Internal controls for teams of one to ten
Textbook internal control assumes three people. Most businesses have one, and that person is also doing sales.
The classic answer — segregate duties so the person who approves a payment is not the person who makes it — is genuinely unavailable to a sole trader. That does not mean control is unavailable. It means the controls have to be detective rather than preventive: not a gate you must pass, but a record that notices when something is missing.
Controls that survive a team of one
- Support behind every entry: a posting with no attached document is flagged, not blocked.
- Independent proof of cash: monthly bank reconciliation against a statement you did not create.
- An immutable ledger: corrections happen through reversals that remain visible, never by editing history.
- A master list of real suppliers, customers, banks and employees, so a payment to an unrecognised counterparty stands out.
- Period locking, so a closed and reported month cannot quietly change afterwards.
Flag, do not block
Hard blocks train people to work around the system — the entry gets posted somewhere else, or not at all. A better pattern is to let the posting through and raise an exception against it: lodgement recorded without a stamped bank slip; inventory purchased with no supplier invoice; a loan on file with no interest charged this month. The work still happens; the gap is now a visible, assignable item rather than a surprise at year end.
Standing documents are controls too
A loan agreement, a lease, a depreciation policy — each one implies entries that must recur. Once the system holds the agreement, it can notice the month the interest was not charged or the depreciation run that never happened. That is a control no small team can reliably perform from memory.
The goal is not to stop you posting. It is to make sure nothing unsupported ever gets forgotten.
