7 Internal Controls a 10-Person Business Can Actually Run

7 Internal Controls a 10-Person Business Can Actually Run

Small-business money almost never disappears in a heist. It leaks.

One trusted person has the bank login, the vendor list, the card program, and the bookkeeping file. Nobody is doing anything wrong on purpose. Then a personal charge gets reclassified as office supplies, and nobody catches it, and the absence of a catch becomes the discovery that nobody is looking. Three years later the number is large.

Internal controls for small business exist to close that loop. The problem is that every framework you find was written for a company with a controller, an accounting department, and enough people to separate duties cleanly. You have nine employees and one bookkeeper.

Here are seven controls that work at that size. Each one is a specific behavior, not a policy binder.

1. The Internal Control for Small Business That Matters Most

The textbook rule is segregation of duties: whoever authorizes a payment should not also have custody of the money or record the transaction. In a 10-person company you cannot split three roles three ways. You can split one.

Pick the break that matters most, which is almost always this: the person who enters payments should not be the person who approves them. If your bookkeeper builds the payment run and you release it, you have installed the single highest-value control available to a small business.

It costs you about ten minutes a week. The tradeoff is real, though. An owner who approves without looking has installed a rubber stamp, not a control, and a rubber stamp is arguably worse because it creates false comfort.

2. Open the Bank Statement Yourself

Not the reconciliation. The statement.

The oldest small-business fraud in existence works by controlling the flow of information from the bank. If the person keeping the books also receives, downloads, and files the statements, the record you review is the record they produced.

Get read-only bank access in your own name, or have statements delivered to an address only you control, and scan them monthly. You are looking for payees you do not recognize, round-dollar transfers, and anything to a new destination. Five minutes.

This single habit closes the largest structural hole in most small companies, and it requires no software, no policy, and no conversation.

3. Put a Gate on New Vendor Setup

The two most common payment frauds both enter through the same door. One is a fictitious vendor added to the payables file. The other is a real vendor whose bank details get quietly changed to someone else's account.

Neither is caught by reviewing payments, because by the time the payment appears, the vendor looks legitimate.

So gate the setup instead. A new vendor requires a W-9, a real business address, and a second person's approval before the first payment goes out. It slows onboarding by a day. That is the entire cost.

4. Write the Callback Rule Before You Need It

Somebody is going to email your bookkeeper claiming to be a vendor or an executive, asking to update banking details or push through an urgent wire. The email will look right. It may come from a real address that has been compromised.

The control is a rule with no exceptions: any change to payment instructions, and any payment above a threshold you set on purpose, requires a voice confirmation to a phone number already on file. Not the number in the email. The number you had before.

Pair it with a dual-approval threshold in the bank. Set the number where it actually bites, which for most small companies is lower than the owner's instinct says.

The limitation is worth stating plainly: callbacks stop the common attack, not a determined and well-informed one, and no control replaces skepticism about urgency.

5. Reconcile Everything, and Have Someone Else Read It

Most small businesses reconcile the operating account. Fewer reconcile the credit cards. Almost nobody reconciles the payment processors, which is where the differences between gross sales, fees, refunds, chargebacks, and deposits quietly accumulate.

Reconcile every account monthly. Bank, cards, merchant processors, loans, and any payment app the business uses.

Then add the part that makes it a control rather than a task: someone other than the preparer looks at the completed reconciliation and asks about the reconciling items. If a deposit in transit has been sitting there for four months, that is not a timing difference. That is a question.

6. Make Someone Take a Week Off

This one sounds like an HR policy and it is a control.

Anomalies in the books usually surface when a different person has to do the work. Mandatory backup coverage, meaning at least one continuous week a year where someone else runs the close, is how a lot of long-running problems get found, and it is also just good business continuity. If only one human on earth can produce your financials, you have a risk that has nothing to do with honesty.

The practical version at ten people: your outside accounting firm covers the week, and you use it as a working review rather than a vacation gap.

7. Write the Close Checklist Down

A documented month-end close checklist with initials and dates is the cheapest audit trail a company can own.

It does not need to be sophisticated. Reconcile these accounts, review this aging, confirm payroll tied out, book these accruals, review the profit and loss against last month, sign and date. Ten to twenty lines.

Three things happen once it exists. The close gets faster because nobody rebuilds the sequence from memory. Handoffs stop being catastrophic. And you get a record of who did what and when, which is exactly what a lender, a buyer, or an insurer will ask for later.

Where Internal Controls for Small Business Usually Fall Apart

Controls fail in small companies for one of two reasons, and neither is complexity.

The first is owner override. If the process applies to everyone except the person who wrote it, the staff learns quickly that the process is decorative.

The second is that nobody owns the calendar. Controls are recurring work. They compete with billable hours, and they lose, until a month gets skipped and then a quarter.

That is usually the point where the work needs an outside owner. Good Operator is a Sam's List accounting, finance, tax, and fractional CFO firm founded in 2017 and based in West Hollywood, California, working with small business owners, solopreneurs, digital nomads, and clients with K-1 partnership income. Installing a close checklist, running the reconciliations on a fixed calendar, and reviewing the exceptions is exactly the kind of recurring discipline that tends to need a dedicated owner rather than a spare Friday afternoon.

Good Operator has 31 verified client reviews on Sam's List as of 2026-08-06. Reviews reflect the experiences of individual clients, do not represent an endorsement by Sam's List, and are not indicative of future results.

Be clear-eyed about what this buys. Controls reduce the opportunity for error and misuse and make problems visible sooner. They do not guarantee that nothing goes wrong, and an outside firm does not remove the owner's responsibility to look. Confirm scope and fit before engaging, and compare firms in the Sam's List accountant directory.

Frequently Asked Questions

What are internal controls for a small business? Internal controls are the routine practices that make errors and misuse harder to commit and easier to spot: separating who approves payments from who enters them, reviewing bank statements independently, gating new vendor setup, reconciling every account monthly, and documenting the close. At small scale the goal is not a complete control framework. It is closing the two or three largest holes.

Can a business with no accounting department really segregate duties? Not completely, and pretending otherwise leads companies to do nothing. The workable approach is to pick the one break with the highest value, usually separating payment approval from payment entry, then compensate for the rest with owner review of bank statements and an outside accountant reviewing reconciliations.

What is the single most effective control for a very small company? Independent owner review of the bank statement, using access the owner controls directly. It requires no software, takes a few minutes a month, and it defeats the common pattern where the person keeping the books also controls the record you would use to check them.

How often should a small business review its controls? Once a year is a reasonable cadence for a full look, and immediately after any change in who handles money, any new banking or payment tool, or any material growth in headcount or transaction volume. Controls are designed around a specific set of people and systems, so they go stale when either one changes.

---

About the author: Kimberly Green is the cofounder of Sam's List, where business owners and high earners find vetted CPAs, financial advisors, and fractional CFOs. She's met one-on-one with 400+ financial professionals and writes from the real data behind thousands of client-advisor matches. Ask her anything about finding an accountant - she's heard it all, including the questions people are afraid to ask.