Small Business Internal Controls: 10-Point Checklist

Running a small business means trusting a few people with a lot of tasks. One employee might collect payments, pay bills, and update the books. Without a second set of eyes, mistakes can go unnoticed, and unauthorized transactions can be harder to catch. Internal controls are simple checks that help you keep track of what happens to your money.

This checklist walks you through ten practical ways to protect your business, even with a small team.

Small business internal controls checklist

The following 10 controls help protect your business' money, records, and other assets. Your business may not need every control in the same form. Choose safeguards based on your operations, staffing, and exposure to risk.

Start with transactions where an error or unauthorized action could cause the greatest loss.

For example, a retailer handling substantial cash should prioritize cash counts, deposits, and reconciliation. A consulting business that pays suppliers electronically may face greater exposure through fraudulent payment instructions and unauthorized bank transfers.

These are recommended safeguards, not universal legal requirements. Additional obligations may apply based on your industry, contracts, and location.

1. Properly segregate duties

Don't let one person control a payment from start to finish. If the same employee can approve it, send the money, and record it, a mistake or unauthorized payment might go unnoticed. Try to divide these three jobs:

• Approval: Deciding whether a payment should be made.
• Recordkeeping: Entering the payment in your books.
• Handling money: Having access to the cash or bank account used to pay.

For example, the employee who prepares bills for payment shouldn't also be the only person approving them and checking the bank statement. If your team is too small to split every job, ask someone else to review the work.

If your bookkeeper prepares and records payments, you could approve them before they're sent and check the bank transactions afterward. A second set of eyes can catch problems.

2. Ensure owner oversight

When you have a small team, you'll probably need to check some of the financial work yourself.

This doesn't mean watching employees all day. It means looking regularly at the payments and records that matter most.

Make a habit of checking:

• Bank and credit card charges you don't recognize.
• Large payments and the bills or receipts behind them.
• Unusual customer refunds, discounts, or changes to the books.
• Changes to a supplier's bank details.
• Differences that still haven't been explained when accounts are checked.

Get bank statements directly from the bank when you can, rather than relying only on reports prepared by employees. Make a quick note of when you checked the records, anything unusual you found, and what you did about it.

If you're also the person making and approving payments, an outside bookkeeper or accountant can review some transactions. This gives you a check from someone who didn't do the work.

3. Maintain proper transaction documentation

Keep enough paperwork for every purchase and payment that you can answer: What was it for? How much did it cost? Who approved it?

Save bills, receipts, orders, payroll records, and proof of payment. For example, when you pay a supplier, keep the invoice, the approval if one was required, and a record of the payment.

You don't need a handwritten signature on every document. An email or a record in your accounting software can also show who approved something and when.

To keep your paperwork organized:

• Use consistent names or numbers so documents are easy to find.
• Keep receipts and invoices with the matching entries in your books.
• Limit who can change records after they're approved.
• If you correct an entry, keep a record of what changed.
• Store documents safely so you can find them later.

The IRS's business recordkeeping guidance permits electronic recordkeeping, provided the records satisfy applicable accuracy, accessibility, preservation, and retention requirements.

Good records help you find mistakes, answer questions about purchases, and prepare your taxes. If employees submit expense claims, QuickBooks Online Advanced lets them upload receipts for you to review before recording the expense.

4. Perform independent reconciliations

Reconciliation is just a way of checking whether two sets of numbers match. For example, does what left your bank account match what you entered in your books?

Compare your bank statement with the payments and deposits in your accounting software. With QuickBooks Online Advanced, you can upload a bank statement for the reconciliation tool to compare with recorded transactions. You still need to check any differences.

If possible, have someone who didn't make or approve the payments do this check. They can view the bank records without needing permission to send money.

The person checking the numbers should be able to see the records, but doesn't need the power to change transactions or move money.

Other useful checks include:

• Bank and credit card statements against your books.
• Cash collected against recorded sales.
• Customer payments against unpaid invoices.
• Actual stock counts against inventory records.

Checking your bank account once a month is a good starting point for many small businesses. Review it more often if you have lots of activity or higher risks.

