Setting up internal controls when you outsource accounting is mostly about deciding who prepares, who approves and who checks. An outside team can do most of the preparation, while you keep approval of anything that moves money or changes key records. With that split in place, outsourcing can actually tighten controls in a small business.
Key takeaways
- Separate preparing, approving and recording so no single person controls a whole transaction.
- Keep payment release and changes to vendor bank details with your own staff.
- Use named logins and role-based permissions in every finance system.
- Review reconciliations, aging reports and user access on a regular schedule.
- Confirm any change to bank details by phone using a number already on file.
Want a controls review of your finance setup? Book a free consultation
What are internal controls?
Internal controls are the rules and checks that keep your financial records accurate and your money safe. In a small business they are simple: approvals, separation of duties, access limits and regular reviews. Their purpose is to catch errors and make fraud difficult.
Splitting duties with an outsourced team
The outsourced team prepares:
- Bills, invoices and journal entries.
- Payment runs, ready for approval.
- Reconciliations and month-end reports.
You approve and release:
- Payments from your bank.
- New vendors and changes to vendor bank details.
- Write-offs, credit notes and unusual journal entries.
You review:
- Monthly reconciliations and the management report.
- Aging reports for old or unexpected balances.
- The user list in each system, every quarter.
Controls that stop common frauds
- Vendor bank detail changes: confirm by phone using a number already on file, never one from the email requesting the change.
- Duplicate payments: the team checks for duplicate bills before each payment run.
- Fake vendors: new vendors need your approval and supporting details.
- Expense claims: receipts are required and reviewed against policy.
Ask us how we split duties with clients
System access
Give each person their own login, turn on multi-factor authentication and grant only the permissions the work needs. Our post on is offshore accounting safe? covers access controls in detail. For how these controls apply to payables, see offshore accounts payable, and for questions to ask a provider, read how to choose an accounting firm in India. Our page on how we work describes our approach.
A monthly controls checklist for owners
These checks take less than an hour a month and catch most problems early:
- Read the bank reconciliation report and ask about any account with an unexplained difference.
- Scan the list of payments made during the month for vendors you don't recognize.
- Review any new vendors added and any vendor bank detail changes.
- Look at the aging reports for unusual balances, including customers in credit.
- Check journal entries over an agreed amount, with their explanations.
- Compare the month's results with last month and ask about large swings.
Your outsourced team can prepare each of these as a short report, so the review takes minutes.
Documenting your controls
Write your controls down in a one-page document: who approves what, the amount limits, how bank changes are verified and who reviews which reports. Share it with your outsourced team and update it when people or processes change. Lenders, investors and auditors often ask how controls work in a small business, and a written page answers that quickly.
Frequently asked questions
What is segregation of duties in a small business?
It means splitting a transaction's steps between different people, so the person who records a payment isn't the one who approves and releases it. Outsourcing makes this easier because the preparer is outside your team.
Should my outsourced accountant be able to approve payments?
Usually not. Keep approval and release with an owner or finance lead, and let the outsourced team prepare the payments.
How often should I review who has access to my accounting system?
At least quarterly, and whenever someone joins, leaves or changes role.
What is the most common payment fraud in small businesses?
Fraudulent requests to change a vendor's bank details are one of the most common. Verifying every change by phone, using a number already on file, stops most of them.
Build strong controls with Oakridge Global
We set up clear preparer and approver roles with every client. Schedule a consultation with Oakridge Global to review your current controls.