Internal Controls for Small Business: Checklist

Internal controls are the everyday checks that keep a business's money safe and its numbers accurate: who can approve a payment, who reconciles the bank account, how invoices are numbered, and who reviews the results. For a small business, good internal controls do not mean bureaucracy. A handful of well-chosen controls, many of them taking minutes a month, prevent most errors and make fraud far harder to commit or hide.

This guide explains the five components of internal control in plain language, lists practical controls for cash, invoicing, payables and payroll, and gives a monthly checklist for owners. It draws on the latest fraud data so you can focus where losses actually happen.

Why internal controls matter: what the 2026 fraud data shows

The Association of Certified Fraud Examiners' Occupational Fraud 2026: A Report to the Nations analyzed 2,402 cases from 143 countries. Coverage of the study reports a median loss of $104,000 per case, an estimated 5% of revenue lost to fraud each year, a typical duration of about 12 months before detection, and 43% of frauds detected through tips. Asset misappropriation, such as stealing cash, billing schemes and fake expense claims, remains the most common type. Small organizations continue to suffer some of the highest median losses relative to their size, and they typically have fewer anti-fraud controls in place.

The same research points to controls like management review, surprise audits and proactive data monitoring as associated with lower losses and faster detection. In short: someone looking regularly at the numbers is one of the best defenses.

The five components of internal control (COSO)

Most internal control guidance is based on the COSO Internal Control Integrated Framework, updated in 2013, which sets out five components supported by 17 principles. The COSO guidance is written for organizations of all sizes. Translated for a small business:

Component	What it means	Small business example
Control environment	Tone at the top, ethics, clear responsibilities	Owner follows the same rules; written roles for who handles money
Risk assessment	Identifying where errors or fraud could happen	Listing the ways cash leaves the business and who can trigger each
Control activities	Specific approvals, checks and restrictions	Dual approval on payments, three-way match, sequential invoices
Information and communication	Reliable reports reaching the right people	Monthly financial pack; staff know how to report concerns
Monitoring activities	Checking that controls work and fixing gaps	Owner reviews reconciliations; annual review by an accountant

Practical internal controls by process

Cash receipts and invoicing

• Number invoices sequentially and investigate gaps; never delete an issued invoice. See our invoice numbering system guide.
• Have customers pay electronically into the business account; minimize cash and checks handled by staff.
• Separate who issues invoices or credit notes from who records payments, or have the owner approve credit notes.
• Review the accounts receivable aging report monthly; unexplained write-offs are a classic warning sign.
• Send customer statements periodically so customers flag payments that were not credited.

Purchases and payables

• Approve new vendors before the first payment, verifying bank details by phone using a number you already have. Our vendor onboarding checklist covers the steps.
• Match supplier invoices to purchase orders and delivery records with a three-way match for significant purchases.
• Use an invoice approval workflow with amount limits.
• Check for duplicates before paying; see our guide to preventing duplicate invoice payments.
• Treat any request to change a supplier's bank details as suspicious until verified; invoice scams often start this way.

Banking and payments

• Reconcile every bank and card account monthly, and have the owner review and sign off. Our bank reconciliation guide shows how.
• Require two approvers for outgoing payments above a set amount, using the bank's dual-control feature.
• Use positive pay and ACH debit blocks where your bank offers them.
• Owner receives bank alerts and statements directly, not filtered through the bookkeeper.

Payroll and expenses

• Owner reviews the payroll register each run for unfamiliar names, rate changes and unusual overtime.
• Changes to pay rates or bank details require written approval.
• Expense claims need receipts and manager approval; review company card statements monthly.

Segregation of duties when the team is tiny

The classic control is splitting four duties between different people: authorizing transactions, holding assets such as cash, recording transactions, and reconciling. In a business with one bookkeeper, that is impossible, so the owner becomes the second person. The bookkeeper records and prepares payments; the owner approves and releases them, receives bank statements, and reviews the reconciliation. Our guide to segregation of duties in a small team has role-by-role examples, and employee embezzlement warning signs lists the behavioral red flags to watch.