Don't change an entry just to make the numbers match. A check that hasn't cleared may explain a difference. A withdrawal you don't recognize needs a closer look.

If your bookkeeper also handles payments, have yourself or another person review the completed bank reconciliation and anything that still doesn't match.

5. Establish transaction authorization levels

Decide who can say yes to purchases, refunds, and payments before employees need to make them.

You don't have to approve every box of office supplies. A manager could approve smaller purchases, while you handle bigger or unusual expenses.

Write down who can approve each type of payment and any spending limits. QuickBooks Online Advanced, for example, offers bill-payment approval workflows that can send certain payments to an approver before release, once you've set up the rules and permissions.

The table shows examples, not fixed rules. Choose approval limits that fit your business and budget.

Make sure everyone knows who can approve what. Update the list when people's jobs change.

Be careful when one employee can add suppliers, change bank details, approve bills, and send payments. Have someone else check at least some of those steps.

Our guide to accounts payable internal controls explains more ways to protect supplier payments.

6. Establish standard operating procedures

A standard operating procedure (SOP) is simply a written set of steps for doing a job. It helps everyone follow the same process, especially when someone is new or away. Write down how you collect customer payments, order inventory, pay suppliers, run payroll, and check bank accounts.

Include tasks you do only once a month or occasionally. Payroll and big purchases still need clear instructions.

For example, your steps for paying a supplier could be:

1. Check that the supplier's invoice is correct.
2. Compare it with the order or proof that the goods arrived when needed.
3. Get approval from the right person.
4. Pay the bill using an approved method.
5. Record the payment and save the paperwork.

Say who's responsible, which documents to keep, and what to do if something looks wrong. Update the steps when your employees, software, or processes change.

7. Strengthen cash handling and payment controls

Cash can go missing before anyone notices, so a few simple checks are worth doing every day you handle it. If customers pay cash, give receipts, record each sale, count the money, keep it secure, and deposit it regularly.

For example, at closing time, a store manager can compare the cash in the register with the day's sales report and look into any difference.

Useful habits include:

• Letting only authorized staff use cash drawers and cash storage.
• Keeping receipts for small cash purchases.
• Recording cash counts and deposits.
• Depositing cash promptly, based on how much you handle and how safely you can store it.
• Having someone else check the cash records when staffing allows.

Card and bank payments avoid some problems with physical cash, but they come with other risks, such as sending money to the wrong account or falling for a fake payment request.

Limit who can send electronic payments, and double-check unusual requests or changes to a supplier's bank account.

If a supplier emails new banking details, call a phone number you already trust to confirm them. Don't rely only on the contact details in the email.

Before charging customers an extra fee for paying by credit card, check the laws and card-network rules that apply.

Use the checks that make sense for each way your business accepts or sends money.

8. Review logical security

Decide who can see and change information in your business software. Employees shouldn't have more access than their jobs require.

This is sometimes called least privilege. In everyday terms, give people only the access they need to do their work.

For example, a salesperson may need to create invoices but probably doesn't need access to payroll or permission to change your bank details.

Check the access settings in your accounting, payroll, banking, and other financial apps.

Start with these basic protections:

• Give every employee their own login instead of sharing passwords.
• Turn on multifactor authentication (MFA), such as a code sent to your phone when you sign in.
• Allow employees to use only the software features needed for their jobs.
• Check who has access from time to time.
• Remove or change access promptly when an employee leaves or changes jobs.
• Review the app's history of changes or activity if something looks suspicious.

Check your software's settings to see which access limits it offers. QuickBooks Online Advanced, for example, has custom user roles to limit what employees can see or change. QuickBooks also has an audit log that shows who changed transactions, though someone still needs to review it.

The Federal Trade Commission's cybersecurity guidance offers additional recommendations on authentication, access controls, employee training, and protecting sensitive information.

9. Protect physical assets and sensitive records

Keep cash, inventory, equipment, and private paperwork in places where only the right people can get to them. You don't need the same security for everything. A locked cabinet may be enough for some papers, while expensive stock may need a secured room.

