Financial Controls: A Guide for Business Owners

What are financial controls?

Financial controls are the rules and checks that make sure money only leaves your business when it should, comes in when it is owed, and is recorded the way it really moved. A control can be as simple as a second person approving any payment above a set amount, or as routine as matching the bank statement to the books each month. If you own or run a company, your job is to stop money leaking, and your fear is paying too much or losing money without ever knowing. Good controls answer that fear in two ways: they find the dollars that went wrong, and when nothing has, they show you plainly that the books are in order.

Why do financial controls matter to an owner?

They matter because money is usually lost through ordinary processes that nobody was checking, not through dramatic events. In the ACFE’s Occupational Fraud 2026: A Report to the Nations, the cases at organizations with fewer than 100 employees had a median loss of $126,000, the highest of any size group it studied. The same ACFE report found that a typical fraud ran for 12 months before anyone detected it, a full year in which a fake supplier could keep being paid.

The cause is usually a gap, not genius. The ACFE report lists a lack of internal controls as the main weakness in 33% of its cases, an override of existing controls in 19%, and a lack of management review in another 18%. Each of those is something an owner can see and change.

Fraud is only part of it. Money also leaks out of a growing company through honest mistakes: a supplier bills last year’s price, an invoice is entered twice, or a customer is never invoiced for a quarter. Controls catch those the same way they catch theft, because they compare what happened with what should have happened, whatever the reason for the gap.

What does the standard framework say a control system needs?

A widely used framework is COSO’s Internal Control Integrated Framework, which defines internal control as a process run by a company’s board, managers and staff to give reasonable assurance about its operations, its reporting and its compliance. COSO says the framework applies to companies of every size, and that a smaller company’s controls may be less formal and still work. It names five parts that work together, and each has a plain meaning for an owner.

• Control environment: the tone you set. Whether people see that rules apply to everyone, including you, and who has authority to do what.
• Risk assessment: knowing where money could go wrong in your business, such as supplier billing, payroll or customer invoices, and which of those would hurt most.
• Control activities: the checks themselves, such as approvals, reconciliations and reviews.
• Information and communication: the records the checks rely on, and making sure the right person hears when something looks wrong.
• Monitoring activities: checking that the controls still run and still work, rather than assuming they do.

You do not need a binder of policies to cover these. A small company covers them when the owner says who approves what, knows the few places money could leak, has checks on those places, keeps the records that prove it, and looks at the results. Our guide to internal controls sets out the five components and the principles behind them in full.

What is the difference between preventive and detective controls?

A preventive control stops a problem before money moves, and a detective control finds a problem after it has happened, ideally while it can still be fixed. COSO’s framework says control activities may be either kind, manual or automated, and lists approvals, verifications, reconciliations and business performance reviews among them. Requiring a second approver above a payment limit is preventive. Matching last month’s bank statement to the books is detective.

You need both. Preventive controls are cheaper when they work, because nothing has to be recovered. But they depend on people following them every time, and a busy team skips steps. Detective controls catch what slipped through, and they are often the only way to find an error that no one thought to prevent.

How fast a detective control runs matters as much as whether it exists. In the ACFE’s 2026 report, frauds at organizations that used proactive data monitoring had a median loss of $70,000 and lasted 9 months, against $150,000 and 16 months at those that did not. A check that runs every day finds a problem weeks before one that runs at year end.

Which financial controls does a business owner need first?

Start with the places where money leaves the business, because a payment that has gone is the hardest thing to get back. Then cover the places where money should come in, and finally the records that tie it all together. These are the controls to put in place first, roughly in order.

