Internal Controls for Small Businesses and Nonprofits: A Practical Checklist

Controls are not paperwork for its own sake. Each one answers a specific question: who can spend money, who checks that it was spent correctly, and how would anyone know if it was not. This guide explains the framework the profession uses, then gives you a checklist you can work through for a team of one to ten people, with the extra items a nonprofit needs.

What are internal controls in accounting?

The most widely used definition comes from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Its Internal Control: Integrated Framework describes internal control as a process, carried out by an organization's board, management and staff, designed to provide reasonable assurance about three objectives: effective and efficient operations, reliable reporting, and compliance with laws and regulations.

Two words in that definition matter for small organizations.

• Process. A control is something people do, repeatedly, not a policy document in a shared drive. A written approval limit that nobody follows is not a control.
• Reasonable. Controls reduce risk. They do not eliminate it. A small team cannot afford the controls of a public company, and does not need them. The goal is controls proportionate to what could go wrong.

Government and many grant-funded organizations use the U.S. Government Accountability Office's Standards for Internal Control in the Federal Government, known as the Green Book, which is built on the same five components as COSO. If your organization receives federal awards, the federal Uniform Guidance at 2 CFR 200.303 points to the Green Book or the COSO framework as the reference for the internal control it expects.

What are the five components of internal control?

COSO organizes internal control into five components. The framework was written for organizations of every size; what changes in a small one is how simply each component is met.

Component	What it means	What it looks like in a 10-person organization
Control environment	The tone set by owners, leaders and the board about integrity and accountability	The owner or board reviews the monthly financials and asks questions. Expense rules apply to leaders too.
Risk assessment	Identifying what could go wrong and how much it would matter	A once-a-year conversation: where could money leave the business without anyone noticing?
Control activities	The specific checks: approvals, reconciliations, separation of duties, access limits	Payments over a set amount need a second approver. Bank accounts are reconciled every month.
Information and communication	Getting reliable information to the people who need it, on time	Monthly statements arrive by an agreed day, with a short note on what moved.
Monitoring activities	Checking that controls are actually operating, and fixing them when they are not	Each quarter someone confirms the reconciliations were signed off and the approval limits were followed.

Most small organizations have some control activities and almost no monitoring. The approval rule exists; nobody checks whether it was followed. That gap is where problems persist for months.

What internal controls does a small business need? A practical checklist

Work through this list area by area. Each item is a control you can put in place without new software or new staff. Mark each one as in place, partly in place, or missing, and fix the missing ones in the order of how much money flows through the area.

Cash and bank accounts

• Every bank, credit card and payment-processor account is reconciled to the ledger every month, within a set number of days after month-end.
• The reconciliation is reviewed and signed off by someone who did not prepare it.
• Bank statements go directly to the reviewer as well as the preparer, so they cannot be altered in between.
• The list of people with online banking access is reviewed at least twice a year, and former staff are removed the day they leave.
• Bank fraud services are switched on where available, such as positive pay for checks and blocks or filters on unexpected ACH debits.

Payments and accounts payable

• Written approval limits: who can approve a bill, up to what amount, and when a second approver is needed.
• The person who enters bills is not the only person who can release payments.
• Any change to a vendor's bank details is verified by calling the vendor on a phone number already on file, never one supplied in the change request.
• New vendors are set up by one person and reviewed by another.
• Payments are matched to an invoice and, for goods, to proof they were received.

Revenue and receivables

• Invoices are issued from a system, numbered in sequence, and gaps in the sequence are investigated.
• Credit notes and write-offs need approval from someone other than the person who issued the invoice.
• The receivables aging is reviewed every month, and anything over 60 days has a named owner and a next step.
• Customer payments go straight into the business bank account, ideally by electronic payment or lockbox rather than through staff hands.

Payroll

• New hires, pay rate changes and terminations are approved in writing by someone other than the person who runs payroll.
• Each payroll register is reviewed before it is released, with attention to new names and changed amounts.
• Payroll tax deposits are made on the schedule the IRS assigns, and someone checks they cleared.

Credit cards and expenses

• Card limits are set per person, and merchant categories are restricted where the card issuer allows it.
• Every charge has a receipt and a business purpose recorded within a set period.
• The cardholder's manager reviews the statement. Leaders' cards are reviewed by the owner or the board.

