The bookkeeper has been with the business for twenty years. The office manager is family. Asking either of them to work under controls can feel like an accusation. It isn’t one, and the businesses that skip controls for that reason are the ones most exposed.
Internal controls are the routines that make honest mistakes visible and dishonest ones difficult. They are not a judgment about anyone. They are a judgment about the structure: whether one person, on a bad day or a bad year, could move money and hide it without anybody finding out.
Most months, a control program catches small errors. Its real purpose is the rare, large event it makes impossible — the diversion that runs for years, or the single loss big enough to threaten the business. That’s why weak controls are dangerous even when nothing has gone wrong. They measure exposure to something that hasn’t happened yet.
Trust and controls are not substitutes
Trust answers the question “do we believe this person?” Controls answer a different one: “is the structure sound?” A business needs both, and having plenty of the first does nothing for the second.
The losses that hurt small businesses most are usually committed by a trusted person, precisely because nobody was checking. Long tenure is not the risk. A long-tenured employee working alone, with no second set of eyes, is.
“We trust them”
One person handles the money, records it and reconciles it. If anything ever goes missing, that person is the only suspect, with no way to clear their name.
“The structure is sound”
The work is split so no single person controls a transaction from start to finish. A mistake gets caught, and the people doing the work are protected from suspicion.
Controls protect the trusted employee as much as they protect the business. Framed that way, they’re rarely resisted.
What a control program actually does
A complete control program rests on five activities. Each covers a gap the others leave open.
Separating duties — no one person controls a transaction end to end
Authorization — transactions are approved by someone with the authority to approve them
Reconciliation — records are checked independently against the bank, the vendor or the shelf
Safeguarding — cash, inventory, parts and units are physically protected
Access — system and physical access match each person’s role, and no more
They work as a set. Separating duties means wrongdoing would take two people working together. Authorization keeps transactions legitimate. Reconciliation catches what slips through. Safeguarding protects the physical assets, and access enforces all of it inside the systems where the work actually happens.
No one person should own a transaction end to end
Every transaction has four parts: approving it, recording it, holding the money or goods, and checking the result afterward. When one person does all four, an error and a theft look exactly the same, and neither will be found.
The most dangerous combination is the person who can both approve a transaction and record it. That concentration is what allows a loss to be committed and hidden by the same hands. Breaking it is the single most important control in the program.
Separating duties when the office is two people
The honest constraint of an independent business is headcount. A small office can’t separate every duty, and pretending otherwise produces a policy nobody follows. The goal is not perfection. It is breaking the most dangerous concentrations first, starting with anyone who can both move money and record it, and using the owner as a checkpoint where staff can’t be split.
Prepares and releases payments
The owner releases payments above a set amount.
Records and reconciles cash
The owner opens and reviews the bank statement first, before it reaches the bookkeeper.
Sets up vendors and pays them
The owner approves every new vendor before the first payment.
Takes and reconciles customer deposits
Someone other than the person taking deposits reconciles them.
None of these adds much work. Each one puts a second person at the point where money could leave without anyone noticing. Owner review isn’t as strong as a fully separated department, but it covers the riskiest points, and in a two-person office it’s the control that is actually available.
Money leaving the business gets the strongest control
Of everything the back office does, sending money out carries the most risk. That’s where the strongest controls belong.
A written list of who can approve what, and up to what amount
Preparing a payment and releasing it are two separate acts, done by two people
Payments above a set amount need the owner’s sign-off
Money never leaves on one person’s say-so
The written list matters more than it looks. When approval authority only exists in people’s heads, it bends under pressure — a vendor calling for payment, a busy week, an owner on the road. Written down, it’s the same answer every time.
Logins are controls too
System access should mirror that approval list. People can do what their role requires and nothing more. Access gets reviewed on a schedule, tightened when someone changes roles, and removed the day someone leaves.
Every action in the system should trace back to a named person and a source document. That trail is what lets a problem be found, and knowing it exists is itself a deterrent. Shared logins and old accounts for people who no longer work there break the trail completely. They’re among the most common gaps, and among the easiest to fix.
A control that gets skipped is not a control
Controls decay when nobody checks them. The reconciliation that used to happen monthly slides to quarterly. The second signature becomes a formality. The approval list stops matching who actually approves things.
Keeping the program real doesn’t take an audit. It takes a periodic look at whether the controls are actually being followed: reconciliations done, approvals genuine, access current. A control that exists on paper but gets bypassed every time things get busy provides no protection at all.
What a review tends to find
Consider a dealer where the owner believed the controls were good. A review found the bookkeeper entered the bills, wrote the checks and reconciled the bank. Nobody had reviewed system access in years, and two former employees could still log in. Cash was locked up every night but never counted against the records.
