Internal controls for small businesses

Why small businesses need them most

Large companies have audit teams. A 20-person trading business usually has one trusted accountant, a cashier and the owner. Trust is necessary, but it is not a control. Most losses in small businesses come from ordinary gaps: a credit note nobody questioned, cash receipts not deposited for weeks, stock that left without a bill, a supplier paid twice.

Good controls also protect honest staff. When every entry has an owner and a check, nobody is wrongly suspected.

The four principles

1. Split duties. The person who handles cash should not be the one who records it, and the person who records should not be the one who reconciles.
2. Approve before, not after. Credit limits, discounts, payments and write-offs above set amounts need approval before they happen.
3. Document everything. Every voucher has a source document: bill, challan, receipt, slip.
4. Check regularly and by surprise. Reconciliations, counts and reviews on a fixed schedule, plus occasional surprise checks.

In a very small team, full separation is not always possible. If one person must both record and handle cash, the owner's review becomes the second pair of hands: a quick daily look at receipts and the cash balance, and a monthly look at the bank statement yourself.

Controls by area

A worked example: the credit note leak

A paint dealer gives retailers a 2% rate difference by credit note when they complain about price. Nobody reviews the notes. Over a year, the billing clerk issues ₹4,80,000 of credit notes, of which ₹1,10,000 are to two customers who are the clerk's relatives, for complaints that never happened.

The controls that would have caught it:

• Credit notes above ₹2,000 need the owner's approval in the system.
• A monthly report of credit notes by customer, read by the owner.
• Party statements sent to every customer each month — a genuine customer would ask why they received an unexpected credit.

None of these needs extra staff. See credit notes and debit notes in GST for how they should be issued.

Access and software controls

• One login per person; no shared passwords.
• Restrict alteration and deletion of vouchers, and closed periods, to senior users.
• Keep an audit trail switched on. Under company law, many companies are required to use accounting software with an edit log; check with your CA whether it applies to you.
• Back up data daily and keep one copy off the premises. See backing up accounting data.
• Remove access the day someone leaves, including phone apps.

An owner's control checklist

Daily: cash and bank balance; sales and receipts; any cancelled or altered bill.

Weekly: overdue receivables; payments made; credit notes issued; stock transfers in transit.

Monthly: bank reconciliation reviewed; petty cash surprise count; party statements sent; new parties and price changes reviewed; GST books vs returns.

Quarterly / yearly: full or cycle stock count; balance confirmations from major parties; review of who has access to what.

Controls that fit with Cashflow OS

Cashflow OS supports several of these habits with your Tally data. Roles per company limit who sees accounts; salespeople see only items and their own customers. Writing back to Tally is off until the owner turns it on, frontline orders can need approval, and deleting a voucher needs a reason and an authorised user. The owner can see team activity, check the Day Book and cash and bank books from the phone, and send party statements on WhatsApp. See team roles.