Internal Controls Design & Documentation

What is internal controls design?

Internal controls are the checks built into how a business operates: who can approve what, who can pay whom, how stock is protected, and how errors are caught. Designing them means deciding which risks matter, what controls address them, and how to document them so people actually follow them.

For a growing business, good design matters more than volume. A few well-placed controls — approvals, segregation of duties, reconciliations — prevent most fraud and error, without drowning the team in process.

The key terms

The building blocks of a control framework:

Delegation of authority

A matrix setting out who can approve which decisions, up to what amounts.

Segregation of duties

Splitting tasks so no one person can initiate, approve, and record the same transaction.

Preventive controls

Controls that stop errors or fraud happening, like approvals before payment.

Detective controls

Controls that find problems after the fact, like reconciliations and reviews.

Maker-checker

One person enters a transaction, another reviews and approves it.

Automated controls

Controls built into systems, like approval workflows and duplicate checks.

Control owner

The person responsible for performing each control and keeping evidence.

Why it matters

Controls protect the business as it scales:

Fraud prevention

Most frauds in small businesses exploit missing basic controls, like unverified vendor changes.

Fewer errors

Reviews and reconciliations catch mistakes before they reach the accounts.

Founder time

Delegation frees founders from approving everything.

Audit readiness

Documented controls make audits and IFC reporting smoother.

Investor confidence

Investors and lenders look for basic controls in diligence.

Scalability

Controls designed early grow with the business.

Compliance

Controls help make sure filings and payments happen on time.

Who is this for?

Testing controls against the auditor's IFC reporting is covered by our Internal Financial Controls Review service.

Types of controls

A balanced framework uses several types:

What we'll need from you

Organisation chart

Roles and reporting lines.

Key processes

How purchases, sales, payroll, and payments work today.

Systems

Accounting, banking, and operational systems used.

Known issues

Past errors, frauds, or audit points.

Policies

Any existing policies or approval practices.

Growth plans

Expected changes in size, locations, and systems.

Engagements are quoted based on the number of processes and locations.

How we design controls

Our approach:

1. 1

   Map processes

   Key processes are walked through with the people who run them.

2. 2

   Identify risks

   What could go wrong at each step is identified.

3. 3

   Design controls

   Practical controls are designed for the most significant risks.

4. 4

   Set authority

   A delegation of authority matrix is agreed.

5. 5

   Configure systems

   Controls are built into systems wherever possible.

6. 6

   Document and train

   Controls are documented and the team trained.

Keeping controls working

Controls need maintenance:

Evidence

Keep evidence that controls were performed.

Periodic review

Check periodically that controls are actually operating.

Update for change

Update controls when processes, people, or systems change.

Access reviews

Review system access regularly, removing leavers promptly.

Learn from incidents

When something goes wrong, fix the control gap.

Board oversight

Report on controls to the board periodically.

Benefits and responsibilities