Nothing had gone missing. But one trusted person could have diverted money for years without detection, and nobody would have known until it was too late to recover.
The fix was small: the owner began releasing payments and opening the bank statement first, the old logins were removed, and cash counts were added on a schedule. The controls cost very little. The exposure they closed was large.
Where to start
01
Write down who does each part of handling money, and look for anyone who does all of it.
02
Break the most dangerous combination first: anyone who can both move money and record it.
03
Review system access. Remove old logins and shared accounts.
04
Add regular counts of cash and high-value items against the records.
05
Check every few months that the controls are still being followed.
Start with the conversation, not the paperwork. The message is not “we suspect you.” It is “we are protecting the business, and protecting you if anything ever goes wrong.”
How this connects
Area: Loss Prevention — operational protection, the controls every other part of the business depends on.
Applies across: Administration — payables, cash, deposits and payroll all run through these controls.
Read next: The Loss You Watch Is Rarely the Largest One — the money that goes missing without anyone taking it.
Also useful: Customer Deposits Aren’t Your Money Yet — refunds and deposits as a control point.
ProfitEdge Systems helps independent retailers and dealers improve profitability and operating performance through consulting, training, and intelligence tools. See how we help →
Free checklist
The Physical Inventory Planning Checklist
Two pages. Everything to do six weeks, two weeks and one week out, the count-day rules, and a review sheet that shows the gross variance, not just the net. One email address, nothing else.
Free follow-up kit
The Follow-Up Kit
Four printable pieces: a short huddle playbook for managers, the huddle form, a one-page field job aid, and a guide to turning the reports you already have into working lists. One email address, nothing else.
Free self-check
The Exit-Readiness Self-Check
Two pages. What still runs through you, the four questions a buyer or successor will ask, and a place to name your first three gaps. One email address, nothing else.
Free worksheet
The Shrink Investigation Worksheet
Two pages. A five-step check for every significant variance, an item log, where shortages hide in an equipment and hardware store, and how to spot a pattern before anyone is accused. One email address, nothing else.
Free self-check
The Small-Office Controls Self-Check
Two pages. Who does what on a payment, the five control activities, first fixes for a two-person office, and a login review. One email address, nothing else.
Free counter log
The Missed-Sale Log
Two pages. A counter log for every request you couldn’t fill, a weekly review that gives each signal an owner, and a place to track patterns across the month. One email address, nothing else.
Free account review
The Commercial Account Review
Two pages. A snapshot of your five most important commercial, fleet, municipal or farm accounts: what they run, the terms on file, and what each account really earns. One email address, nothing else.
Free planning sheet
The Before-the-PO Planning Sheet
Two pages. Why you’re buying it, four questions to answer before the cash goes out, the program on one page, and how to run a controlled test when the evidence is thin. One email address, nothing else.
Free template
The Customer Deposit Policy Template
Two pages. Write your deposit terms once, set how deposits are handled at the counter, and reconcile open deposits every month. One email address, nothing else.
Free worksheet
The Revenue Leak Worksheet
Two pages. Check warranty, co-op and programs, labor, vendor terms and floorplan, put a yearly dollar figure on each leak, and rank them against shrink with an owner for every fix. One email address, nothing else.
Free morning review
The Work Order Stage Review
Two pages. A morning sheet for every open job, with its stage, what it’s waiting on, the next step and who owns it, plus a stage-by-stage count of where work stalls. One email address, nothing else.
Free monthly review
Monthly Margin Questions
Two pages. The four questions an owner should be able to answer every month, set out as a sheet to fill in when the statement arrives, with a checklist of where margin drifts. One email address, nothing else.
Free planning sheet
The Decision-First Report Request
Two pages. Before asking for a new report or a new system, write down the decision, who makes it, how often, what counts as an exception and whether the data can be trusted. One email address, nothing else.
Free working sheet
The Month-End Exception Review
Two pages. The five questions worth settling before you build anything, and a daily / weekly / before-the-close sheet with the owner column left blank for your own names. One email address, nothing else.
Shrink Isn’t Only Theft
When the count comes up short, theft is the first thought. Often the stock was never there, or it left without anyone recording it. Sort the cause before you act.
Trust Is Not a Control
Controls are not a judgment about anyone. They are a judgment about whether one person could move money and hide it, and they protect the people you trust most.
Commercial and Fleet Customers Are Different
A down mower is a frustrating weekend for a homeowner. For a landscaper, it is a crew standing still.
Customer Deposits Aren’t Your Money Yet
A deposit is money you are holding, not money you have earned. Book it as a sale and the numbers start telling a story that is not true.
Bring the problem you keep re-solving
Most of what ends up in these articles started as a question from a shop owner or a dealer principal. If something here sounds like your month, say so and we will look at it together.
