Internal Controls for Small Businesses: Four Eyes, Clear Limits

Why a small business needs an internal control system

In many small businesses, all payment processing lies with one person. They set up suppliers, check invoices, release transfers, and reconcile the accounts. That is efficient and usually works for years. But it also means that an error or abuse only becomes apparent once it has grown large.

This guide answers one question: How does a business with only a few employees build an internal control system that works without paralyzing daily operations? To answer it, we first clarify the term and the COSO framework as the thinking model, then look at the findings on small companies with two readings, and finally go step by step to your own control map.

What an internal control system is and what it is not

An internal control system covers all rules, routines, and checks with which a business ensures that its assets are protected, its figures are correct, and laws and its own requirements are met. It is not a document but a way of working. An approval limit, a monthly account reconciliation, and a password that not everyone knows are already parts of it.

For small businesses there is no general obligation to describe a formal internal control system of the kind German stock corporation law imposes on listed companies. However, the German principles for proper electronic bookkeeping, known as GoBD, require controls for tax-relevant processes, and the managing directors of a GmbH, the German limited liability company, must act with the care of a prudent businessperson. A lean internal control system is therefore more than a good idea.

It is also important what an internal control system does not achieve. It reduces risks but does not eliminate them. Anyone who deliberately colludes with others to circumvent controls, or who overrides rules from the top, is hard to catch with ordinary controls. According to the ACFE's 2024 fraud report, lack of internal controls was the primary weakness in 32 percent of cases, and the override of existing controls in 19 percent.

The thinking model: the five COSO components

The best-known framework for internal control comes from the Committee of Sponsoring Organizations of the Treadway Commission, COSO for short, an association of American professional bodies. It describes an internal control system as the interplay of five components. If one is missing, the others carry less weight.

An analogy makes the logic tangible. A house is not made secure by a lock alone. It needs residents who lock up, an idea of where someone might break in, locks on the right doors, neighbors who speak up, and someone who checks now and then whether the windows are really closed. The control activities are the lock. Without the other four components it often stays open.

A control that the boss bypasses is not a control but a recommendation to everyone else.

Why segregation of duties is so hard in small businesses

The core of control activities is segregation of duties: a process is distributed among several people so that nobody can control it alone from start to finish. For purchasing, this means that ordering, receiving goods, and approving payment are in different hands, as Purchasing and approvals describes.

Gramling, Hermanson, Hermanson, and Ye (2010) examined how widespread the problem is. They analyzed the reports of listed US companies for fiscal year 2008, in which management must disclose material weaknesses in internal control. Around 358 small companies reported weaknesses in segregation of duties, among larger companies it was fewer than 30. From a sample of 116 small firms, the authors analyzed the reasons.

The disbursement cycle was affected most: cash disbursements, cash, invoice approval, purchasing, and period-end closing. The companies in the sample were very small, with a median market value below five million dollars. The study comes from the United States and looks at listed firms, but the patterns transfer well to a German business with ten to fifty employees.

Two readings: more people or better compensating controls?

Gramling and co-authors (2010) show that experts mostly recommend the second path. The COSO guidance for smaller companies names as compensation management's review of transaction reports, sample checks against supporting documents, supervised stock counts, and performing reconciliations independently. The precondition is that the owner understands enough about bookkeeping to recognize what they are looking at. As a second means, the authors name the outside view, for instance having bank statements sent directly to the tax adviser.

How disputed even segregation of duties is can be seen in a debate among researchers. A mathematical model by Barra, Savage, and Im from 2020 concluded that segregation of duties could actually encourage fraud. Knisley, Powell, and Stern (2022) consider the model's assumptions unrealistic: fraud only succeeds for a group that controls authorization, record-keeping, and custody at the same time, and every separation forces the perpetrator to recruit further accomplices. However, they too concede that separation can increase risk if it requires many new employees.

I therefore consider a mix to be right: separate duties where it is possible without new positions, and compensate for the rest with a few regular controls by yourself and a third party. The ACFE material cited by Gramling and co-authors supports a further component: organizations with job rotation or mandatory vacation had median losses more than 60 percent lower in the 2008 analysis.

The control map: internal control in five steps

From the five components and the findings I derive a procedure that I call the control map. It fits on one page and can be created in an afternoon.

1. Name the most costly processes

   Write down the five processes where an error or abuse would cost the most. Payments, changes to bank details, discounts, inventory, and access to customer data are almost always among them.

2. Who does what?

   For each process, enter who initiates it, who approves it, who records it, and who checks the result. Where one name appears four times, there is the gap.

3. Separate where possible

   Reassign roles where this is possible without new positions. Often it is enough for a second person to approve transfers in online banking.

4. Compensate where not

   For the remaining gaps, define a compensating control: monthly review of payments by you, reconciliation of supplier master data, mandatory vacation with a stand-in.

5. Check effectiveness

   Once a quarter, use a small sample to check whether the rules are followed, and once a year have a third party look at one area.

How the map fits into an overall picture of self-control, a second person, and an outside view is described in Corporate governance for small businesses using the three lines model. Which patterns are typical of employee fraud is covered in more depth in Preventing fraud in your business.

The most important controls, sorted by effort

• Payments above a set amount only with approval by a second person.
• Changes to supplier bank details only after a call back to a known number.
• Monthly reconciliation of bank accounts with the books by someone who does not post entries.
• The owner's own read access to all business accounts.
• Monthly review of outgoing payments and master data changes by the owner.
• Annual stock count with a person who does not manage the warehouse.
• Mandatory vacation of at least one consecutive week with a real stand-in.
• An annual review engagement for the tax adviser covering one selected area.

The call back for changed bank details in particular protects against a widespread scam in which fraudsters pose as a supplier by email. How businesses protect themselves against such attacks is described in Cyberattacks on small businesses. The rule also applies to the owner: controls that apply to everyone are not perceived as distrust.

What follows beyond the individual case, and where the limits lie

In large companies, internal control is an obligation and a department of its own. In a small business it is an attitude that shows in a few rules. The most important component is the control environment, and the owner shapes it: if the owner keeps to the rules, so do the others. Major accounting scandals show that controls most often fail at the top, as Patterns of accounting scandals describes.

The findings have limits. The analysis by Gramling and co-authors concerns listed US firms in 2008, and the ACFE figures come from investigated cases, not from a random sample. Comparable data for small German businesses are lacking. The direction is nevertheless clear and matches what COSO and audit practice recommend.

Conclusion: control on a small scale means knowing gaps and compensating for them

To the guiding question: a business with few employees builds an effective internal control system by knowing its five most costly processes, separating duties where it can do so without new positions, and compensating for the remaining gaps with regular controls by the owner and a third party. The COSO framework provides the structure, and the control map turns it into one page.

It takes no more than an afternoon for the map and an hour a month for the review. What matters is not the number of rules but that they apply to everyone and that someone takes a look.