Worked example: controls that would have stopped a billing scheme

The figures are illustrative. At a 12-person contractor, the office manager set up a vendor called "BRS Supply" with her partner's bank account and submitted invoices of $1,800 to $2,400 a month for 14 months, totalling about $29,000. She entered bills, scheduled payments and reconciled the bank account herself.

Control	How it would have caught the scheme	Time cost
Owner approval of new vendors	Unknown vendor with no contract or W-9 flagged before first payment	5 minutes per vendor
Three-way match	No purchase order or delivery record for "supplies"	Built into payables process
Owner reviews reconciliation and payee list	Recurring payments to an unfamiliar name	20 minutes a month
Job cost review	Material costs not assigned to any job	Part of monthly job review
Mandatory vacation	Stand-in would have seen invoices with no matching deliveries	None

Any one of these would likely have stopped the loss within one or two months.

Monthly internal controls checklist for owners

1. Review each bank and card reconciliation, and the bank statement itself, for unfamiliar payees.
2. Scan the vendor list for new or changed vendors and bank details.
3. Check the invoice number sequence for gaps and review any credit notes or write-offs.
4. Review the receivables aging and follow up on anything over 60 days.
5. Review the payroll register for new names, rate changes and overtime spikes.
6. Compare actual results with budget and investigate unexpected variances.
7. Look at the accounting software's audit log for edits to closed periods or deleted transactions.
8. Confirm user access is current; remove former staff immediately.

Most owners can complete this in about an hour once it becomes routine.

Access and cybersecurity controls

Many losses today start with a compromised email account or a spoofed message rather than an employee. Basic controls that close those doors:

• Turn on multi-factor authentication for email, banking, payroll and accounting software.
• Give each person the lowest access level they need; few people need to both add vendors and release payments.
• Remove access the day someone leaves, including shared drives and payment apps.
• Verify any payment instruction change by calling a known number, never the number in the email.
• Train staff to recognize urgent payment requests that appear to come from the owner.

A 30-day plan to put controls in place

1. Week 1: List every way money leaves the business (checks, ACH, wires, cards, payroll, cash) and who can initiate each.
2. Week 2: Turn on bank dual approval, alerts and multi-factor authentication; give the owner direct statement access.
3. Week 3: Write a one-page policy covering vendor approval, payment limits, credit notes and expense claims.
4. Week 4: Run the monthly checklist for the first time with your bookkeeper, and book a recurring hour for it each month.

Review the list once a year, or whenever you add staff, a new bank account or a new payment method.

Common internal control mistakes

• Trusting one long-serving employee with everything. Many fraud cases involve trusted staff with years of tenure.
• Shared logins and passwords, which make the audit trail meaningless.
• Owner override. When the owner bypasses controls, staff learn the rules are optional.
• Controls on paper only. A policy no one follows is not a control. Monitor it.
• Ignoring small amounts. Schemes often start small to test whether anyone notices.

Insurance and outside review

Controls reduce risk but never remove it. Employee dishonesty or commercial crime insurance can cover theft by staff, and some policies cover funds transfer and social engineering fraud, though limits and exclusions vary, so read the policy wording. Many insurers ask about controls such as dual payment approval and callback verification when pricing these policies. An annual review by an outside accountant adds a check that staff know is coming. Even a limited engagement, such as testing a sample of payments and vendor changes, gives the owner independent assurance that the monthly checklist is working.

What to do if you suspect fraud

Do not confront the person immediately or alert them by changing everything at once. Secure records and backups, restrict system access quietly, and speak to your accountant and an attorney. Contact your insurer early if you have employee dishonesty or crime coverage, since policies often have notice deadlines. A forensic accountant can document the loss for insurance, recovery and any police report. This is general information, not legal advice.

Internal controls start with simple habits: numbered invoices, approved payments and a monthly owner review. Make the first one easy by creating consistently numbered, professional invoices with the free invoice generator, with no sign-up required and an instant PDF download for your records.