Safeguarding of assets in internal controls is the system of policies, records, and physical and digital protections a company uses to keep its resources from being stolen, misused, or lost. It is not a nice-to-have. Officers and directors owe a fiduciary duty of care, meaning they must manage company resources with the diligence a reasonably prudent person would use in the same circumstances.1Legal Information Institute. Duty of Care When that duty is breached through bad faith or gross negligence, courts can hold individual directors personally liable. So the practical answer to what safeguarding requires is: enough documented control over your assets that a court, an auditor, or an insurer would find your conduct reasonable.
Five components carry most of the weight: an accurate record of what you own, separation of who does what, physical and digital security, insurance transferring the residual risk, and periodic reconciliation to confirm the controls are working. People controls, including screening and whistleblower protection, tie the system together.
Know What You Own
You cannot protect what you have not counted. A comprehensive asset register is the foundation. Every resource gets logged: liquid assets like petty cash and undeposited checks, fixed assets like machinery and office furniture, and intangible assets like proprietary software and customer databases. Fixed assets should carry manufacturer serial numbers, acquisition dates, cost centers, and internal tag numbers. Intangibles need entries for storage location and access.
A standardized acquisition form captures this data when an asset arrives. The receiving department head signs off, and the item is categorized by risk level. Highly portable items like laptops or specialized tools get flagged for more frequent tracking, since those walk out the door most easily. Risk-tiering puts your monitoring effort where loss is most likely, rather than treating a $30 stapler like a $3,000 laptop.
Good records serve downstream purposes too. The IRS requires businesses to keep property records long enough to calculate depreciation and determine gain or loss on disposal, which usually means until the limitations period expires for the tax year you dispose of the property.2Internal Revenue Service. How Long Should I Keep Records If you received property through a nontaxable exchange, you need records for both the old and new property. An accurate register also speeds insurance claims after a fire or storm, because it gives you documented replacement values rather than guesswork.
Segregation of Duties
The single most effective structural control against internal fraud is making sure no one person can authorize a transaction, execute it, and record it. The employee who handles incoming cash should not reconcile the bank statements. The person who approves vendor payments should not cut the checks. When one employee’s work automatically verifies another’s, fraud requires collusion rather than just opportunity.
For publicly traded companies, Section 404 of the Sarbanes-Oxley Act requires management to assess and report annually on the effectiveness of internal controls over financial reporting, and an independent auditor must separately attest to that assessment.3U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control over Financial Reporting Requirements Courts also weigh the quality of internal controls when assessing damages in fraud cases. An organization with no meaningful separation of duties can look grossly negligent, which opens the door to larger civil awards. Management should define roles in written job descriptions and enforce those boundaries consistently.
When You Do Not Have Enough Staff
Full segregation is a luxury that requires enough people to divide work among. A three-person accounting department can manage it; a one-person shop cannot. When staffing makes true segregation impossible, compensating controls fill the gap. The most important single step is at least one outside set of eyes on financial activity: a board member, an outside accountant, or even a peer organization that swaps oversight duties.
Practical compensating controls include having someone other than the bookkeeper open the bank statements and review them for unusual activity, unannounced spot checks of cash drawers, a second signature on checks above a set dollar threshold, and periodic rotation of job assignments so employees review each other’s work. Accounting software helps by enforcing user-level permissions so the person entering invoices cannot also approve payments. If the software cannot enforce that separation, someone outside the process needs to review every transaction.
Physical and Digital Security
Physical assets need physical barriers. Restricted zones with electronic card readers that log every entry and exit are standard in any facility with significant inventory or equipment. High-value items like cash reserves or confidential documents belong in vaults with dual-custody locking mechanisms, meaning two people must be present to open them. Surveillance cameras at entry points and loading docks give you a continuous visual record of asset movement. When someone leaves the company, their credentials should be revoked the same day.
Vault ratings matter for insurance. Underwriters often require a specific classification before issuing a high-value policy, and buying the wrong vault means either paying for coverage you cannot collect on or discovering during a claim that your safe did not meet the policy terms.
Digital assets need a layered approach: multi-factor authentication for all financial systems, role-based access so employees only reach the data they need, enterprise-grade firewalls, intrusion detection, and encryption for data both at rest and in transit. IT administrators should configure permission levels tightly and review credentials quarterly. When someone changes roles or leaves, digital access should be adjusted as quickly as the physical badge.
