7 Internal Controls a 10-Person Business Can Actually Run
Sam's List Editorial | 2026-08-06
7 Internal Controls a 10-Person Business Can Actually Run Small-business money almost never disappears in a heist. It leaks. One trusted person has the bank login, the vendor list, the card program, and the bookkeeping file. Nobody is doing anything wrong on purpose. Then a personal charge gets reclassified as office supplies, and nobody catches it, and the absence of a catch becomes the discovery that nobody is looking. Three years later the number is large. Internal controls for small business exist to close that loop. The problem is that every framework you find was written for a company with a controller, an accounting department, and enough people to separate duties cleanly. You have nine employees and one bookkeeper. Here are seven controls that work at that size. Each one is a specific behavior, not a policy binder. 1. The Internal Control for Small Business That Matters Most The textbook rule is segregation of duties: whoever authorizes a payment should not also have custody of the money or record the transaction. In a 10-person company you cannot split three roles three ways. You can split one. Pick the break that matters most, which is almost always this: the person who enters payments should not be the person who approves them. If your bookkeeper builds the payment run and you release it, you have installed the single highest-value control available to a small business. It costs you about ten minutes a week. The tradeoff is real, though. An owner who approves without looking has installed a rubber stamp, not a control, and a rubber stamp is arguably worse because it creates false comfort. 2. Open the Bank Statement Yourself Not the reconciliation. The statement. The oldest small-business fraud in existence works by controlling the flow of information from the bank. If the person keeping the books also receives, downloads, and files the statements, the record you review is the record they produced. Get read-only bank access in your own name, or have statements delivered to an address only you control, and scan them monthly. You are looking for payees you do not recognize, round-dollar transfers, and anything to a new destination. Five minutes. This single habit closes the largest structural hole in most small companies, and it requires no software, no policy, and no conversation. 3. Put a Gate on New Vendor Setup The two most common payment frauds both enter through the same door. One is a fictitious vendor added to the payables file. The other is a real vendor whose bank details get quietly changed to someone else's account. Neither is caught...