For example, an office may use locked cabinets and a key log. A store or warehouse might need a stockroom with controlled access and cameras.

Start with these habits:

• Give access only to employees who need it for their jobs.
• Keep track of who has keys and access cards.
• Count stock and other valuable items regularly.
• Look into differences between what you count and what your records show.
• Collect keys and remove access when someone leaves or changes jobs.

You don't always have to limit access to just one employee and the owner. A second employee or trusted backup may also need access, depending on the task.

For example, ask someone other than the employee who updates inventory records to help check the actual stock count. Choose security measures that match the value of the items and how likely they are to go missing.

10. Have a backup plan when things go wrong

Imagine your bookkeeper calls in sick on payday, or your store loses power just as customers arrive. Who steps in? What can your team still do? A simple business continuity plan gives you answers before you're scrambling.

Start with the jobs you can't afford to miss, such as paying employees, taking orders, sending invoices, and accessing financial records. You don't need a thick manual, just clear instructions someone else can follow.

For each important task, write down:

• Who can take over if the usual person is unavailable.
• Where to find the instructions and essential records.
• What to do if the computer, internet, or payment system stops working.
• Who to call for help, including your bank, software provider, and key suppliers.
• How you'll update customers if orders or services are delayed.

Then give the plan a quick test. Ask your backup person to find a recent invoice or walk through the payroll steps. Try restoring a backed-up file to make sure the backup works.

If you use QuickBooks Online Advanced, its online backup and restore tools can help recover supported company data. Keep separate copies of important files stored outside QuickBooks, too.

Review your plan whenever staff or systems change. Even a one-page checklist helps when your team knows where to find it. The FTC also recommends preparing for security problems and recovery.

How to implement internal controls with limited staff

Small businesses rarely have enough employees to assign a different person to every accounting responsibility.

The practical solution is to identify duties that shouldn't be combined and establish independent checks where separation isn't possible.

Consider a hypothetical business with three administrative employees and an owner.

This arrangement illustrates how a small team might divide responsibilities. Actual assignments depend on your business processes, staff capabilities, and banking permissions.

Some duties may still overlap. An employee might handle both customer billing and payment recording, for example.

In that situation, the owner could compare customer payment records directly with bank deposits and review overdue invoices or unusual adjustments. This independent review helps address the risk created by combining responsibilities.

If your business cannot provide sufficient oversight internally, consider hiring an outside bookkeeper or accountant to review selected transactions or reconciliations periodically.

Focus on separating the highest-risk activities first. Where that isn't possible, establish a reliable way to detect errors or unauthorized transactions.

How to check whether your internal controls are working

Internal controls only provide value when employees follow them consistently, and someone checks the results.

Assign responsibility for each control, decide how often it should be performed, and document evidence that the work was completed.

The following schedules are examples, not universal requirements.

Adjust review frequency based on transaction volume, business risk, and applicable requirements.

When a control reveals a discrepancy, investigate the cause and document the resolution.

Suppose you discover an unfamiliar electronic payment during a bank review. Determine how it was authorized, contact the bank promptly if necessary, and examine whether payment permissions or approval procedures need strengthening.

Encourage employees to report suspicious activity, accounting errors, and procedural weaknesses. Employees often notice problems before they appear in routine financial reports.

According to the Association of Certified Fraud Examiners' 2026 Report to the Nations, 43% of occupational fraud cases examined in its study were initially detected through tips. The report covered 2,402 investigated cases, so this finding should not be interpreted as the likelihood of detecting fraud at any particular business.

Getting started in your first month

You can begin strengthening internal controls without overhauling every business process at once.

• Week 1: Identify your highest-risk transactions, examine existing responsibilities, and review access to financial systems.
• Week 2: Establish essential payment approvals, bank reviews, and access restrictions.
• Week 3: Document key procedures and assign review responsibilities.
• Week 4: Check whether controls were followed, investigate exceptions, and improve any procedures that proved ineffective.

More complex businesses may need additional time or outside professional assistance. The priority is to establish workable safeguards and improve them as your operations evolve.