1. An approval limit on payments. Any payment above an amount you set needs a recorded approval from someone other than the person who prepared it. Watch for several invoices from one supplier that each sit just under the limit.
2. A check on every change to a supplier’s bank details. A request to pay a new account just before a large payment is a classic sign of fraud, so confirm any change by phone on a number you already had. Our guide to vendor master fraud explains the schemes.
3. Supplier invoices against what you agreed. Each invoice should match the price in your agreement on the date of supply, along with the quantity you ordered and the fees your agreement allows. The steps are in how to check supplier invoices against agreed prices.
4. A duplicate check before each payment run. The same invoice entered twice, or the same delivery billed under two invoice numbers, should be stopped before it is paid. See duplicate payments and invoice fraud.
5. A monthly bank reconciliation. Every transaction on the bank statement should match an entry in your books, and the month-end balance should agree, with anything unmatched listed and explained.
6. Customer invoices against what customers agreed. Each invoice you send should carry the agreed price, and every period your agreements let you bill should have an invoice.
7. Payroll against your employee list. The people paid should be the people you employ, at the rate on their record, and no one should be paid after their leaving date.
8. A review of journal entries. Entries made by hand, especially large ones or ones posted after the month closed, should be reviewed by someone other than the person who made them. The journal entry testing guide shows what to look for.
9. A review of who can do what. At least once a quarter, check who has access to your accounting system and bank, and remove anyone who has left.
10. Supporting documents for every entry. Keep the invoice, receipt or agreement behind each transaction. The IRS guidance on what records to keep says supporting documents such as paid bills, invoices, receipts and canceled checks back up the entries in your books and on your tax return.

You do not need all ten in place before you start. The first four protect the money going out, which is where a mistake is hardest to undo, so begin there and add the rest one at a time.

How do you run controls with a small team?

You split the few duties that give one person a clear path to cash, and where you cannot split them, you add a review by someone else that leaves a record. The ACFE’s 2026 report found that businesses with fewer than 100 employees are much less likely to have each of the 18 anti-fraud controls it studied than larger ones. With an office of three or five, one person often sets up suppliers, enters invoices and pays them, and that is the pattern controls are meant to break.

COSO’s framework expects this: it says segregation of duties is usually built into control activities, and where it is not practical, management chooses other control activities instead. In a small company, the other activity is often you. Approve the payment run yourself, read the bank reconciliation each month, and look at the list of supplier changes. A short owner review, done every time and recorded, puts a second person between a decision and the money, which is what splitting roles is for. Our guide to segregation of duties on a small finance team lists the pairs to split first.

Review only works when it leaves evidence. A signature, an approval in the accounting system or a short note saying what you checked turns “I looked at it” into something you can show a lender, a buyer or an auditor later.

How often should each control run?

Each control should run as often as the thing it protects happens. A check on a payment belongs before every payment, a check on an invoice belongs when the invoice arrives, and a check on the month’s books belongs at month end. COSO’s framework describes two ways to monitor controls: ongoing evaluations, built into everyday processes, which give timely information, and separate evaluations, done from time to time. Most small companies rely on the second kind, a yearly look or an audit, and so find problems long after the money has moved.

In practice, controls fall into three rhythms.

• On every transaction: invoice against agreement, duplicate check, approval limit, bank details change, customer invoice against agreement.
• Every month: bank reconciliation, journal entry review, payroll against the employee list, invoices you should have sent but did not.
• Every quarter or year: access review, a review of your approval limits, and an update of where your risks are.

The more of the first group that runs on its own, the less the monthly and yearly work has to catch. The difference between checking at year end and checking as you go is set out in continuous controls versus the year-end scramble.

Worked example: the controls Ferrygate runs, monthly and continuously

Ferrygate Plumbing & Heating is an invented company, one of the Demo companies Ressura uses to show its checks, and every name and figure below is made up for the example. It is a plumbing and heating contractor in Tacoma with about forty staff, most of them installers and service technicians, and an office of five. Marcus Oyelaran owns and runs it, Dana Whitlock is the office manager and bookkeeper, and Priya Natarajan enters supplier bills.

Here is what Ferrygate checks on every bill and payment, and what each control protected in one month.

• Bill against agreement. A bill from Cascade Pipe & Supply charged 48 lengths of copper pipe at $62.40 each, a total of $2,995.20. Ferrygate had ordered 40 lengths at the agreed $58.90, which is $2,356.00, so the bill was $639.20 too high. This control protects against paying more than you agreed.
• Duplicate bill. A $1,236.50 bill from Sound Safety Supply had been entered twice. It was caught before the payment run, so it was paid once. This control protects against paying the same bill twice.
• Approval limit. Ferrygate’s limit for a single approval is $5,000.00. Pacific Tool & Equipment billed twice on one day for a single order of power tools, $4,850.00 and $4,700.00, each under the limit but $9,550.00 together. The pair went to Marcus as one purchase, and he approved it after checking the order. This control protects against large spending that never reaches a second approver.
• Bank details change. Salish HVAC Parts & Controls’ bank details were changed two days before an $18,450.00 payment was due. Dana held the payment and called Salish on the number already on file before it went out. This control protects against paying a thief who poses as a supplier.

