Practical Internal Controls for Small Organizations

by Patrick T. Copeland, CPA, Staff Associate II

Posted on May 3, 2017

Our firm works with organizations with varying staff sizes, but regardless of size, every organization must implement a system of internal controls over key financial processes and financial reporting.While this can be difficult for small organizations where many employees “wear many hats”, it’s still imperative that internal controls are incorporated where possible.The following includes a starting point and ideas to provide some “Best Practices” for internal control.

A properly designed internal control system can help prevent and/or detect financial misstatements or fraud in your organization.An internal control system should safeguard the organization’s assets, and attempt to divide responsibilities among several employees, where possible. Additionally, the internal control system should be understood by all concerned parties.

Board members’ and management’s attitude toward controls is key to setting the right tone.They should have high integrity and ethical values and be committed to developing and maintaining sound internal control procedures.In small organizations, the board members may even perform some of the key internal control procedures.

Documenting your entity’s procedures will not only help in sustaining the organization’s internal control system, it also will help train new employees on their job duties. Reviewing and updating procedures on a yearly basis helps ensure that the controls are still operating as designed.Ideally, reviews should be conducted by management and/or board members not involved in the internal control process.If weaknesses are detected, the reviewer should follow-up and update the procedures as deemed necessary with board approval.In addition, continuous outside training for board members, management, and other relevant personnel can help ensure the internal control system stays up-to-date with industry changes and technology.

Here is a list of some suggested controls that may help your organization:


  • Ensure your organization has a delayed payroll calendar.
  • Incorporate reviews and authorizations of non-exempt workers’ timesheets.
  • Distribution of payroll checks should not be handled by the individual processing payroll.
  • Outsource payroll processing, preparation of tax filings and remitting taxes due.

Accounts Payable

  • Require pre-approval for purchases made on behalf of the organization.
  • Review the list of check signers periodically.
  • Protect checks by keeping them in a secure location with limited access and never have signed blank checks.

Credit Cards

  • Maintain a current listing of all credit card users.
  • Ensure supporting documentation is required and reviewed for all purchases.


  • Ensure that individuals who open the mail are not also responsible for bank deposits.
  • Require that the individual who opens the mail also maintains a cash/check log.
  • Require that checks received in the mail are immediately endorsed.
  • Require all un-deposited funds to be in a locked drawer with limited access.
  • Make deposits on a consistent basis, at least weekly if significant.

Bank Reconciliations

  • Prepare bank reconciliations in a timely manner.
  • Ensure bank reconciliations are prepared by someone other than the individuals who make deposits or process accounts payable. If this is not possible, identify another employee to review the completed bank reconciliations.

Financial Statements

  • Establish and maintain a journal entry review and approval process.
  • Prepare monthly financial statements that are reviewed by management and presented to board members.
  • Compare actual results to budgeted expectations on a monthly basis, explaining any major fluctuations.

Aside from these suggestions, also consider the internal control recommendations in the following articles: