Key takeaways
- Internal control does not mean distrusting people. It guards against both mistakes and fraud, and it also protects the people doing the work.
- The size of the loss depends on how quickly it is detected, which is why regularly checking bank balances matters so much.
- A small company cannot fully segregate duties, so it needs compensating controls, with the owner acting as the reviewer.
An employee has worked for ten years, and the owner trusts them enough to hand over the bank login. One day a supplier calls to chase a payment that the books say has already been made. Looking back, unusual payments turn out to have been going out for several months. Owners often blame themselves for trusting the wrong person, which is only half true. The other half is that the company allowed one person to carry out every step.
Locking the house does not mean distrusting your children, and a control system does not accuse any particular employee. A good system also protects honest people, because when a balance is wrong, there is evidence showing it was not their fault.
Core principles
The most widely used international framework is COSO Internal Control, but a small company does not need to start with a large set of documents. Start with a question that is easy to answer: can one person initiate a transaction, approve it, pay it and record it in the books without anyone else seeing? If so, that point is still open.
| Cycle | Risk point | Minimum control |
|---|---|---|
| Cash and bank | One person creates and approves transfers | Separate the person who initiates from the person who approves in internet banking, and send transaction alerts to the owner |
| Purchasing and payables | Fake suppliers, changed bank account numbers | Changing a supplier's bank account number requires a call-back to the original number and an approver |
| Sales and receivables | Cash received but not banked, credit notes issued without reason | Have customers transfer into the company account, and approve credit notes |
| Inventory | Loss, count discrepancies | The person counting is not the person issuing stock; run random counts |
| Payroll | Ghost employees | The owner compares the name list and the total every month |
| Petty cash | Over-withdrawal, spending without documents | Set a fixed limit, replenish only when documents are complete, and carry out random counts |
Example: detection time equals the loss
Hypothetical example: THB 5 million leaks over 26 weeks at a constant rate, about THB 0.19 million per week
| Check | Time to detection | Estimated loss (THB million) |
|---|---|---|
| No checks; discovered when the supplier chases payment | 26 weeks | 5.00 |
| Independent monthly reconciliation | 4.33 weeks | 0.83 |
| Owner reviews bank transactions weekly | 1 week | 0.19 |
Controls do not guarantee that no loss will occur, but they limit the damage, and people who know someone will check think twice.
What small teams can do
A company with only one accounting employee cannot fully segregate duties, so it must use compensating controls.
- The owner approves every payment, or approves every transaction above a set limit.
- The owner views the statement personally, with read-only access, rather than using files sent by the employee.
- Have an external accounting firm perform the bank reconciliation or carry out spot checks.
- Require key employees to take one continuous period of annual leave each year, with someone covering their work during that time.
- Keep passwords and access rights personal to each individual, and prohibit sharing.
If you suspect fraud, do not confront anyone or make an announcement straight away. Preserve documents and system data, restrict only the access that is necessary, and consult a lawyer before investigating, filing a police report or dismissing anyone, because the steps taken affect the case and the rights of all parties.
Controls people can actually work with
Overly complex controls will be worked around, for example by splitting purchase orders to avoid waiting for an approver, or by sharing passwords because the owner is unavailable. Start with the high-value items or those that can easily be turned into someone else's money, then add only the controls that are necessary. A good test is to ask: if the owner travels for two weeks, can the system still work, and can someone else check the transactions?
An effective control must leave a trail that can be checked, such as a signature in the system, the date and time, the preparer, the reviewer and supporting documents. If a check exists only in one person's memory, then when a problem arises it cannot be proved that the check took place. Documentation need not be long. For many items, a one-line note in the system stating who reviewed it, on what date and what they found is enough.
Signs that should prompt the owner to ask more questions include an employee who never takes leave, who will not let anyone touch their work, a new supplier with no clear information, original documents that often go missing, repeated round-figure transfers, or customer discounts with no reason. These signs do not prove fraud, but they are a reason to check the facts quietly. The owner should not use the system to catch out any one person, but should apply it equally to everyone, including family members and themselves.
Next steps
- Map the cash receipt and payment cycle, then identify the points where one person can complete every step
- Separate internet banking access rights and turn on alerts for every transaction
- Define the procedure for changing a supplier's bank account number
- The owner reviews the statement at least once a week
- Perform a monthly bank reconciliation with a reviewer
- Use the recommendations in the management letter as an improvement list
- Review system access rights when employees change roles or resign