Internal Financial Controls for Small Businesses: A Practical Guide

As a business owner, you carry a responsibility many people only notice when something goes wrong: making sure the money in your business is recorded accurately, spent properly and protected from error or theft. Internal financial controls are the practical procedures that do this, and you do not need a large finance team to put them in place.

This guide explains what internal financial controls are, which ones small businesses need, who should perform them, how often to check them and how to set them up with limited staff.

At The Taxcom, we are a Manchester-based tax advisory and accountancy firm, and we regularly see how a handful of simple internal controls can prevent costly problems.

What Are Internal Financial Controls?

Internal financial controls are the rules, checks and routines that protect your money, keep your financial data reliable and reduce the chance of mistakes or fraud. They sit around your day-to-day transactions: who can spend, who approves, who records and who checks.

They are not the same as keeping your books. Your bookkeeping records capture what happened. Controls make sure what was recorded is correct, authorised and complete. Good controls support accurate financial reporting and give you reliable data for tax returns, VAT returns and decisions about cash.

The law also expects a baseline. Section 386 of the Companies Act 2006 requires every company to keep adequate accounting records, sufficient to show and explain its transactions and to disclose its financial position with reasonable accuracy at any time. Controls are how you make sure those records can be trusted.

For the official guidance, see New failure to prevent fraud guidance published.

Why Do Small Businesses Need Financial Controls?

Small businesses are often more exposed than large ones. One person may raise invoices, receive cash, pay suppliers and write up the books. That concentration of tasks creates the opportunity for both honest mistakes and deliberate misuse.

Sound controls have the five categories of benefits:

Protect cash and other assets: stop unauthorised payments and loss of stock, equipment or intangible assets.
Prevent accounting fraud: make it harder for anyone to hide false entries or diverted payments.
Improve accuracy: catch duplicate invoices, miscoded expenses and missed income early.
Meet your obligations: support correct tax, VAT and payroll reporting to HMRC.
Make better decisions: rely on financial statements that reflect reality.

Fraud prevention is also firmly on the government’s agenda. The Home Office guidance on the failure to prevent fraud offence applies only to large organisations, but it states that its principles represent good practice that may help smaller organisations. Those principles include risk assessment, proportionate procedures and regular monitoring and review. All of them translate well to a small business.

Do Charities Need Internal Financial Controls?

Yes. For charities in England and Wales, the Charity Commission makes clear that all charities need suitable financial controls regardless of size. A charity’s internal financial controls help protect its money and property, maintain reliable records and ensure resources are being used for the purposes intended.

Charity trustees retain overall responsibility for the charity’s funds and financial management. Controls should therefore help trustees meet their legal obligations, identify problems early and manage risks affecting the charity’s assets.

Restricted and endowment funds should be identified separately so that income and spending can be traced to the correct fund.

A larger organisation may delegate detailed monitoring to a finance sub-committee, audit committee or risk management committee. However, this does not transfer ultimate responsibility away from the charity trustees. Trustees should continue to receive clear financial information and review whether controls remain proportionate to the organisation’s activities.

The Core Principles Behind Robust Controls

Whatever your size, robust controls rest on a few ideas. You can apply each one with very little cost.

Segregation of Duties

No single person should control a transaction from start to finish. The person who requests a payment should not be the one who approves it, and the person who approves it should not be the one who records it. In a very small team, you can split the steps between two people, or between you and your accountant.

Authorisation and Approval Limits

Set clear limits for who can commit the business to spending. For example, a manager may approve purchases up to £500, while anything above that needs the director’s sign-off. Anything unusual should always need a second person. Arrange security measures for data breaches.

Documentation and a Clear Record

Every transaction should leave a clear record: an invoice, a purchase order, a receipt or an email approval. If you cannot evidence it, you cannot defend it in a dispute or an HMRC enquiry.

Regular Review and Risk Assessment

A simple risk assessment asks where money could go missing or be misreported. Identify the key risks in your business, then match a control to each one. Review them at least once a year and whenever the business changes, because new risks appear as you hire staff, add products or open new bank accounts.

Manual and Automated Financial Controls

Financial controls can be manual, automated or a combination of both. A manual control might involve a different person reviewing and approving a payment before it is released. An automated control could prevent a user from approving financial transactions above their authorised limit or flag duplicate supplier invoices automatically.

In practice, combining the two is often more effective. Automation can improve efficiency and reduce repetitive checking, while human review provides judgement where a transaction is unusual or higher risk. The aim is not to automate every process, but to use technology where it supports the efficient conduct of routine financial tasks without removing meaningful oversight.

Preventive Controls and Detective Controls Explained

Controls fall into two broad groups. You need both.

