How do you set up internal controls for the first time?

Start with the processes, not the controls. Identify the five to eight business processes that carry the most financial risk, document how each one actually runs today, and give each an owner. Only then design controls over them. Controls designed before the process is understood tend to protect the wrong thing.

Internal Controls Setup — Where to Start

Checklist section

Foundation

0 done0%

Identify the 5-8 core business processes that carry the most financial risk

Examples include purchasing, payroll, inventory, revenue recognition, expense management, and customer billing.

Map how each high-risk process currently works

Document who is responsible and what they do at a high level for each process.

Assign an owner to each high-risk process that does not have a clear one

Make sure each critical process has an accountable owner before formalising controls.

Map existing informal controls for each high-risk process

Capture what the business already does today, even if it has never been written down as a formal control.

Write a simple process narrative or SOP for each high-risk area

Use plain language to describe how the process works from start to finish.

Create a one-page step list for any process involving more than three approval steps

Include the mapped informal controls directly within that process flow.

Checklist section

Roles, Responsibilities and Access

0 done0%

Define which roles are authorised to approve payments, raise purchase orders, process payroll, and adjust inventory

Create a clear permission model for the most sensitive finance activities.

Remove access to financial systems and physical assets from anyone whose role does not require it

Limit both system access and real-world access to what is actually needed.

Ensure no single employee has end-to-end control over a high-value transaction

Separate responsibilities from request through payment or delivery wherever practical.

Define a clear escalation path

Document who covers each critical role when the primary owner is absent or unavailable.

Checklist section

Transaction Controls

0 done0%

For each high-risk process, design at least one preventive control and one detective control

A preventive control stops the problem; a detective control catches it after the fact.

Set documented approval thresholds for payments, purchases, and expenses

Define who can approve what and up to which amount.

Require dual authorisation for payments above a defined threshold and for all payments to new payees

Use a second level of approval where payout risk is higher.

Require that adjustments above a defined threshold are reviewed and approved before posting

Make sure material changes are checked before they hit the records.

Checklist section

Close and Reconciliation

0 done0%

Define a standard month-end close checklist and calendar

Set out what gets done, by whom, and by what date each month.

Require monthly reconciliation of all bank accounts by someone who does not also process transactions

Separate transaction processing from reconciliation work wherever possible.

Set up formal balance sheet reconciliation of key accounts

Include AP, AR, FA, and other core balances with clear timelines and named preparers and reviewers.

Set up a standard review of accruals and prepayments before each month-end

Treat this as a recurring step in the close process rather than an ad hoc review.

Checklist section

Documentation and Monitoring

0 done0%

Write up each control in a short description

Document what it does, who performs it, how often, and what evidence it leaves behind.

Compile all control descriptions into a single control register

Use one source of truth that lists every control, its owner, and its frequency.

Set up a simple exception log

Record any instance where a control was not followed, including the reason and how it was resolved.

Organise control approval records in a format that can easily be shared with auditors

Keep the evidence orderly enough that it can be reviewed externally without reconstruction work.

How do you set up internal controls for the first time?

Foundation

Identify the 5-8 core business processes that carry the most financial risk

Map how each high-risk process currently works

Assign an owner to each high-risk process that does not have a clear one

Map existing informal controls for each high-risk process

Write a simple process narrative or SOP for each high-risk area

Create a one-page step list for any process involving more than three approval steps

Roles, Responsibilities and Access

Define which roles are authorised to approve payments, raise purchase orders, process payroll, and adjust inventory

Remove access to financial systems and physical assets from anyone whose role does not require it

Ensure no single employee has end-to-end control over a high-value transaction

Define a clear escalation path

Transaction Controls

For each high-risk process, design at least one preventive control and one detective control

Set documented approval thresholds for payments, purchases, and expenses

Require dual authorisation for payments above a defined threshold and for all payments to new payees

Require that adjustments above a defined threshold are reviewed and approved before posting

Close and Reconciliation

Define a standard month-end close checklist and calendar

Require monthly reconciliation of all bank accounts by someone who does not also process transactions

Set up formal balance sheet reconciliation of key accounts

Set up a standard review of accruals and prepayments before each month-end

Documentation and Monitoring

Write up each control in a short description

Compile all control descriptions into a single control register

Set up a simple exception log

Organise control approval records in a format that can easily be shared with auditors

Stay ready for your next transition.