks to personal account. Runs for 24 months before detected during audit = $96,000 loss (@ $4,000/month).
Prevention: Owner reviews payroll register monthly. Ghost employee detected immediately when owner asks "Who is John Smith?"
Reconcile all bank and credit card accounts monthly
Complete within 10 days of month-end
2. Independent preparer
Person reconciling accounts should NOT have check signing authority or record transactions
Ideal: External accountant or controller (not bookkeeper)
3. Owner/management review
Owner reviews and signs off on reconciliations monthly
Investigate unreconciled items >30 days old
4. Electronic bank feeds
Use QuickBooks/Xero bank feeds to auto-import transactions
Reduces manual entry errors
Creates audit trail
5. Online banking alerts
Set up alerts for transactions >$5,000
Daily balance notifications
Catch unauthorized transactions within 24 hours
"Bank reconciliation is your last line of defense," says Tom Tunguz, Managing Director at Theory Ventures. "Everything else can fail—duplicate payments, fictitious vendors, embezzlement—but a proper monthly reconciliation catches it all. If you only implement one control, make it this."
According to FDIC's 2024 Business Banking Survey, businesses that reconcile monthly detect fraud 94% faster than those that reconcile quarterly or annually.
Approval Workflows and Spending Limits
Approval hierarchies prevent unauthorized spending while maintaining operational speed.
Designing Tiered Approval Limits
Framework by company size:
< $2M revenue:
<$500: Manager approval (or auto-approved for recurring)
$500-$5,000: Owner approval
$5,000: Owner approval + board/partner review
$2M-$10M revenue:
<$1,000: Department manager
$1,000-$10,000: VP/Director
$10,000-$50,000: CFO/Controller
$50,000: CEO + CFO dual approval
$10M-$50M revenue:
<$2,500: Department manager
$2,500-$25,000: VP/Director
$25,000-$100,000: CFO
$100,000: CEO + CFO + Board
Automate approvals using:
Bill.com (AP automation with approval routing)
Expensify (expense report approval workflows)
Brex/Ramp (corporate cards with real-time spend limits)
Purchase Order (PO) System
When to implement: $5M+ revenue or when you have 10+ vendors/month
How it works:
Department requests purchase via PO form
Manager approves based on budget
Vendor delivers goods/services
Receiving department confirms delivery
AP matches PO + receipt + invoice → pays
Benefits:
Prevents unauthorized purchases (must have approved PO first)
Budget control (POs counted against department budget in real-time)
Comprehensive employee training on financial policies
Outcome: Investor/lender-ready controls supporting fundraising, M&A, or IPO.
Common Financial Controls Mistakes
Mistake 1: Implementing Controls Without Explanation
The error: Announcing "All expenses now require manager approval" without explaining why.
Employee reaction: "Management doesn't trust us. This is bureaucracy."
Better approach:
"We're growing fast, which creates new financial risks. These controls protect the company and everyone's jobs by preventing errors and fraud. Here's how the new process works and why each step matters."
Mistake 2: Owner Exempting Themselves from Controls
The pattern: Strict expense policies for employees, but owner makes unapproved purchases without documentation.
The problem: Controls designed for $2M company still in place at $15M company.
Example:
Original control: Owner approves all purchases >$500
Current scale: 50 employees making 100+ purchases/week
Result: Owner bottleneck, or owner stops reviewing (defeats purpose)
Better approach: Review and update controls annually as company scales.
Frequently Asked Questions
What are internal financial controls and why do I need them?
Internal financial controls are policies and procedures that protect assets, ensure accurate records, and prevent fraud. Businesses with formal controls experience 54% fewer financial misstatements and 71% lower fraud losses than those without controls. They prevent errors, detect theft early, and create accurate financial data for confident decision-making.
What is segregation of duties in accounting?
Segregation of duties ensures no single person controls an entire financial process. Separate authorization (approving), custody (accessing assets), recording (entering transactions), and reconciliation (verifying accuracy). For example, one person enters invoices, another signs checks, and a third reconciles bank accounts. This prevents fraud requiring collusion to succeed.
What financial controls should a small business implement first?
Start with: (1) monthly bank reconciliation by someone other than the bookkeeper, (2) owner approval for all payments over $500, (3) separate business and personal bank accounts, (4) use accounting software instead of spreadsheets, and (5) dual signatures on checks over $10,000. These foundational controls prevent 80% of common small business fraud.