Feature	Preventive controls	Detective controls
Purpose	Stop errors and fraud before they happen	Find problems that have already occurred
Timing	Before or during a transaction	After a transaction
Examples	Approval limits, dual authorisation, restricted system access	Bank reconciliations, budget-to-actual reviews, stock counts
Cost and effort	Set up once, then built into routine	Repeated on a schedule
Main weakness	Can be bypassed if one person has too much access	Problems are found late, after money may be lost

Preventive controls reduce the chance of loss. Detective controls limit the damage and show you where your preventive controls are weak. A business relying on only one type is carrying avoidable risk.

Practical Internal Financial Controls Every Small Business Should Have

The following controls cover the areas where small businesses lose money most often. Pick those that match your risks and build them into your routine.

Controls Over Cash Received and Sales

Record cash received promptly: log takings daily and bank them intact, rather than paying suppliers from the till.
Use numbered invoices: keep sequential invoice numbers so a missing one stands out.
Separate roles: the person who raises invoices should not also be the only person who records receipts.
Chase and review debtors: check the list of overdue customers monthly and query any write-offs.

Controls Over Payments and Bank Accounts

Dual authorisation: require more than one person to approve bank transfers above a set amount.
Limit access: restrict who can set up new payees, change supplier bank details or amend a standing order.
Verify changes: call a known number to confirm any change in supplier bank details before paying.
Keep bank accounts tidy: close unused accounts and review who has access at least twice a year.

Invoice redirection scams are a real risk. The government’s Fraud Strategy 2026 to 2029 notes that criminals intercept legitimate emails and send fake invoices, with losses ranging from hundreds to millions of pounds. A call-back check is a cheap and effective preventive control.

Controls Over Purchases and Expenses

Purchase orders: raise one for larger spends, and match it to the delivery note and supplier invoice before paying.
Expense claims: require receipts and a manager’s approval, and check for duplicates.
Company cards: set limits, and review statements monthly against receipts.

Controls Over Payroll

Verify new starters and leavers: check every addition and removal against signed paperwork.
Review the payroll report: compare each month’s totals to the last and investigate unexplained changes.
Restrict changes: only an authorised person should amend pay rates or bank details.

Payroll errors can lead to HMRC penalties as well as lost cash, so this is an area where outsourcing to a dedicated provider can strengthen your control environment.

Controls Over VAT

Check VAT on every purchase invoice: make sure it is valid before reclaiming it.
Reconcile the VAT control account: compare it with your return before you submit.
Review treatment: make sure sales and purchases are coded correctly. Our guide to input VAT and output VAT explains the difference.

Controls Over Fixed Assets and Stock

Public companies should:

Keep a fixed assets register: record what you own, where it is and what it cost.
Check physically: compare the register to the assets themselves at least once a year.
Count stock: carry out regular stock counts and investigate differences.

You can also arrange professional external audits for a second layer of security.

Bank Reconciliations: The Most Important Detective Control

If you only introduce one detective control, make it regular bank reconciliations. A reconciliation compares your accounting records to your bank statements and explains every difference. It will reveal duplicate payments, unrecorded transactions, payments you do not recognise and errors in the ledger.

To make bank reconciliations effective:

Reconcile every bank account and card account, at least monthly (weekly if volumes are high).
Match each line on the bank statements to a supporting record.
Investigate any unreconciled items older than 30 days.
Have someone other than the person who makes payments review and sign the reconciliation.
Keep the signed reconciliation on file as evidence.

The fourth step matters most. A reconciliation prepared and reviewed by the same person as the one making payments offers far weaker protection.

A Worked Example: Stopping a Fraudulent Payment

Consider a small building supplies company with a director, an office manager and an outside bookkeeper. Previously the office manager raised supplier payments, approved them and entered them in the accounts.

Over eight months, the office manager added a fake supplier and paid it £1,850 a month, a total of £14,800. Nobody noticed, because the same person controlled every step and nobody reviewed the bank statements.

After the loss was found, the director introduced three controls:

Approval: every payment batch needs the director’s authorisation in online banking.
New supplier checks: the bookkeeper confirms any new supplier’s details independently before setting them up.
Monthly review: the director reviews the bank reconciliation and the supplier payment list.

The fake payee would now have been spotted in the first month. The fix cost almost nothing, only a few minutes each month. It shows how segregating duties and one review step can prevent most small-scale accounting fraud.

Who Should Perform Each Control and How Often?

You do not need an internal audit function or an audit committee to assign responsibility clearly. The table below shows a practical split for a business with a small finance team.

