Internal controls for small businesses are the everyday rules that decide who can spend money, who can touch it, and who writes down what happened. Get those three jobs into different hands and you cut your fraud exposure sharply. The Association of Certified Fraud Examiners put the 2024 median fraud loss at businesses with fewer than 100 employees at roughly $141,000 per incident, and the companies that get hit hardest are almost always the ones that trusted a single person with the full transaction cycle.
What follows is a working set of controls a small business can actually implement, along with the compensating steps to take when your headcount is too low for a clean separation.
Separate the Three Jobs
The single most important control in any business is making sure no one person carries a transaction from start to finish. Three functions need to stay in separate hands: authorizing the transaction, holding the asset, and recording it in the books. When one employee can approve a purchase, receive the goods, and enter the invoice, you have opened a lane for fraud that needs no accomplice.
Some practical splits: the person who writes a check should not be the person who signs it, and a third person should record the payment in the general ledger. The employee who opens the mail and lists incoming checks should not be the one making bank deposits. The person who reconciles the bank account should not handle cash. These separations force collusion, which is harder to arrange and far more likely to surface.
When You Don’t Have Enough People
If you have three employees or fewer, full segregation is impossible. You simply don’t have the bodies. The answer is not to give up; it is for the owner to become the compensating control. The work is unglamorous and it takes 30 to 60 minutes a month.
- Get the bank statement yourself, before anyone else opens it. Scan for unfamiliar vendors, electronic payments to employees that weren’t authorized, ATM withdrawals, and payments to services like PayPal or Venmo that sit outside your normal channels. If your bank provides check images, verify the payee lines match what you expected.
- Sample transactions each month. Pull a handful at random and match the invoice to the purchase order to the receiving report. When employees know the owner spot-checks their work, the incentive to process something unauthorized drops.
- Compare budget to actuals monthly. If office supply spending doubled, or an annual subscription shows up three times, you’ll see it here.
- Turn on the exception reports in your accounting software. Deleted transactions, duplicate payments, and entries over a set dollar amount can all be flagged automatically. Read the reports.
None of this requires accounting expertise. It requires the owner to stay involved in the financial details rather than delegating everything to one bookkeeper.
Set Approval Limits for Spending
Every dollar leaving your business should pass through an explicit approval, and the size of the expense should determine how high up that approval goes. A tiered system works for most small businesses: a manager can approve routine purchases up to a set amount, and anything above that requires the owner. Pick dollar limits that fit your cash flow.
General authorizations cover predictable recurring expenses, like office supplies inside a pre-approved monthly budget. Specific authorizations are reserved for unusual or high-dollar commitments: a commercial lease, an equipment purchase, new debt. Routine spending needs to flow without bottlenecks, and large commitments need a second set of eyes before they become binding.
Electronic signatures carry the same legal weight as paper signatures for most business transactions. The E-Sign Act treats an electronic sound, symbol, or process attached to a record and adopted with intent to sign as a valid signature.1Federal Deposit Insurance Corporation. The Electronic Signatures in Global and National Commerce Act (E-Sign Act) Digital approval workflows leave a cleaner audit trail than wet signatures, because they log who approved what, when, and from which device.
Handle Cash Safely
Cash is the asset most vulnerable to theft because it is anonymous once it leaves your hands. The rule: no single employee handles cash from receipt through deposit and recording. The bookkeeper should not touch incoming cash or checks, and the person making deposits should not reconcile the bank account.
Daily deposits are non-negotiable for any business that receives cash. The amount deposited each day should match the day’s receipts exactly. If Tuesday brought in $2,400, a $2,400 deposit hits the bank that day or the next morning. Holding cash on-site for multiple days creates opportunity and temptation in equal measure. A daily cash summary listing every receipt, tied to the deposit slip, closes the loop.
The owner’s role is direct: look at canceled checks before they reach the bookkeeper, watch for checks made out to unfamiliar names, and question any cash discrepancy immediately rather than waiting for month-end.
Lock Down Records and Systems
Physical controls are the simplest. Keep daily receipts and petty cash in a safe with limited access. Lock inventory storage and issue keys only to employees who need them. Keep a log of who enters secure areas. These measures prevent theft and narrow the suspect list when something goes missing anyway.
Digital security for financial records takes more planning. The National Institute of Standards and Technology recommends that small businesses limit access to sensitive systems to employees who need it, enable multi-factor authentication on every account that offers it, and keep software and operating systems patched.2National Institute of Standards and Technology. Small Business Cybersecurity – NIST IR 7621 Revision 2 Use standard user accounts for daily work rather than administrator accounts, and change the default manufacturer passwords on routers, printers, and other network-connected devices.
