Internal controls when your finance team is two people

Standard control frameworks assume you have enough people to separate approving, doing and recording. Most businesses we work with do not, and pretending otherwise produces a manual nobody follows. The answer is not to give up on controls but to choose ones that work at your size.

Where the same person must both record and reconcile, the control becomes an independent review afterwards. An owner who reads the full bank statement line by line every month, against a list of payments made, achieves most of what separation of duties would. It has to be the statement from the bank rather than an export from your accounting software, and it has to be every line.

Five controls are worth the effort at any size. Two signatories on bank payments, with no standing exception, one of them outside the finance function. A monthly statement review by the owner, obtained directly from the bank. Supplier bank detail changes confirmed by phone to a number you already had, never by replying to the email that asked. Two consecutive weeks of leave a year for finance staff, covered by someone else, because long-running schemes need continuous presence. And pre-numbered receipts and invoices, with gaps explained rather than ignored.

Almost every case of misappropriation we have investigated shared the same two features. One person controlled both the supplier list and the release of payments, and that person had not taken uninterrupted leave in years. Neither fact was hidden. Both were visible to anyone who thought to look.

Keep the written version short. Four pages that staff have actually read beat forty in a drawer. Name the control, name the owner, name the frequency, and say what evidence shows it happened. A control that produces no evidence cannot be tested by an auditor, and more importantly cannot be checked by you.