In the 2020 Report on the Nations, the Association of Certified Fraud Examiners (ACFE) estimates that, on average, organizations lose 5% of total revenues to fraud annually. According to the ACFE, “occupational fraud-fraud committed by individuals against the organizations that employ them-is among the costliest forms of financial crime in existence.”

Unfortunately, the number of employees or industry doesn’t exempt businesses from losses due to fraud.

Although not 100% foolproof, an internal control system is an effective way for any size business to reduce risks from fraud. A simple internal control system will also help keep operational objectives on track.

Not sure where to begin? This guide, an internal control checklist for small business, we’ll get you started.

What is an Internal Control Checklist?

An internal control checklist for small business is a management tool used to evaluate the company’s policies and procedures designed to efficiently guide business objectives.

Whether a small business has 15 or 500 employees and $50,000 or $25.5 million in annual revenue, there is an essential need to establish a system of checks and balances that protect business assets from fraud. A good internal control checklist should cover all aspects of an effective control system, starting with the recommended five components.

The Five Components of an Internal Control System

The Committee of Sponsoring Organizations (COSO) provides the framework for an internal control system and suggests the system include five components:

  1. Establish a control environment
  2. Conduct risk assessments
  3. Implement control activities
  4. Create effective communication and information systems
  5. Monitor control systems

The overriding principle of internal controls for a small business is to set up a system of accountability in all areas of the business. From physical assets and petty cash to employee attitudes and the bookkeeper’s reliability, setting a few internal controls in place can make a big difference in the business running efficiently, achieving goals, and experiencing growth.

Internal Control Checklist for Small Business

The following internal control checklist for small business presents some basic examples of internal controls for each of the five components of internal controls.

Control Environment

The control environment sets what is often referred to as the “tone at the top.” To develop a strong foundation for a system of internal controls, it’s important for business owners to present the concept of internal controls in a positive way, encouraging personnel to adopt and enforce controls.

To create or improve your control environment, start with these:

  • Management and supervisors encourage a positive attitude toward adopting internal controls
  • Ethics, values, and integrity are emulated and encouraged from the top down
  • Staff and employees receive written policies and procedures which outline the internal controls for your small business
  • Business has a well-defined and clearly stated code of ethics
  • All staff are accountable for following internal controls as defined by their job description
  • Before hiring new employees, managers complete background checks and verify employment history

Risk Assessment

Strong internal controls cannot be implemented without uncovering potential risks. A thorough risk assessment includes:

  • Identify the areas in your organization that present the greatest risk for fraud
  • Identify vulnerabilities in financial reporting
  • Have regular internal audits conducted for accounting records and industry compliance and regulations
  • Evaluate the effectiveness of current security systems and protocols for safeguarding physical assets, cash, customer information, and employees

Control Activities

To create a thorough internal control checklist for small business, include specific control procedures that all staff are expected to comply with and execute, depending on their various responsibilities. Some examples of control activities:

  • Establish a system for segregation of duties, especially for bookkeeping and handling cash ( the one person responsible for Bank deposits should not be the same person who handles cash flow and cash receipts)
  • Complete regular bank statement reconciliations
  • Supervisory authorization for cash disbursements is required from someone other than the bookkeeper
  • Document and standardize processes for operational activities
  • Equipment, inventory, other physical assets, and the building are locked up after hours
  • Secure digital assets via password protection and/or a cybersecurity system
  • Purchase adequate insurance coverage for physical assets

Communication and Information

Communication and information systems are key factors in ensuring the reliability of financial reporting, improving accountability in the workplace, and streamlining day-to-day operations.

  • Information affecting personnel’s ability to complete assigned duties is distributed in a timely manner
  • Bookkeeper is provided financial statements and other necessary accounting records on a timely basis
  • All new employees receive a policies and procedures manual
  • Create specific job descriptions for various duties within the organization
  • Employees receive training whenever there are changes in business processes or departments policies


Monitoring is a final component of an internal control system. It’s here that an organization begins to learn how to strengthen internal controls and determines which established internal controls are working as designed.

  • Perform unscheduled spot checks of inventory and bank reconciliations
  • Schedule an internal audit with a certified public accountant (CPA)
  • Managers conduct occasion unscheduled cash register checks, reconciling credit card and cash sales
  • Cross-check recent bad debt write-offs
  • Conduct annual employee evaluations
  • Review changes in state or federal laws and regulations and evaluate current compliance policies
  • Cross-reference accounts receivable journal entries against receiving documentation
  • Monitor customer, outside vendor, and stakeholder feedback
  • Evaluate accounts payable processes by matching invoices to purchase orders

Put Your Internal Control Checklist for Small Business on Autopilot

Many small businesses do not institute an internal control system because they feel they lack the resources to do so. Yet, protecting your business from fraud while meeting operational goals is critical to running a successful operation.

An organization’s control system can be made much easier with an automated system. ZenGRC provides businesses of all sizes a cost-effective, unified system to manage controls. Learn how we can fit into your business today.

Improve How You Manage
Internal Controls