Short answer: A Dallas small business can have strong internal controls without a big accounting team: split a few key duties, require owner approval above set dollar amounts, verify every change to vendor bank details by phone, limit who can move money, and review reconciliations every month. Where there are too few people to separate duties, an outside reviewer fills the gap.
LUCI Financial Solutions, based in Dallas–Fort Worth, provides that independent review layer for service businesses through our outsourced controller work.
Key takeaways
- The person who records a payment should not be the only person who approves or reconciles it.
- Set dollar thresholds for owner approval and build them into your bank and bill-pay tools.
- Verify every vendor bank-detail change by calling a number you already have on file.
- Turn on multifactor authentication for banking, bill pay, payroll and QuickBooks.
- If a fraudulent payment goes out, call your bank at once, then report it at ic3.gov.
Internal controls sound like something for public companies with audit committees. In practice, they are a short list of habits that make it hard for one person to make a costly mistake, or to hide one, without someone noticing. Much of the fraud and error that hurts small businesses traces back to a few common gaps, and most can be closed at very little cost.
Separation of duties when you only have a few people
The core idea is simple: no one person should be able to start a payment, approve it, record it and reconcile it. In a large company, each of those steps belongs to a different person. In a business with one office manager and an owner, you split the duties that matter most:
- Whoever enters bills should not be the one who releases payments. The office manager or bookkeeper can enter and schedule bills; the owner approves and releases them.
- Whoever records deposits should not be the only one who sees the bank statements. The owner should have their own view of the bank accounts.
- Whoever runs payroll should not be able to change pay rates or add employees without approval.
- Whoever reconciles the accounts should not be the person who handles the cash, or, if that cannot be avoided, someone else should review the reconciliation.
When duties cannot be split, review takes their place. That is the principle behind every recommendation below.
Set approval thresholds that match how you actually spend
Approval thresholds decide what can be paid without a second look. Set them in writing and build them into your banking and bill-pay tools where possible. A typical structure for a small service business looks like this:
| Payment type | Who approves |
|---|---|
| Recurring bills from established vendors under a set amount | Office manager or bookkeeper, reviewed monthly by the owner |
| Any bill above the set amount | Owner, before payment |
| Any payment to a new vendor | Owner, before payment |
| Wire transfers | Owner, with a second approval in the bank if available |
| Changes to payroll, rates or bank details | Owner, in writing |
How to read this table: start at the top and stop at the first row your business does not follow today. The rows that need the owner before payment, new vendors, wires and bank-detail changes, are where small businesses lose the most money, so they come first.
The dollar amount depends on your business. The point is that someone besides the person who entered the payment sees anything material before money leaves the account.
Control who can add vendors and change bank details
This is one of the costliest gaps a small business can leave open. In a business email compromise scheme, a criminal impersonates a vendor, an executive or an employee by email and asks for a payment to go to a new bank account. The email often looks routine: an updated invoice, new remittance instructions, or a request from the “owner” to send a wire quickly. The FBI describes business email compromise as one of the most financially damaging online crimes and lists ways to protect a business on its business email compromise guidance page.
The controls that stop it are simple and work only if they have no exceptions:
- Limit who can add a vendor or edit vendor bank details in your accounting and bill-pay systems to one or two people.
- Verify every bank detail change by phone, using a number already on file or from an independent source, never a number in the email asking for the change.
- Treat urgency as a warning sign. A request to pay today, keep it confidential or skip the usual process should slow you down.
- Review new vendors and vendor changes monthly. Your accounting software can usually show recently added or edited vendors; the owner or reviewer should look at that list.
If a payment does go to a fraudster, contact your bank immediately and file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Speed matters for any chance of recovery.
Lock down bank and card access
Banking access is often set up once and never revisited. A few changes reduce risk considerably:
- Give each person their own login, never a shared one, and turn on multi-factor authentication for every user.
- Give staff the lowest level of access their job requires. Many people only need to view balances or upload bills, not send money.
- Ask your bank about dual approval for wires and ACH payments, and about positive pay or similar services that flag checks and payments you did not authorize.
- Issue individual company cards with spending limits instead of sharing one card number across the team.
