Internal Controls Checklist: 20 Controls for SMEs

Internal controls are the routines that make errors and fraud less likely and easier to catch. A small business can't afford a large finance team, but it can afford a short list of well-chosen controls. This checklist is arranged by area.

First, the principle: segregation of duties

No one person should be able to authorise, record and handle the same transaction. In a three-person office, you may not be able to split all three — so compensate with review: the owner approves payments, reviews bank reconciliations and looks at exception reports.

Cash and banking

1. Reconcile every bank account monthly, prepared by someone who doesn't make payments, reviewed by the owner. See bank reconciliation step by step.
2. Dual authorisation for payments above a set limit.
3. Bank mandate review at least yearly — remove leavers.
4. Petty cash imprest counted regularly. See petty cash management.
5. Daily banking of cash receipts, intact.

Purchases and payables

1. Purchase orders for anything beyond a threshold.
2. Three-way match: order, goods received, supplier invoice.
3. Supplier master changes (bank details!) verified by call-back to a known number — a common fraud route.
4. Duplicate check before each payment run — try the Duplicate Transaction Finder.
5. Approve invoices by someone who didn't raise the order.

Sales and receivables

1. Sequential invoice numbering with voids retained. See sequence gaps.
2. Credit notes need approval from someone other than the person who issued the invoice.
3. Customer credit limits and an ageing review monthly. See AR ageing guide.
4. Cash sales reconciled to till or POS totals daily.

Payroll

1. Changes to employees and salaries approved in writing.
2. Payroll register reviewed by the owner before payment — check for ghost employees.
3. WPS file reconciled to the register. The WPS SIF Generator helps prepare the file.

Ledger and reporting

1. Journals reviewed and approved by someone other than the preparer; manual journals have a narration. See journal entries explained.
2. Period locking after close, so numbers don't change silently.
3. Management accounts reviewed against budget with unusual variances explained — see financial ratios.

IT and access

• Individual log-ins, never shared.
• Role-based access: cashiers shouldn't edit the chart of accounts.
• Off-site backups and a recovery test.
• Remove access the day someone leaves.

How to roll it out

1. Pick the five highest-risk controls first (usually bank, supplier changes, payments approval, payroll and journals).
2. Write each as a one-line procedure and assign an owner.
3. Evidence them — a signed reconciliation, a dated approval.
4. Review quarterly. Controls that aren't evidenced aren't controls.

Software as a control

Role-based permissions, approval workflows, locked periods and an audit trail turn manual rules into enforced ones. Pyalm Books includes role-based team access (Owner, Admin, Manager, Cashier), transaction locking and a double-entry ledger, and is free during beta. See also segregation of duties and fraud red flags.

Rules, rates and deadlines change. Confirm the current position with the Federal Tax Authority (tax.gov.ae), the Ministry of Finance or a qualified adviser before you file, pay or rely on it.