Map where money or information can go wrong
Follow a sale, a purchase and a payroll payment from initiation to the bank and ledger. Identify who can create records, approve them, release money and reconcile the result. Include manual workarounds and spreadsheets, because the real process may differ from the documented one.
Rank issues by potential loss, likelihood and how quickly a problem would be detected. A small company may reasonably prioritise bank access and supplier changes before designing an elaborate reporting policy. Assign an owner to each priority and a date for checking whether the response works.
Separate payment preparation from approval
Where practical, use different people for preparing and authorising payment runs. Approvers need the underlying invoice and commercial explanation, not only a list of bank amounts. A new supplier or changed bank account deserves independent verification through a trusted contact route.
A two-person company may have limited segregation. Record a compensating review, such as an owner examining bank transactions against approved invoices promptly afterwards. This has different strengths from a preventive approval; describe it honestly rather than treating every double signature as equivalent protection.
Make reconciliations a control with evidence
A bank reconciliation should identify unmatched transactions and old reconciling items, with a preparer, reviewer and completion date. A tick saying done is less useful than evidence that the reviewer considered exceptions. Apply similar discipline to material debtors, creditors and payroll control accounts.
In a hypothetical case, a £12,000 difference may contain several offsetting errors. Clearing only the net amount can hide a duplicated payment and an unrecorded receipt. Investigate the components and retain the resolution trail. The appropriate frequency depends on activity and risk, not a universal monthly rule.
Control access throughout the employee lifecycle
Keep a register of users with access to banking, accounts, payroll and sensitive exports. Review whether permissions match current responsibilities and remove access when people leave or change roles. Shared logins make accountability and removal harder.
Arrange an authorised backup for critical approvals so absence does not force informal credential sharing. Check that the business can recover access without relying on one employee’s personal device or mailbox. Coordinate the finance process with appropriate IT and data-protection support where required.
Use an exception log instead of hiding workarounds
Record urgent payments, missing evidence, overdue reconciliations and approval overrides. Capture the reason, authoriser, amount, follow-up action and final resolution. Repeated exceptions may show that a workflow is unrealistic or that responsibilities are unclear.
Review a small sample from start to finish. Ask whether the control happened at the right time and whether anyone acted on the problem found. A beautifully written policy that is bypassed every Friday is a process improvement opportunity, not proof that the risk has been managed.
Walk one transaction through the controls
Choose a completed payment and follow the evidence in sequence. Look for approval before release, verification of any bank-detail change and subsequent reconciliation. A review performed after the event may still be useful, but it is not the same as preventing an unauthorised payment. Record the limitation and assign a practical improvement where the evidence does not support the policy.
| Area | Evidence to examine | Question to resolve |
|---|---|---|
| Initiation | Invoice and business reason | Who confirmed that the purchase was authorised? |
| Release | Approval and bank-detail verification record | Did the check happen before money left? |
| Review | Reconciliation and exception resolution | Who checked the payment independently? |
Give directors an actionable oversight view
A short governance report can show overdue reconciliations, unusual payment changes, access reviews and unresolved issues. Include trend and ownership rather than a wall of green status indicators. Distinguish controls designed, controls implemented and controls actually checked.
Consult EFC can discuss proportionate controls, reporting processes and governance for a growing SME. Start with the team structure, systems and current concerns. Agree a practical scope and handover so the company knows who will operate each control after the initial improvement work.
Your preparation checklist
- Map preparation, approval, payment and reconciliation responsibilities.
- Verify supplier changes independently using a trusted route.
- Keep dated evidence of reviews and exception resolution.
- Review access and assign backups for critical activities.
Frequently asked questions
Can a small team have effective controls?
Yes, although perfect segregation may be impractical. Identify the limitation and design proportionate independent reviews and oversight.
Does accounting software prevent payment fraud?
Software can support controls, but permissions, verification, approvals and follow-up still need people and a workable process.
How often should controls be reviewed?
Set a frequency reflecting risk and activity, and revisit it after staff, systems or transaction volumes change. Agree the approach for the business.
Sources and scope
This is general preparation guidance. Worked examples are original hypothetical illustrations, not client outcomes, market multiples or individual advice. Agree the purpose, evidence and scope before commissioning professional work.
Professional background: ICAEW technical resources. These links provide context and do not imply endorsement, assurance or compliance for an individual engagement.
Explore the related questions
Discuss the decision with Consult EFC
Tell us the decision, approximate timing and the information available. We will discuss suitability, scope and fees before work begins. Please arrange a suitable channel before sharing confidential documents.