When a business is growing fast, internal controls feel like the boring grown-up topic nobody wants to talk about. Sales is up. The team is hiring. New customers keep showing up. Why slow down to talk about controls?
I'll tell you why. Because in every fast-growing business I have ever fixed, the same pattern shows up: the business outgrew its controls about eighteen months before anyone noticed. By the time someone noticed, money had already been leaking out the side of the boat for a year and a half.
This article is for owners and operators of growing businesses ($2M to $15M in revenue) who suspect their internal controls may not be where they need to be — and who want a practical, concrete checklist they can use to find out.
What Internal Controls Actually Are
Forget the textbook definition. In plain English, internal controls are the procedures that make sure:
- Money goes where it's supposed to go
- The numbers in your reports actually match reality
- One person can't accidentally (or deliberately) cause a major problem
- Your business can survive a key person leaving without falling apart
That's it. Everything in the rest of this article is in service of those four outcomes.
The Six-Question Diagnostic
Before you go through the full checklist, answer these six questions honestly. If you can't answer any of them with confidence, you have a controls problem.
- Can you tell me, today, how much cash you have on hand and what's coming in and going out this week? Not "I'll ask my bookkeeper." You.
- Does anyone besides the person writing checks also see the bank statement? If the same person can write a check and reconcile the bank, that's a controls failure.
- If your bookkeeper got hit by a bus tomorrow, could someone else close the books next month? If not, your knowledge is sitting in one head.
- Are your accounts receivable accurate? When you look at AR, does it represent real money customers actually owe — or is it cluttered with old invoices nobody plans to pay?
- Does anyone review expense reports before they're paid? Or do they just go through?
- When was your last bank reconciliation? If you have to think hard about the answer, that's the answer.
The Internal Controls Checklist
Cash & Banking
- Bank reconciliations done monthly, reviewed by someone other than the preparer
- Two-signature requirement on checks above a defined threshold
- Wire transfers require dual approval
- Bank account access reviewed quarterly (especially when employees leave)
- Deposits and disbursements separated from recordkeeping
Accounts Receivable
- Aging report reviewed weekly by leadership, not just AR clerk
- Documented escalation path for past-due accounts
- Credit approval process for new customers
- Invoices reviewed for accuracy before they go out
- Disputes tracked and resolved on a defined timeline
Accounts Payable
- Three-way match (PO, receipt, invoice) before payment
- Vendor master file reviewed quarterly for duplicates and inactive vendors
- New vendor setup requires more than one approval
- Expense reports reviewed against policy and supporting documentation
- Recurring payments reviewed annually
Payroll
- Payroll registers reviewed by someone other than the preparer
- Changes to pay rates require documented approval
- Termination workflow includes immediate access removal
- Time-off and overtime tracked in a single source of truth
Financial Reporting
- Month-end close completed within ten business days (target: five)
- Documented close calendar with owners and deadlines
- Balance sheet reconciliations performed monthly for all major accounts
- Variance analysis (actual vs. budget) reviewed monthly by leadership
- Documented chart of accounts
Documentation & Knowledge
- Standard operating procedures written down for every recurring financial process
- At least two people trained on every critical task
- System access reviewed quarterly
- Backup and recovery procedures tested at least annually
What to Do With Your Results
Go through this checklist honestly. Mark the items where you can confidently say "yes, we do that, and I can prove it." Mark the items where you can't.
If your honest count is below 70%, you have a meaningful internal controls gap. That doesn't mean disaster is imminent. It means the longer you wait, the more expensive the eventual fix becomes — and the higher the chance that something quietly goes wrong before you catch it.
The cost of fixing controls before something goes wrong is always smaller than the cost of fixing them afterward. Always.
The good news: most controls gaps are fixable in 60 to 120 days. The work isn't glamorous, but it's not complicated either. What it requires is somebody who has done it before, working alongside your team to put the right structures in place — and training your people to maintain them after the project ends.
That is exactly the kind of work I do. If your honest answer to the six-question diagnostic above made you uncomfortable, let's talk.