Internal Controls Every SME Should Have
Internal controls are policies, procedures, and
technical safeguards designed to protect company assets, ensure accurate
financial reporting, prevent fraud, and maintain operational efficiency. For
SMEs, effective internal controls bridge the gap between lean staffing and
financial security.
Key Internal Controls by Operational Area
1. Financial & Banking Safeguards
Dual-Authorization for Payments: Require two approvals for all
electronic bank transfers and check issuances above a defined threshold (e.g.,
$1,000 / ₹50,000). The person preparing the payment must never be the sole
approver.
Independent Bank Reconciliations: Ensure bank reconciliations are
prepared or reviewed monthly by someone who does not handle cash receipts,
issue payments, or record sales.
Petty Cash Controls: Maintain a strict impounded petty cash system with
set limits, required surprise cash counts, and mandatory physical receipt
submissions for every disbursement.
2. Procurement & Accounts Payable (AP)
Segregation of Duties (SoD): Separate the roles of creating
vendors, approving purchase orders (POs), receiving goods, and authorizing
payments.
Three-Way Matching: Mandate that Accounts Payable matches three documents
before releasing vendor payments:
Purchase Order (PO) – Verifies price and approved quantities.
Receiving Report / Goods Receipt Note (GRN) – Confirms physical receipt of
goods.
Vendor Invoice – Validates billing terms and math accuracy.
Vendor Master Data Management: Restrict privileges for adding or
modifying vendor bank details, requiring independent verification (such as a
direct phone call to a confirmed vendor number) before changing payment
details.
3. Sales, Revenue & Accounts Receivable (AR)
Formal Credit Approval Limits: Establish explicit credit limit
rules and payment terms before extending credit to new customers. Require
management sign-off for exceeding credit limits.
Standardized Pricing & Discount Rules: Implement fixed price lists in your
ERP/accounting system. Require secondary managerial sign-off for custom pricing
or non-standard discounts.
Monthly Customer Statements: Send automated or manual monthly
account statements to clients, requiring them to verify outstanding balances
directly.
4. Payroll & Human Resources
Payroll Review & Approval: Require a manager outside the
immediate payroll department to review and approve payroll summaries prior to
funds release, cross-referencing active employee rosters.
Direct Deposit Modifications: Mandate multi-factor verification
for any employee direct deposit account changes to prevent social engineering
or insider fraud.
5. Inventory Management & Asset Protection
Perpetual Inventory & Perpetual Reconciliation: Utilize inventory management
software integrated with accounting systems to track movements in real time.
Regular Physical Counts & Variance Analysis: Conduct monthly or quarterly cycle
counts, alongside annual physical inventory counts, investigating any material
variances immediately.
Physical & Digital Security: Restrict physical warehouse access
to authorized personnel and lock up high-value stock items. Tag all capital
assets with fixed asset tracking IDs.
6. System Access & IT Governance
Role-Based Access Control (RBAC): Restrict accounting software and ERP
access based on employee job descriptions. Prevent line staff from posting
manual journal entries or altering closed periods.
Mandatory Multi-Factor Authentication (MFA): Enforce MFA across all corporate
email, banking, accounting, and payroll portals.
Audit Trail Logging: Keep system audit logs permanently enabled within
ERP/accounting software to track who created, edited, or deleted transactions.