Systems and records

• Each person has their own login to the accounting system. Shared logins make every other control unprovable.
• The accounting period is locked after the close, so prior months cannot be changed without someone noticing.
• Records and supporting documents are kept for as long as the IRS requires. Publication 583 explains what to keep and why.

Close and reporting

• The books are closed every month on a calendar, using a month-end close checklist.
• Manual journal entries above a threshold are reviewed by someone other than the person who posted them.
• The owner or board receives the statements by an agreed day and asks at least one question about what changed.

If you have only one person in finance, several of these items look impossible. They are not, but they need a different design. The companion guide on segregation of duties for small teams sets out three controls that work with a finance team of one.

What internal controls should a small nonprofit have?

Everything in the checklist above applies. A nonprofit adds three risks that a business does not have: money that can only be spent on specific purposes, funders who audit how it was spent, and a board that is legally responsible for oversight but often meets only a few times a year.

• Restricted funds are tracked separately. Each restricted gift or grant has its own class, fund or project code, and spending against it is reviewed against the terms of the award.
• Grant spending is supported. Costs charged to a grant have documentation showing they were allowable, and allocations of shared costs follow a written method.
• Two people handle cash donations. Cash and checks received at events or by mail are counted by two people, recorded, and deposited promptly.
• The board reviews the financials, not just the budget. A finance committee or treasurer reviews the monthly or quarterly statements and the bank reconciliations, and minutes record that it happened.
• Governance policies exist and are followed. IRS Form 990 asks whether the organization has policies such as a conflict of interest policy, a whistleblower policy and a document retention policy. Having them on paper is the start; applying them is the control.

The board's role is the one most often missing. Dr. Michelle Gordon's question for leaders, who verifies the work, and what internal controls are in place?, is a good test for a nonprofit board to put to its own finance function.

What is the difference between preventive and detective controls?

Preventive controls stop an error or a misuse before it happens. Detective controls find it afterwards. A small organization needs both, because preventive controls are the ones that break down first when someone is on holiday or the team is stretched.

Risk	Preventive control	Detective control
A fake vendor is paid	New vendors set up by one person, approved by another	Monthly review of the new-vendor list and payments to first-time payees
Vendor bank details are changed by a fraudster	Call-back verification on a known number before any change	Monthly report of all vendor bank detail changes, reviewed by the owner
Payroll includes someone who has left	Terminations approved and processed the same day	Payroll register reviewed against the staff list each run
Cash is recorded incorrectly	Deposits recorded from bank data, not manual entry	Monthly bank reconciliation, reviewed independently
Prior periods are changed after reporting	Closed periods locked in the accounting system	Audit log of changes to closed periods reviewed quarterly

Where you cannot have the preventive control, usually because there are not enough people, a detective control reviewed by someone independent is called a compensating control. It is how small teams meet the intent of the framework without the headcount.

How do you test whether a control is working?

A control is working if you can produce evidence that it happened. Once a quarter, pick three items for each key control and look for the proof: the signed reconciliation, the approval email, the call-back note. If the evidence is missing for one of the three, the control is not operating reliably, however good the written policy is. Studies of occupational fraud, such as the Association of Certified Fraud Examiners' Report to the Nations, repeatedly list a lack of internal controls and the override of existing ones among the weaknesses that allowed fraud to happen. Testing is how you find out which of the two you have.

Common mistakes

• Copying a large-company control list. Fifty controls that nobody performs are worse than ten that run every month, because the list creates false comfort.
• Trusting a person instead of a process. Most misuse in small organizations is done by someone trusted. A control is not an accusation; it protects the person doing the work as much as the organization.
• Reconciling without reviewing. A reconciliation that only the preparer sees catches errors but not misuse.
• Never revisiting the design. Controls set up for a team of two stop fitting a team of eight. Review the list once a year.

How DataWyse helps

The detective controls in this guide depend on someone regularly looking at the data: new vendors, payments to first-time payees, spend against budget, receivables drifting past terms. In a small team that review is the first thing dropped in a busy month. DataWyse connects read-only to the accounting system and checks receivables, payables, margin and spend against your targets every day, so a change shows up when it happens rather than at the next close. Every figure it reports comes with the formula and the source records behind it, so the reviewer can trace an exception back to the transaction.

It is a monitoring aid, not a control framework. Approval limits, separated duties and an independent reviewer are still decisions your organization has to make and enforce. For matching two lists yourself, such as bank against ledger, the free two-list reconciler shows what is missing from each side.