Even if you are a small business, you can still set up a strong internal control and fraud mitigation framework with proper separation of responsibilities.
Every time money is going out the door, you want to have multiple people involved in the transaction. This includes both payments to vendors and customer refunds. For a small business, I recommend three people are involved.
- One person is responsible for updating the accounting and general ledger. If it is an electronic payment from the company bank account, this same person can set up the payment in the bank’s system. Note: in a larger company, you would want a fourth person to be responsible for setting up the payment in the bank’s system.
- One person is responsible for approving the payment in the bank’s system. If it is a check payment, this person should also have check signing authority and sign the check.
- One person is responsible for the bank reconciliation; comparing what is in the bank account with what is in the accounting records or general ledger. This person’s job is to catch anything that one of the other two people may have done without the other’s knowledge. This way, no single person can independently send money out the door without at least 2 other people knowing about it.
Furthermore, all payments should have proper backup, including an invoice or contract specifying the amount to be paid, when, and to whom, and be approved by the responsible manager.
If resources are really tight, I would recommend one of two options:
- Combining roles 1 and 3 from above. So you still have two eyes on each transaction, which is better than nothing.
- Hiring an outside professional as the third set of eyes to prepare the bank reconciliation. I recommend a professional accountant or someone who subscribes to similar professional ethics.
In summary, for a small business or startup, three sets of eyes are ideal.
