Every business loses some money in ways the owner never decided to spend it. Stock that disappears. Cash that comes up short at the end of the day. A supplier invoice paid twice. Discounts given that nobody approved. A customer who was never billed.
In a small business the owner can often see all of it, because they're in every transaction. As the business grows, the owner moves further from the transactions, and the losses get harder to see, whether or not they're any larger. And a loss you can't see can't be fixed, and tends to grow.
Internal controls are how a business sees. This guide is about building them in proportion: enough to catch problems early, without slowing the business down or treating your team as suspects.
What I want to do here is start from why money leaks at all, and then build up the few controls that stop most of it, in order of how much they protect.
Three kinds of leakage
It helps to separate the three ways money leaks, because they have different causes and different fixes.
Error is unintentional. A wrong price keyed in, an invoice entered twice, an order shipped to the wrong customer, a delivery not billed. Error is often a bigger source of loss than owners expect, and it has nothing to do with honesty.
Waste is avoidable cost that nobody is responsible for. Stock that expires, materials over-ordered, subscriptions nobody uses, overtime that a better schedule would have avoided.
Theft and fraud are deliberate. Cash taken from the till, stock walked out of the store, fake supplier invoices, discounts given to friends, sales made off the books.
Good controls address all three at once, and that's an important point to hold onto. Most of the controls that catch fraud also catch error, which means they're useful even in a business where you trust everyone completely.
Why fraud happens
A useful model for understanding fraud is the one criminologist Donald Cressey called the fraud triangle. For someone to commit fraud, three things usually come together.
Pressure: a personal need, often financial. A debt, a family emergency, an addiction.
Opportunity: a way to take money and not get caught. This is the only one of the three a business directly controls.
Rationalisation: a story that makes it feel acceptable. "I'm underpaid." "I'll pay it back." "Nobody will miss it."
The practical implication is a hopeful one. A business has no reach into its staff's private pressures, or into the stories people tell themselves. Opportunity is the part within its reach, and when most of the opportunity goes, much fraud never starts. People who would never steal under normal circumstances can be tempted under pressure, if the gap is obvious and the chance of being noticed is low. Good controls protect honest people from that moment.
Does that make sense? Think of a locked door. A lock makes no accusation against your neighbours. What it does is remove a temptation that would otherwise sit in front of everyone, every day, and it means nobody ever has to wonder who left the door open. Good controls work the same way inside a business.
The core controls
There are a handful of controls that do most of the work in a small business. None of them is complicated.
Separate the duties that check each other. The person who handles cash shouldn't also be the person who records it. The person who orders from suppliers shouldn't also be the person who approves payment. The person who counts stock shouldn't also be the person responsible for it. When one person does both halves of a task, they can make mistakes, or take money, and also hide it. When two people do the halves, each one checks the other without anyone needing to accuse anyone. In a very small team, where full separation isn't possible, the owner can be the second person for the riskiest steps: approving payments, reviewing the bank statement.
Set approval limits. Decide who can spend, discount or write off how much without asking. "Purchases up to LKR 25,000 by the supervisor; above that, the owner." "Discounts up to 5% at the salesperson's discretion." Limits keep small decisions moving and put a pause in front of large ones.
Reconcile everything that can be reconciled. A reconciliation compares two records that should agree. Every day: the till against the sales recorded. Every month: the bank statement against the books, and supplier statements against the payables (money you owe suppliers) ledger. Regularly: the stock count against the stock records. When two independent records agree, you can trust both. When they don't, you've found something, and you've found it early.
Count stock, including by surprise. Full counts at least a few times a year, and small surprise counts of high-value or easily-taken items in between. The surprise matters. A count everyone knows is coming in a week checks very little.
Protect the physical things. Locked storage for valuable stock, limited keys, a safe for cash, cash banked daily instead of kept on site, CCTV where it's appropriate and staff know about it.
Make sure people take leave, and rotate tasks. Some frauds require someone to be present every day to keep them hidden. When a person who never takes leave finally does, and someone else covers their work, problems often surface. Covering each other's work is also a fallback plan for the business, which is useful in its own right.
Variance analysis: controls that watch numbers
The controls above stop problems at the point of the transaction. A second layer watches the numbers afterwards, looking for patterns that shouldn't be there.
Variance analysis compares what you expected to happen with what did. A few that work well in small businesses:
Gross margin (the share of each sale left after paying for the goods) by month, and by product or branch if you can. If the margin drops and prices and supplier costs haven't changed, something is leaking: theft, waste, unrecorded discounts or pricing errors.
Expected stock against counted stock. If you bought 1,000 units, sold 850 and counted 120, thirty units have gone somewhere.
Cash sales as a share of total sales, by day and by person. A shift or a person whose cash sales are consistently lower than others' may be worth a closer look.
Refunds, voids and discounts by person. These are common routes for till fraud, and they show up as unusual patterns long before anyone gets caught in the act.
Supplier payments against orders. Payments with no matching order, new suppliers nobody recognises, invoices just under an approval limit.
The point of these isn't to accuse anyone when a number looks odd. Most odd numbers have innocent explanations, a delivery recorded late, a count done wrong. The point is to ask, every time, and to find the explanation. Asking consistently is itself a control: people behave differently when they know the numbers are read.
Proportion
Every control has a cost: time, friction, the feeling of not being trusted. A business that controls everything heavily becomes slow, and good people leave places that treat them as suspects.
So match the strength of the control to the size of the risk. High-value stock, cash, supplier payments and discounts need strong controls. A box of pens doesn't. And explain the controls to your team as what they are: protection for the business and for them. When the till is reconciled every night with two people present, nobody can ever be wrongly suspected of a shortfall.
Three attitudes to control
The first is trust: I know my people, so I don't need checks. It feels generous, and it leaves honest staff exposed to suspicion the first time something goes missing.
The second, often after a theft, is suspicion: watch everyone. It catches little, slows everything down and drives good people away.
The third holds trust and checking together. The controls are routine, applied to everyone and explained openly. They make honesty the easy path and mistakes visible early.
That's the bigger point: controls protect relationships as much as money, because they replace guessing and suspicion with information.
How Gridwerk helps
Our Process & Financial Control Implementation service designs and installs these controls in proportion to your business, building on the process and financial work in our other services, and sets up the variance analysis that shows you when something is leaking. If you suspect money is going missing, or just want to be sure it isn't, start with the free diagnostic. It's eighteen questions, about seven minutes, and then we call you to go through the rest.
Gridwerk diagnostic