Home / Columns / Internal controls protect company assets

Internal controls protect company assets

Q: I own a small business with just a few employees including my longtime bookkeeper. While I have known her for years and trust her completely, I keep hearing of the importance of internal controls. I spend most of my time managing operations and selling my product, and consequently I don’t spend much time looking at the books and accounting records. Do I really need to worry about internal controls when I have such a trusted bookkeeper?

A: This is a great question of vital importance to all businesses. Protecting the assets of the company is a major responsibility of any owner, and a system of internal controls should be developed and enforced to minimize the possibility of errors and fraud.

Even when you have complete trust in the person watching over your financial affairs, internal controls are important to protect you and to protect that trusted employee.

To get better insights into the world of internal controls, I turned to one of my associates at CliftonLarsonAllen, Sue Langley, who besides being a CPA is also a certified fraud examiner. Here’s what Sue had to say:

While not all fraud can be prevented, ensuring some basic internal controls are in place can help prevent a large percentage of fraud that occurs in small businesses. The classic fraud triangle consists of opportunity, pressure and rationalization. Strong internal controls help minimize the first leg of the triangle: opportunity. The following controls should be used when a small business owner has very few employees and only one person handling the bookkeeping:

  • Sign all checks yourself. Set up certain days of the month when you are in the office specifically to sign checks. If this isn’t always possible, authorize one other person to sign checks, but that person should not be the one writing the checks or who has access to the check stock.
  • Have bank statements with cancelled checks or images of the checks mailed to your home. Banks don’t always include the cancelled checks, so you may have to request this. Even if you don’t have time to review the bank statement thoroughly, make it look as if you did, and then bring it into the office for the bookkeeper to prepare the bank reconciliation. At the minimum, verify the vendors and signatures on all checks.
  • Don’t wait for the bank statement to arrive. Go online frequently to look at transactions and view cleared checks. No one else should have online access. If someone else must have online access, set up limited access to view the transactions with no authority to make transfers or payments.
  • Keep the check stock in a locked drawer. Minimize the temptation.
  • Personally approve invoices. Be familiar with vendors and watch for duplicate payments. (Refunds can easily be deposited into someone else’s account.) Verify the existence of new vendors and be wary of post office boxes for the addresses and initials for the names.
  • Be knowledgeable enough in the accounting software to navigate around to various screens and reports. Get outside training if necessary. Be in the program frequently and randomly so the bookkeeper will never know when you might be in it and what areas you might be viewing. One option is to set up online access, so you can view recent transactions, monitor accounts receivable, and look at vendor details during evening hours or when you are away from the office.
  • If you take credit cards from your customers, be wary of credits on the merchant statement. A person with access to the merchant account can easily give credits to their own credit cards.
  • Do background checks on all new employees. People with credit problems of their own may not be the ones you want handling your money. Situational factors, such as personal financial pressures, play a large role in the motivation to commit fraud (the second leg of the fraud triangle).
  • Require bank reconciliations to be done promptly each month. Review the bank reconciliation report and look for outstanding items.
  • Be unpredictable. This is the most important control to keep in mind. Even if you have very clear internal controls with a good separation of duties, shake it up every so often so no one gets too comfortable.


To ensure compliance imposed by IRS Circular 230, any U.S. federal tax advice contained in this article is not intended or written to be used, and cannot be used by any taxpayer, for the purpose of avoiding penalties that may be imposed by governmental tax authorities. The answers in this column are meant to offer general information. You should consult your tax adviser regarding the specifics of your situation.

Peter Robbins is a partner in the Boise office of CliftonLarsonAllen, LLP specializing in tax matters for small businesses, individuals, and trusts and estates.

Have a question for Robbins? Email your question to news@idahobusinessreview.com. Enter “Talking Tax” in the subject line.

About Peter G. Robbins, CPA