Control	Who performs it	Who reviews it	Frequency
Payment approval	Director or senior manager	Bookkeeper (matches to invoices)	Every payment run
Bank reconciliations	Bookkeeper	Director	Monthly (weekly if busy)
Supplier bank detail changes	Bookkeeper	Director (call-back check)	Each change
Payroll report review	Payroll provider	Director	Each pay run
Budget to actual review	Bookkeeper or accountant	Director	Monthly or quarterly
Fixed assets and stock check	Office manager	Director	Annually (stock more often)
Access rights review	Director	Accountant	Twice a year
Risk assessment	Director	Accountant or adviser	Annually

For routine tasks such as coding and ledger tidying, you may prefer a ready-made approach to bookkeeping for small businesses. This article concentrates on the controls that sit above that routine.

How to Implement Financial Controls With Limited Staff

A small business cannot always separate every duty. That does not mean you go without controls. It means you use compensating measures.

Map your money flows: list how money comes in, goes out and is recorded.
Identify the key risks: note where one person has unchecked control.
Assign owners: give each control to a named person and a named reviewer.
Use technology: set approval workflows and user permissions in your accounting software and online banking.
Involve an outsider: have external auditor, like your accountant or bookkeeper review bank statements and unusual items.
Write it down: keep a short procedures document, even one or two pages.
Train and communicate: make sure staff know what is expected and how to raise concerns.
Review and improve: revisit your controls each year and after any significant change.

If you are the only person in the business, the owner reviewing unfiltered bank statements monthly, with an outside accountant checking the books, is a realistic and effective control.

At The Taxcom, we often recommend starting with the highest-risk area, usually payments and bank access, rather than trying to build a full framework in one go. If you want to stand back and look at how controls fit your wider plans, our guide to what a business audit involves shows how an independent review can test them.

Common Mistakes With Internal Financial Controls

One person doing everything: the same individual raises, approves, pays and records transactions.
Shared logins: passwords shared between staff mean nobody can be held accountable.
No review of bank statements: reconciliations are done, but nobody independent reads them.
Leaving former staff with access: leavers keep access to banking, software or cards.
Verbal approvals only: no record shows who authorised a payment.
Setting controls once and forgetting them: the business grows but the procedures do not.
Ignoring the owner’s own spending: director loan account transactions need controls too.

What If Your Internal Audit Controls Reveal a Problem?

Sometimes a control works and exposes an error or loss. Act quickly. Secure the bank accounts, preserve the records and establish the facts before confronting anyone. If the problem has led to underpaid tax or VAT, correcting it early is usually the better route, and our guide to voluntary disclosure to HMRC explains how that works.

Where fraud is suspected, a detailed analysis of the transactions may be needed. We at The Taxcom provide forensic accounting for disputes and investigations.

Strengthening Your Controls With The Taxcom

The right support can turn a set of good intentions into control processes that actually run each month and help you maintain compliance and stay safe.

Bookkeeping: accurate, up-to-date records are the foundation for reconciliations and review. Having a second person maintain the books also helps with segregation of duties.
Management Accounting: regular management accounts let you compare results to budget and spot unusual movements, which is a key detective control.
Forensic Accounting: if you suspect a loss or irregularity, detailed financial analysis helps establish what happened and supports any dispute or investigation.

Frequently Asked Questions

What are internal financial controls in simple terms?

They are the procedures that protect your money and keep your accounts accurate. Examples include approval limits, bank reconciliations and separating who pays, records and reviews transactions.

Do small businesses legally need internal financial controls?

There is no single rule requiring a specific control set for small businesses. However, companies must keep adequate accounting records under section 386 of the Companies Act 2006, and controls are how you make those records reliable.

How can I prevent accounting fraud with only a few staff?

Split key steps between two people, require a second approval on payments and have the owner or accountant review bank statements. Even one independent review each month greatly reduces the opportunity for fraud.

What is the difference between preventive and detective controls?

Preventive controls stop problems before they happen, such as approval limits. Detective controls find problems afterwards, such as bank reconciliations and budget reviews.

Do I need an audit committee or internal auditors?

No. Most small businesses do not need either. A director, a separate reviewer and an outside accountant can perform the same checks in a proportionate way. Contact our taxation experts for more guidance.

Review Your Controls With The Taxcom

If you are unsure where your weak points are, a short review of your payments, bank access and reporting is a sensible place to start. Our Tax Advisory team can look at how your current procedures affect your tax position and suggest practical improvements. If a control has uncovered something that concerns HMRC, our Tax Investigations support helps you respond with confidence.

Book a personal consultation and we will help you build controls that fit your business.

Note: This is general guidance, not professional advice. Contact our tax advisors for personalised advice.