Basic internal controls for a growing company

An email arrives from a supplier saying it has changed bank accounts. The same person who records purchases updates the details, prepares the payment and approves it because the general manager is traveling. A month later the supplier complains it never received the money. Nobody inside the company acted in bad faith, but there was no point at which someone else had to take a look.

When the company was small, the owner saw everything. As it grows, that stops being possible and you need internal controls: simple rules that make an error or an abuse require more than one person and leave a trail. This guide covers the minimum controls and how to apply them, even if you work with spreadsheets.

Segregation of duties

The principle is that no single person controls a process from start to finish. In almost any money flow there are four functions worth separating:

Function	Purchasing and payments	Sales and collections
Record	Create the purchase order	Issue the invoice
Approve	Authorize the purchase or the payment	Authorize discounts or credit
Custody	Execute the transfer	Receive the cash or deposit
Reconcile	Check the bank statement against payments	Check collections against invoices

If the same person records and holds custody, or approves and reconciles their own work, they can make a mistake and also hide it.

What if the team is small? You won’t always have four people. In that case, use compensating controls: the owner reviews the full bank statement every week, changes to supplier bank details are confirmed by phone with a known contact, or the external accountant reviews a sample of payments each month.

Approval levels by amount

Not every purchase deserves the same review. A table of levels keeps the manager from signing everything while nobody signs what matters. An example with hypothetical figures:

Purchase amount	Who approves
Up to Bs 5,000	Department head
Bs 5,001 to Bs 30,000	Department head and finance manager
Over Bs 30,000	General manager

Your company sets the amounts based on its size and risk. What matters is that they’re written down and that everyone knows them.

The splitting problem. Suppose the department head’s limit is Bs 5,000 and, in the same week, three purchases from the same supplier show up for Bs 4,800, Bs 4,900 and Bs 4,700. Together they add up to Bs 14,400, which should have gone to the finance manager. To catch it:

1. Group purchases by supplier and by week.
2. Add up the amounts in each group.
3. Flag the groups whose total exceeds an approval level even though no individual purchase does.
4. Review the flagged groups with whoever approved each purchase.

A useful indicator is the percentage of purchases that land between 90% and 100% of the limit for their level. If it’s high and rising, someone may be adjusting amounts to avoid escalation.

Permissions matrix

Segregation becomes real when it turns into concrete permissions. A matrix crosses roles with actions:

Action	Purchasing	Treasury	Accounting	Management
Create purchase order	Yes	No	No	No
Approve purchase order	No	No	No	Yes
Change supplier bank details	No	No	Yes	No
Execute payments	No	Yes	No	No
Reconcile bank accounts	No	No	Yes	No

Build the matrix by role, not by person. When someone changes jobs, you change their role and don’t have to remember one-off permissions. And check that no row combines incompatible functions from the previous table.

Change log

Some data should always leave a record of who changed it, when, the old value and the new value:

• Bank details of suppliers and employees.
• Selling prices and price lists.
• Customer credit limits.
• Amounts on documents already approved.
• Users, roles and permissions.

If you work in spreadsheets, at least keep dated versions and password-protect the master sheets. The key point is that the log can’t be edited by the same person making the changes.

Supporting documents

Every payment should be traceable back to its origin. In purchasing, the classic control is the three-way match: approved purchase order, receiving note and supplier invoice. If quantity or price don’t match across the three, the payment is held until it’s cleared up.

Indicator: percentage of payments with complete support = payments in the month with all three documents ÷ total payments in the month × 100. Suppose you made 200 payments in a month and 170 had an order, a receipt and an invoice: 170 ÷ 200 × 100 = 85%. The remaining 15% is your review list.

Retention periods for invoices and accounting records are set by current regulations; check them with your accountant before defining your filing policy.

Periodic access review

Permissions pile up: someone covers a vacation, gets extra access and never loses it. A periodic review, for example quarterly, fixes that:

1. Pull the list of active users with their roles.
2. Match it against current staff and deactivate anyone who no longer works at the company.
3. Send each manager the list for their team to confirm that each role is right.
4. Remove expired temporary permissions.
5. Record the review, with the date and who approved it.

Indicator: active accounts belonging to former employees at the time of the review. The target is zero.

Common mistakes

• Shared users. If five people use “till1”, the log is useless.
• Permanent exceptions. “I’ll approve it just this once” becomes the rule.
• Hiding instead of restricting. Hiding a menu option doesn’t stop someone from reaching it another way; the permission is what protects you.
• Controls nobody reviews. A log nobody looks at only helps after the problem.
• Copying another company’s matrix. Risks depend on your processes and your size.

Checklist

• The four functions (record, approve, custody, reconcile) are separated or have a compensating control.
• There’s a written table of approval levels by amount.
• Purchase splitting is reviewed at least once a month.
• There’s a permissions matrix by role, with no incompatible combinations.
• Changes to bank details, prices and permissions are logged.
• Every payment has an order, a receipt and an invoice.
• Access is reviewed on a defined schedule and the review is documented.
• Every user account is personal and non-transferable.

Moving it into a system

These controls work in spreadsheets if there’s discipline. As volume grows, an ERP like MKA can apply fine-grained permissions by role, validated on the server, and record every data change in a hash-chained trail whose integrity you can verify (see audit and security).