Remote Work
Remote employees extend your security perimeter to every home office. The governing principle is zero trust: no access request gets trusted automatically, every user and device proves identity before connecting, and behavior is monitored continuously for anomalies. Endpoint detection and response tools use behavioral monitoring to catch attacks that slip past traditional antivirus. Conditional access policies can adapt requirements based on context, blocking a login from an unfamiliar location or an unhealthy device.
What Cyber Insurers Now Expect
Cyber underwriters have become specific about the controls they expect before issuing or renewing a policy. Multi-factor authentication across remote access, email, and privileged accounts is essentially a prerequisite. Carriers also commonly require endpoint detection and response tools, a documented patch management program with critical patches applied within defined timeframes, offline or immutable backups separated from production systems, regular security awareness training with phishing simulations, and a written incident response plan with defined escalation paths. Failing to maintain these controls can void coverage or result in denied claims after a breach.
Insurance and Fidelity Bonding
Controls reduce risk; they do not eliminate it. Insurance transfers what remains. Commercial crime policies cover losses from employee theft of money, securities, or property. The coverage goes by several names, including employee dishonesty coverage and fidelity bonding, but the function is the same: reimbursing the organization when an insider steals.
For employee benefit plans, ERISA imposes a mandatory bonding requirement. Every person who handles plan funds must be bonded for at least 10% of the funds they handled in the preceding year, with a minimum bond of $1,000 and a maximum generally capped at $500,000 per plan. Plans holding employer securities face a higher cap of $1,000,000.4Office of the Law Revision Counsel. 29 USC 1112 – Bonding If your organization administers a retirement or benefit plan, the people touching those funds must be bonded or you are already out of compliance.
Reconciliation and Response
Controls are only as good as your willingness to check whether they are working. Periodic reconciliation means physically counting assets and comparing the count to what the books say. For inventory, that is a literal count matched against the register. For cash, it is matching the ledger balance to the monthly bank statement. Discrepancies get documented on a formal reconciliation report. Small variances might close with a journal entry. Large or unexplained gaps should trigger an internal investigation.
Findings typically flow to the internal audit department or an oversight committee. Reconciliation documentation must be retained for at least seven years under SEC rules governing audit records.5eCFR. 17 CFR 210.2-06 – Retention of Audit and Review Records Destroying, altering, or concealing those records with intent to obstruct a federal investigation is a separate crime carrying up to 20 years in prison.6Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations
If reconciliation uncovers suspected embezzlement, the organization can seek a writ of attachment, a court order that freezes the suspect’s property before trial. The U.S. Marshals Service executes these writs, seizing and holding assets under court supervision while litigation proceeds.7U.S. Marshals Service. Writ of Attachment That preserves the possibility of recovery instead of letting a suspected thief move or spend the funds before judgment.
What Rises to a Material Weakness
Not every discrepancy gets the same response. Auditors distinguish between a significant deficiency, a control problem important enough to flag for oversight, and a material weakness, meaning there is a reasonable possibility that a material misstatement in the financial statements will not be caught in time.8Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit There is no fixed dollar threshold. Auditors evaluate whether a reasonable investor would view the misstatement as significantly changing the total mix of available information.9Public Company Accounting Oversight Board. AS 2105 – Consideration of Materiality in Planning and Performing an Audit Both quantitative size and qualitative factors matter. A small dollar discrepancy in executive compensation can be material because of what it implies about management integrity, even when the number itself is not large relative to revenue.
People Controls
Hiring the right people is the first line of defense. For positions involving cash, inventory, or financial systems, background and credit checks are common screening tools. Under the Fair Credit Reporting Act, an employer must provide a clear written disclosure and get the applicant’s written consent before pulling a credit report for employment purposes.10Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports If the employer decides not to hire based on the report, they must first give the applicant a copy of the report and a written summary of rights before taking that adverse action. A growing number of states also restrict when credit checks may be used at all, often limiting them to roles with direct financial responsibility. The safest practice is to run credit checks only for positions where the connection to financial responsibility is obvious and documented.
Controls also work because employees know someone is watching, and that only holds if the people who spot problems feel safe reporting them. The Sarbanes-Oxley Act protects employees who report concerns about financial fraud or internal control failures. Under 18 USC 1514A, employers cannot retaliate, and retaliation is defined broadly to cover firing, demotion, pay cuts, intimidation, reassignment to less desirable work, blacklisting, and subtler actions like isolation or false accusations of poor performance.11Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases OSHA enforces the provision and can order reinstatement, back pay, and other corrective relief. Organizations serious about safeguarding should build anonymous reporting channels, train staff to use them, and make clear that retaliation will result in discipline. A hotline nobody trusts is the same as no hotline at all.