Here’s Why Your Online Business Needs Strong Internal Controls

Internal controls keep big business running, but these same controls are perfect for smaller teams. Too many owners assume that internal controls are only for large corporations, leaving themselves open to fraud and error.

Add remote work into the mix or a hybrid option, as 88% of companies offer, and the risks increase even further. Virtual businesses and remote work come with the inherent concerns of:

• Lack of Physical Oversight: Remote workers have no physical oversight. No one is looking over their shoulders to make sure that they’re following internal controls.
• Reliance on Email/Chat: Phishing and spoofing scams are also easier when workers are remote because you have less control over their devices and Internet usage.
• High Trust, Low Verification: Often, companies put too high of trust in one employee, allowing them to have higher access levels with lower verification. If this person’s account is compromised, they have access to a wide range of files and systems.

As a virtual bookkeeper, I know the importance of system checks and balances. Internal controls encourage operational efficiency, maintain financial data reliability, and protect your company’s assets.

If you’ve been putting off your business’s internal controls, it’s a lot easier to implement them when you have a blueprint to follow. I’ll help you get started below:

How to Achieve Segregation of Duties (SoD) with a Small Virtual Team

SoD is one of the first steps that I recommend you take. If a single person in the business has control of a transaction’s entire lifecycle, it opens you up to fraud.

Instead of having a single entity create a bill, approve and execute it, you can do something like this for your bill payment cycle:

• Preparation: Designate a bookkeeper or junior staff member to prep the bill for your QuickBooks Online.
• Approval: Put yourself or a manager in charge of digitally reviewing and approving payments in a separate system, such as Bill.com.
• Execution: Create automated systems to execute the transfer once you approve it.

Your goal when focusing on SoD is to ensure the bill preparer never has access to banking credentials. Systems and controls like these can be used across your business, not just in the example above.

For example, in your payroll cycle, add SoD so that the person who approves time off or hours worked is never the person who finalizes payroll.

Once you have a strict separation of duties in place, you can move on to access controls.

Implementing Digital Security and Access Controls

Phishing is responsible for 15% of all data breaches, and when you add in weak passwords, virtual companies are at serious risk of their data falling into the wrong hands.

Training employees on industry best practices is a good start, but you want to prevent all unauthorized access to employee and company accounts.

You can start integrating these controls with the help of: 

• Role-Based Access: What is the role of the employee? If it’s payroll, this individual doesn’t need access to your marketing team’s files. Marketing teams don’t need access to payroll records, etc.
• Two-Factor Authentication (2FA): One of the safest measures you can take is requiring mandatory 2FA on your accounting, banking and payment apps.
• Secure Password Management: Shared passwords are a security risk. Use a platform like 1Password or Bit Warden to encrypt and generate passwords rather than keep them in spreadsheets.
• Offboarding Protocol: Once someone is off the team, the internal controls that you have must revoke their access to all systems immediately. 

Employees and contractors must follow these internal controls to safeguard your business. We follow these same practices with the accounting services we offer because it’s better to be safe today than sorry tomorrow.

Placing Transactional Controls and Documentation

Internal controls must track every dollar in and out of the business. Transactional controls and documentations are possible with the help of apps, such as Expensify, that allow you to capture receipts instantly.

Your goal? Never reimburse expenses without an attached receipt.

Additional controls include:

• Automated Reconciliation: Daily bank feeds and regular reconciliation provide controls to catch unauthorized transactions quickly.
• Expense Policy Enforcement: Put spending limits on expenses. For example, owners must pre-approve all expenses over $500.

Small controls like these keep your business safe from fraud and bad actors.

Controls Enable Growth, Not Hinder It

Strong internal controls protect your profits, free up owner time and ensure that you’re following strict compliance standards. Your goal is not to just tell your team what to do. Instead, put tools and controls in place and monitoring systems.

Spend time creating workflows and systems that ensure everyone follows the internal controls you put in place.

Add in digital segregation of duties, and you lower your risk of fraud or data breaches instantly. If you’re running payroll or paying bills without SoD, let’s talk.

Schedule a consultation to discuss how to put these systems in place for your payroll and billing.