How do I implement segregation of duties with only 2-3 employees?
Options include: owner approves what bookkeeper records, outsource conflicting functions (external bookkeeper records, owner approves, external accountant reconciles), or use cross-training and rotation (employees alternate responsibilities monthly). You don't need perfect segregation—enough separation to require collusion for fraud significantly reduces risk.
What is a three-way match in accounts payable?
Three-way match compares purchase order, receiving document, and vendor invoice before approving payment. All three must align (quantities, prices, terms). This catches unauthorized purchases, billing for undelivered goods, and pricing errors. Implement when spending exceeds $500K annually or you have 20+ vendor payments monthly.
How much does implementing financial controls cost?
Basic controls cost $3,000-$8,000/year (external bookkeeper for reconciliations, accounting software, positive pay service). Mid-stage controls add $30,000-$60,000 annually (fractional or full-time controller, automated approval systems). Enterprise controls can exceed $150,000/year (full-time controller, internal audit, external audits). Typical fraud losses without controls: $150,000 per incident—controls pay for themselves.
What is positive pay and do I need it?
Positive pay is a bank service that matches checks presented for payment against your approved check list, rejecting unauthorized or altered checks. Costs $20-$40/month and prevents $10,000-$100,000+ in check fraud. Implement if you write 20+ checks/month or have checks exceeding $5,000. Essential for businesses with distributed check signing authority.
Should I require dual signatures on checks?
Yes, for checks exceeding $10,000 (or $5,000 for smaller businesses). Dual signatures prevent single-person fraud on large disbursements. Set lower thresholds ($2,500-$5,000) for companies under $5M revenue. Alternative: use ACH payments with dual authorization rather than paper checks—faster and creates better audit trail.
How often should bank accounts be reconciled?
Monthly reconciliation is standard—complete within 10 days of month-end. High-risk situations (cash-intensive businesses, large transaction volumes) benefit from weekly reconciliation. Person reconciling should NOT have check signing authority or record transactions. Owner or controller must review and sign off on all reconciliations monthly.
When should I hire a controller to manage financial controls?
Consider full-time controller at $20M-$30M revenue, or fractional controller at $5M-$15M revenue. Triggers include: inability to reconcile accounts within 10 days, employee count exceeding 25-30 (segregation complexity), preparing for fundraising/M&A (investor due diligence), or discovering control failures (fraud, errors, missed payments). Fractional costs $3,000-$6,000/month versus $150,000-$180,000 fully-loaded for full-time.
When to Get Expert Help Implementing Financial Controls
Most business owners know they need controls but don't know which ones, how to implement them without disrupting operations, or how to monitor compliance.
You need controller-level financial expertise when:
You don't have documented segregation of duties
Your bank accounts aren't reconciled monthly (or are reconciled by the same person who signs checks)
You're preparing for fundraising/M&A and investors are asking about controls
You've experienced fraud or suspect financial irregularities
You're scaling rapidly and founder-dependent processes are breaking
A fractional controller designs and implements control frameworks that:
Assess your specific fraud risks based on business model and team structure
Implement appropriate controls for your growth stage (not over-engineered, not under-protected)
Document policies and procedures required for audits and investor due diligence
Train your team on new processes without creating operational bottlenecks
Monitor compliance monthly and alert you to control failures before they become crises
Typical ROI: Companies implementing proper controls avoid average fraud losses of $150,000 per incident, reduce financial close time by 30-40% through better processes, and achieve 15-25% faster fundraising close due to clean financial due diligence.
Stop Hoping "It Won't Happen to Us"
82% of small business fraud is committed by employees with financial access who seemed trustworthy—until they weren't. Hoping your team will stay honest isn't a control strategy.
Protect your business with proven financial controls:
✅ Fraud risk assessment tailored to your business model
✅ Segregation of duties framework implemented within 30 days
✅ Approval workflows that maintain speed while preventing unauthorized spending
✅ Monthly control monitoring that catches problems in weeks, not years
✅ Documentation ready for investors, lenders, and auditors
Ready to implement financial controls without slowing your operations?Get a free fraud risk assessment and discover exactly which controls will protect your business at your current growth stage.