Back up your accounting data regularly, with at least one copy on media disconnected from your network, like an external drive stored off-site. Ransomware that encrypts your financial records can halt the business overnight, and a disconnected backup is often the only recovery path that doesn’t involve paying a ransom or rebuilding from scratch.
If You Handle Customer Financial Data
The FTC’s Safeguards Rule imposes mandatory data security requirements on businesses that are “financial in nature.” The definition reaches further than most owners assume: tax preparers, collection agencies, mortgage brokers, check cashers, credit counselors, and investment advisors are all covered, among others. Covered businesses must designate a qualified individual to oversee data security, run a written risk assessment, encrypt customer information in storage and in transit, implement multi-factor authentication for anyone accessing customer data, and maintain a written incident response plan. A breach affecting the unencrypted records of 500 or more consumers has to be reported to the FTC within 30 days.3Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know If none of those business types describe you, this rule doesn’t apply, but the underlying practices are still sound.
Standardize Documentation and Keep It Long Enough
An audit trail is only as good as the documents feeding it. Use pre-numbered invoices and purchase orders so every transaction has a place in a sequence and gaps show. Match receiving reports against packing slips to confirm you actually got what you paid for. Paying for goods never received is one of the most common billing fraud schemes, and this simple matching step prevents it.
The IRS requires that supporting documents identify the payee, the amount paid, proof of payment, the date the expense was incurred, and a description of the item or service.4Internal Revenue Service. What Kind of Records Should I Keep Retention periods vary by situation:
- Three years from the filing date for most income tax records.
- Six years if you failed to report income exceeding 25% of the gross income shown on your return.
- Seven years if you claimed a deduction for bad debts or worthless securities.
- Four years for all employment tax records, measured from when the tax was due or paid, whichever is later.
- Indefinitely if you didn’t file a return or filed a fraudulent one.
Records tied to property should be kept until the statute of limitations expires for the year you dispose of the property, since you’ll need them to calculate depreciation and gain or loss on sale.5Internal Revenue Service. How Long Should I Keep Records
You can keep digital copies in place of paper originals, but the IRS expects the electronic storage system to accurately transfer information from the originals, include controls preventing unauthorized alteration or deletion, produce legible reproductions on demand, and support cross-referencing between your general ledger and the source documents.6Internal Revenue Service. Revenue Procedure 97-22 You can destroy paper originals once testing confirms the electronic system reproduces them accurately. Run the system through a cycle before shredding anything.
Reconcile Every Month
Reconciliation is where fraud actually gets caught. The concept is simple: compare what your books say to what an independent source says, and investigate every difference. A monthly bank reconciliation matches your check register against the bank statement, surfacing outstanding checks, deposits in transit, bank fees not yet recorded, and any transaction you didn’t authorize. If the person doing the reconciliation is not the person who handles cash and deposits, you have built in a natural detection layer.
Physical inventory counts work the same way. Count the stock on your shelves and compare it to the ledger. Variances reveal shrinkage from theft, receiving errors, or bad record-keeping. Quarterly counts are a reasonable minimum, though high-value or high-volume inventory may warrant monthly. Document every variance and investigate it, even when the dollar amount looks small. Persistent small discrepancies often signal a systematic problem rather than random error.
For bank statements specifically, the highest-value habit is a 15-minute owner review before the statement reaches the reconciler. Check images, unfamiliar payees, electronic payments outside normal operations — this catches things a bookkeeper either won’t notice or won’t report.
Carry Insurance as a Backstop
Controls reduce fraud risk. They don’t eliminate it. Fidelity bonds and crime insurance cover losses from employee dishonesty, forgery, computer fraud, and similar theft, acting as a financial backstop when controls fail. If you carry a policy, the insurer will almost certainly want to see that you had reasonable controls in place before paying a claim. That means documented segregation of duties (or compensating owner controls), regular reconciliations, and organized records. A policy that pays out after a six-figure embezzlement is worth far more than its annual premium, but a claim filed without supporting documentation can be denied or reduced.
The Tax Penalty for Sloppy Records
Poor internal controls carry a direct tax cost beyond the fraud risk. The IRS defines negligence to include failing to keep adequate books and records, and the penalty for a negligence-caused underpayment is 20% of the underpaid tax. If your records can’t substantiate the deductions you claimed, the IRS can disallow those deductions and add the 20% penalty on top.7Internal Revenue Service. Accuracy-Related Penalty
If your documentation can’t produce a receipt, invoice, or bank record to back up a line item on your return, you’re exposed to both the lost deduction and the penalty. That is where the hours spent on standardized documentation pay for themselves many times over.