What it means
Accounting controls answer a simple question: how do you know the numbers are right? Every business has transactions flowing in from sales, purchasing, payroll and banking, and controls are the checkpoints that catch mistakes and deter dishonesty before either reaches the accounts.
Without them, a set of accounts is only as reliable as the least careful person who touched the ledger. The controls fall into recognisable families.
Preventive controls stop problems happening, such as requiring two signatures above $10,000 or blocking a supplier payment where the bank details changed without verification. Detective controls find problems after the fact, such as monthly bank reconciliations, supplier statement reconciliations and exception reports on duplicate invoice numbers.
Separation of duties is the single most valuable structural control and the one small businesses most often skip. The person who sets up a new supplier should not be the person who approves the invoice or the person who releases the payment, because combining those roles gives one individual the ability both to create a fraud and to conceal it.
Where headcount will not allow full separation, the owner reviewing the bank statement line by line each month is a workable substitute. Controls are also about completeness, not just accuracy.
Sequentially numbered invoices, daily till reconciliations and stock counts are there to prove that everything that happened was recorded, which matters just as much as proving that what was recorded actually happened. Revenue that never reaches the ledger is invisible to any check that only tests recorded entries.
Every control has a cost, so design is a judgement about proportion. Requiring three approvals on a $40 stationery order wastes more money in time than it protects, while leaving a $500,000 payment run with a single approver invites disaster.
Sensible organisations set thresholds, document who does what, and test periodically that the control is actually being performed rather than merely written down.
In practice
Real-world examples.
Example
A veterinary group requires that any change to a supplier's bank details is confirmed by telephone to a number held on file, not to a number in the email requesting the change. The control costs a five minute call and has stopped two attempted payment redirection frauds in a year.
Example
A restaurant chain reconciles till takings to bank deposits daily at each site and produces an exception report for any variance above $50. A persistent small variance at one site led to the discovery of unrecorded refunds being processed at the end of each shift.
Example
A manufacturer runs a monthly report matching goods received notes to supplier invoices. Items received but not invoiced are accrued so the month end cost of sales is complete, and items invoiced but not received are held back for query rather than paid.
Formula
Calculation
Control design is often justified with a simple cost benefit calculation: Net benefit = (Expected annual loss x Proportion of loss the control prevents) - Annual cost of the control.
A services business processes 12,000 supplier invoices a year. A sample review finds that roughly 0.5% are duplicated or incorrectly priced, and the average value of an affected invoice is $1,800.
Expected annual errors: 12,000 x 0.5% = 60 invoices.
Expected annual loss: 60 x $1,800 = $108,000.
The company considers an automated three way matching control comparing purchase order, goods receipt and invoice, which is expected to prevent 90% of these errors and costs $35,000 a year in software and staff time.
Loss prevented: $108,000 x 90% = $97,200.
Net benefit: $97,200 - $35,000 = $62,200.
The control pays for itself nearly three times over, and that is before counting the audit time saved and the deterrent effect on anyone contemplating a fictitious invoice.Case study
Seen in the real world.
Wrenfield Sanitaryware is a fictional bathroom products wholesaler described here as an illustrative example. As it grew from eight staff to sixty, the founder kept the original arrangement in which the office manager raised purchase orders, approved invoices, set up suppliers and released the weekly payment run.
An insurer reviewing the company's cover asked how payments were controlled, and the answer prompted an internal review. Over four years, $186,000 had been paid to two supplier accounts that existed only as bank details, hidden in a ledger nobody else reconciled.
Wrenfield separated the duties across three people, introduced a bank reconciliation reviewed by the finance director, and required dual approval on payments above $5,000. The control changes cost roughly $28,000 a year in additional time, which the illustrative company judged cheap against a loss it had funded silently for four years.
Watch out
Common mistakes.
- Writing a control policy and never testing whether it is actually performed. A documented approval step that everyone bypasses when the month end is busy provides no protection at all.
- Relying entirely on trust in a long serving employee. Controls are not an accusation, they are the structure that protects honest staff from suspicion as much as it protects the business from loss.
- Assuming accounting software provides the controls automatically. Software enforces what it is configured to enforce, and default settings often allow one user to create a supplier and pay it in the same session.
Questions
People also ask.
What is the difference between accounting controls and administrative controls?
Accounting controls focus on the accuracy of financial records and the safeguarding of assets, while administrative controls cover operational efficiency and adherence to management policy more broadly.
Can a very small business achieve separation of duties?
Not fully, but the owner can take back the highest risk steps, typically opening the bank statement, reviewing the payment run and approving new suppliers personally.
How often should controls be reviewed?
At least annually, and immediately after any significant change in systems, headcount or transaction volume, because controls tend to decay quietly as processes evolve around them.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%