—Guide
Internal Controls for Growing Businesses: A Practical Starter Framework
The handful of internal controls that prevent most fraud and errors in growing Indian businesses — payments, purchases, payroll, cash and access — and how to put them in place.
Most frauds and costly errors in small and mid-sized businesses don't need sophisticated schemes. They exploit missing basics: one person who can create a vendor and pay it, bank details changed on the strength of an email, or reconciliations nobody reviews. This guide sets out a starter framework that covers the biggest risks without burying a growing team in process.
Start With the Risks, Not the Rules
Controls exist to stop specific things going wrong. Before writing any policy, list what could hurt the business most: money leaving to the wrong person, stock disappearing, revenue not being billed, payroll paying people who don't exist, or filings being missed. Design controls for those first.
Payments: The Most Important Area
- Two-person release of bank payments, using maker-checker in the bank's portal.
- Independent verification of any change in vendor bank details, by calling a known number — never one in the email requesting the change.
- Payments made only against approved invoices matched to purchase orders or contracts.
- A monthly review of the bank statement by someone who does not make payments.
Purchases and Vendors
- Separate the person who creates vendors in the system from the person who approves payments.
- Use purchase orders above a set value.
- Check GSTIN and PAN when onboarding vendors, and verify that GSTR-2B supports input tax credit.
Sales and Receivables
- Reconcile dispatches or service delivery with invoices raised, so nothing goes unbilled.
- Approve credit notes and discounts above a threshold.
- Review ageing monthly and follow up overdue accounts.
Payroll
- Have HR, not payroll, add new employees and record exits.
- Compare each month's payroll with the previous month and explain variances.
- Match PF and ESI headcounts with payroll.
Cash, Stock and Access
- Keep petty cash on an imprest basis, with surprise counts.
- Count stock periodically, and investigate differences.
- Give system access based on role, and remove leavers the same day.
When the Team Is Too Small to Separate Duties
In a five-person business, full segregation of duties isn't possible. Use compensating controls instead: the founder reviews the bank statement monthly, approves payments in the bank portal, and reviews a list of new vendors and payroll changes. These take minutes and close most gaps.
Write It Down
Keep a short controls document listing each control, its owner, how often it runs, and what evidence is kept. It helps new staff, supports auditors, and forms the basis for internal financial controls reporting as the company grows.
Getting Help
Think Filing designs practical controls frameworks for growing businesses, and configures them in accounting and banking systems.