- Remove access the day an employee or contractor leaves.
Owner review of reconciliations
A bank reconciliation proves that the books match the bank. It does not prove that every transaction was legitimate. That is why the owner, or an independent reviewer, should look at the reconciliation and the bank statement itself each month, not just a report saying the account is reconciled.
The review usually takes minutes, not hours. Look for payees you do not recognize, round-number transfers, payments to individuals, checks out of sequence, deposits that seem low for the month, and items that stay uncleared month after month. If you are not sure how to read the reports, our guide on understanding your financial statements is a good place to start.
Control payroll changes
Payroll fraud tends to be quiet: a pay rate edited upward, a former employee left on payroll, extra hours added, or a direct deposit account changed to a different bank. The controls:
- New hires, terminations, rate changes and bonuses require written owner approval before they are entered.
- Direct deposit changes are verified with the employee in person or by a known phone number, the same way vendor bank changes are.
- The owner reviews the payroll register each pay period, or at least monthly, and compares headcount and totals to expectations.
- The books are tied to the payroll provider’s reports every month as part of the close.
A monthly review routine for the owner
Controls work when someone checks them on a schedule. A practical monthly routine for an owner of a small business:
- Review each bank and card statement directly, and confirm the reconciliations are complete.
- Look over the list of new vendors and any vendor changes.
- Review the payroll register and any changes made during the month.
- Scan the AR aging for customer balances that look wrong or have been written off.
- Read the profit and loss against last month and last year, and ask about anything that moved more than you expected.
- Confirm that user access to bank, payroll and accounting systems is still current.
Done consistently, this routine usually takes about an hour a month and closes many of the gaps that lead to loss.
How an outsourced controller provides the independent review
Many owners know they should be reviewing these things and simply do not have the time, or the accounting background to know what looks wrong. That is the gap an outsourced controller fills. A controller who is not part of the day-to-day payment process can reconcile the accounts, review vendor and payroll changes, question unusual transactions, and report findings to the owner every month. Because the reviewer sits outside the office, that review is independent of the people entering and paying the bills.
That structure is how we work at LUCI. Our team uses industry-standard cloud systems with multi-factor authentication, role-based access and encrypted file sharing, and every client’s financials go through senior-level review before they are delivered. You can read how this fits together on our outsourced controller services page. If you are weighing whether to build this in-house, our comparison of outsourced vs. in-house accounting for small businesses covers the tradeoffs.
Frequently asked questions
How can a small business separate duties with only one or two employees?
Split the most sensitive tasks between the employee and the owner: the employee enters bills and records deposits, while the owner approves payments, controls bank access and reviews the statements. Where duties cannot be split, add a review step. An outside controller or accountant can provide that review each month.
What is the best way to prevent vendor payment fraud?
Limit who can add vendors or change their bank details, and verify every bank detail change by calling the vendor at a number you already have on file, never one provided in the request. Require owner approval for payments to new vendors. Review a list of new and edited vendors every month.
What should I do if we paid a fraudulent invoice or wire?
Contact your bank right away and ask them to try to recall or freeze the payment, then file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Acting quickly gives you the best chance of recovering funds. Afterward, review how the request got through and tighten the control that failed.
How often should the owner review bank reconciliations?
Every month, as soon as the reconciliations are complete. The owner should look at the bank statement itself, not just a report confirming the account is reconciled. Unfamiliar payees, round-number transfers and long-outstanding items are the main things to look for.
Do small businesses need written internal control policies?
A short written policy is worth having, even if it fits on one page. It should state approval thresholds, who can add vendors and change bank details, how payroll changes are approved and who reviews reconciliations. Writing it down makes the rules easier to follow and harder to skip under pressure.
Can an outsourced controller replace an internal accounting team for controls?
For many small businesses, an outsourced controller provides the independent review that a larger in-house team would otherwise supply. The controller reconciles accounts, reviews changes and unusual activity, and reports to the owner monthly. The owner still approves payments and keeps control of bank access.
Find the gaps before someone else does
If you are not sure where your business is exposed, our free Financial Operations Assessment is a quick way to see where your processes stand. When you are ready to add an independent review layer to your books, schedule a consultation with our team.
