Five internal controls every growing SME needs
Segregation of duties, approvals and reconciliations that protect cash as you scale.
1. Segregation of duties
The person who approves a payment should not be the one who records it or reconciles the bank. In a small team, compensate with owner review of bank statements.
2. Approval limits
Write down who can commit spending and up to what amount. Require two signatures above a threshold on the banking platform.
3. Monthly bank and supplier reconciliations
Reconcile every bank account monthly, investigate differences and keep the evidence signed and dated. Reconcile supplier statements to catch duplicate or fictitious invoices.
4. Supplier master-data control
Changes to supplier bank details are a classic fraud route. Confirm any change by phone using a number already on file, never the one in the change request.
5. Access and records
Give each user their own login in the accounting system, remove access when people leave and back up data. These five controls reflect the COSO Internal Control framework in a form an SME can run.