And here is what Ferrygate checks at month end and quarter end.

• Missing customer invoice. Ferrygate’s maintenance agreement with Commencement Bay Apartments lets it bill $2,700.00 each quarter, and the month-end check found one quarter with no invoice. This control protects money you have earned but not asked for.
• Bank reconciliation. Every bank transaction is matched to the books, and anything unmatched is listed with its age. This control protects against errors and payments no one recorded.
• Journal entry review. Any entry Dana posts by hand above the amount Marcus set is reviewed by Marcus. This control protects the figures the bank and the owner rely on.
• Access review. Each quarter, Dana and Marcus check who can sign in to the accounting system and the bank, and remove anyone who has left. This control protects against access no one is watching.

Two things stand out. The money found came from the controls that run on every transaction, before payment. And the controls that found nothing still did their job: the bank reconciled, every journal entry had its reviewer, and the access list matched the staff list, so Marcus could say the books were in order and show what was checked.

How do you know your controls are working?

You know a control works when it leaves a record each time it runs, and you can read those records without asking anyone. A control that exists only as a policy, or in one person’s memory, cannot be shown to a lender or an auditor, and it quietly stops when that person is busy or leaves. COSO’s framework asks for monitoring that checks whether each part of internal control is present and working, with any weakness reported to management and the board.

For an owner, that comes down to three questions to ask each month.

• Did each control run? The reconciliation for every bank account, the review of every hand-made journal entry, the check on every bill.
• What did it find? Each exception, in dollars where it has them, with who is dealing with it.
• What did it check when it found nothing? A clean result is worth as much as money found, but only if it says what was checked. “Forty-seven bills checked, all in order” is evidence, and “no issues” is not.

Read exceptions that stay open as a warning too. A control that flags the same problem every month without anyone fixing it has become a report, not a control.

What can financial controls not protect against?

Controls give reasonable assurance, not certainty. COSO’s framework names the limits: human judgment can be wrong, people make simple mistakes, managers can override controls, and two or more people can work together to get around them. An owner who approves their own exceptions, or a clerk and a supplier who agree to bill for work never done, can defeat checks that would stop either one alone.

You narrow these gaps rather than close them. Keep overrides rare and recorded, so an exception you approve today is visible next month. Have someone outside the daily work look at the results from time to time, whether that is an outside accountant, a board member or an auditor. And check the records against outside evidence, such as the bank statement, the signed agreement or a call to the supplier, since collusion inside the company rarely changes what the bank or the other party holds.

If you are preparing for an audit, controls that already run and leave records also lower its cost, because the auditor can rely on them instead of rebuilding the evidence. Our guide to what an audit costs a mid-market company explains why.

How can Ressura run these controls for you?

Ressura checks your records against these controls and shows each Finding with its evidence, in dollars where there are any. The Procure-to-Pay Module checks every supplier invoice against the price, amendments and fees your agreement allows, flags duplicates and price drift, and adds each invoice up again. The Cash & Bank Module matches every bank transaction to your books, checks each payment goes to the account on the supplier’s record, and checks payments above your limit have a recorded approver. The Master Data Module logs and flags every change to a supplier’s bank details, and Fraud Watch points out patterns across them, such as invoices split under an approval limit or bank details changed shortly before a payment.

The Order-to-Cash Module checks the invoices you send against what customers agreed and raises a period your agreement lets you bill with no invoice. The General Ledger Module checks no journal entry is prepared and approved by the same person, the Payroll & HR Module reconciles each pay run to your employee records, and the Access & Segregation of Duties Module checks who can do what in your finance systems every quarter. Ressura connects to Xero, QuickBooks Online, DocuSign, Google Drive and your bank through Plaid. When everything matches, the result reads All in order and lists what was checked, so you have the line to take to your board either way.

You can start with one control and nothing to connect: add one supplier agreement and one invoice billed against it, and the Procure-to-Pay Module checks every line.

Sources

1. the ACFE’s Occupational Fraud 2026: A Report to the Nations
2. COSO’s Internal Control Integrated Framework
3. IRS guidance on what records to keep