Internal controls design

Internal Controls Design

Design, document, and maintain a startup-appropriate internal control environment. Implement segregation of duties, approval matrices, process documentation, audit trails, and monitoring. Goal: the right controls at the right time — enough to prevent fraud and errors without slowing the business down.

Purpose

Startups face a control paradox: at 10 people, you can't segregate duties because there aren't enough people — but at 10 people, a single fraud or error can destroy the company. This skill solves that problem by providing a stage-appropriate control framework. Instead of copying SOX requirements designed for billion-dollar companies, it gives startups the controls they actually need: cash protection first, then approval matrices, then process documentation, evolving as the company grows from seed to series B and beyond.

When to Use

• "Design our internal controls"
• "Who should approve what?"
• "Do we have segregation of duties?"
• "Document this financial process"
• "Control environment review"
• "Are we SOX-ready?" (if preparing for IPO)

Inputs Required

• Current control environment assessment
• Organizational chart with roles and responsibilities
• Access list for all financial systems (accounting, banking, payroll)
• Current approval processes and thresholds
• Existing process documentation (if any)
• Prior audit findings or control gaps (if applicable)

Quick Reference

Stage	Control Level	Focus Area
Pre-seed / Seed (< 15 people)	Minimal viable	Fraud prevention, cash controls, CEO reviews all payments > $500
Series A (15-50 people)	Lightweight	Approval matrix, basic segregation, documented processes
Series B (50-150 people)	Structured	Full segregation, audit trails, quarterly testing
Pre-IPO / Series C+ (150+ people)	SOX-lite / SOX-ready	Fully documented, tested, attested

Control Area	Highest Risk	Bare Minimum
Cash	Fraud (#1 startup risk)	Separate initiator, approver, reconciler
AP	Duplicate payments, fictitious vendors	Approval matrix, W-9 for new vendors
Payroll	Ghost employees, wrong amounts	CEO review of payroll register
Access	Unauthorized transactions	2FA on all financial systems, termination checklist

Procedure

1. Assess Current State

Evaluate what controls exist and what's missing across:

• Cash disbursements
• Approval authority
• Segregation of duties
• Process documentation
• IT access controls
• Monitoring and testing

2. Prioritize by Risk

Start with the highest-risk areas:

1. Cash controls — 90% of startup fraud is cash-related
2. Approval matrix — who can approve what
3. Segregation of duties — incompatible duties separated or compensated
4. Process documentation — key financial cycles
5. IT access controls — who has access to what

3. Document the Control Framework

Cash Controls (Highest Priority)

Cash is the #1 fraud risk for startups.

CONTROL: Segregation of Duties - Cash Disbursements

  Person A: Initiates payment (prepares the payment run)
  Person B: Approves payment (reviews and authorizes)
  Person C: Reconciles bank account (independent verification)

  Risk if not segregated: One person could create a fake vendor,
  approve the payment, and reconcile it away.

For very small teams (3-5 people): the CEO reviews every payment over $500. A monthly bank rec by someone not involved in payments. This is the bare minimum.

Approval Matrix

Define who can approve what:

Transaction Type	Up to $1,000	$1,000-$5,000	$5,000-$25,000	$25,000+
Vendor Payments	Dept Head	Dept Head + CEO	CEO + CFO	CEO + CFO + Board (if > $50k)
Expense Reports	Manager	Manager + CEO	CEO	CEO + CFO
New Hires (salary)	Dept Head + CEO	CEO + CFO	CEO + CFO + Board	CEO + CFO + Board
Contractors	Dept Head	Dept Head + CEO	CEO + CFO	CEO + CFO
Software Subscriptions	Dept Head	Dept Head + CEO	CEO + CFO	CEO + CFO
Customer Contracts / Pricing	Sales Manager + CEO	CEO + CFO	CEO + CFO + Board	Board
Equity Grants	N/A	CEO	CEO + Board	Board

Segregation of Duties Matrix

For each key process, identify incompatible duties:

Process	Duty 1 (Initiate)	Duty 2 (Approve)	Duty 3 (Record)	Duty 4 (Reconcile)
Vendor Payments	AP Clerk / Office Manager	CEO / CFO	Accountant	Accountant (different person) or CEO
Payroll	HR / Office Manager	CEO	Accountant / Payroll Provider	Accountant or CEO
Customer Invoicing	Sales / Account Manager	Sales Manager	Accountant	Accountant or CEO
Expense Reimbursement	Employee	Manager + CEO (if > $500)	Accountant	CEO (spot check)
Journal Entries	Accountant	CEO / CFO	Accountant	CEO / CFO (monthly review)
Bank Reconciliation	Accountant	—	—	CEO / CFO (review completed rec)

For very small teams, document compensating controls where true segregation is impossible:

"Jane both initiates and records AP payments. Compensating control: CEO reviews ALL payments over $500 before they go out, and reviews the full AP register monthly."

Process Documentation

For each key financial process, document:

PROCESS: Accounts Payable - Vendor Payments

Purpose: Ensure all vendor payments are valid, approved, and accurately recorded.

Frequency: Weekly payment run (Thursdays).

Steps:
  1. AP receives vendor invoice (email or portal).
  2. AP verifies: vendor is in master, amount matches PO/estimate, not a duplicate.
  3. AP enters invoice into [system] with coding (account, department).
  4. System routes for approval based on the amount matrix.
  5. Approved invoices batched for weekly payment run.
  6. Payment run reviewed by CEO (all payments > $500).
  7. After approval, payments executed (ACH, check, wire).
  8. Payments recorded in GL, AP subledger updated.
  9. Monthly: AP subledger reconciled to GL.
  10. Monthly: Top 10 vendor statements reconciled to AP subledger.

Systems: QuickBooks / Xero / Netsuite, Bill.com / Brex / Ramp

Controls:
  - Invoice approval required before payment (preventive).
  - CEO reviews all payments > $500 (detective).
  - Monthly AP reconciliation (detective).
  - Vendor master changes require CEO approval (preventive).
  - New vendors require W-9 before first payment (preventive).

Evidence retained:
  - Approved invoices (digital or physical).
  - Payment run approval (email or system log).
  - Reconciliation reports.
  - W-9 forms.

Risks if control fails:
  - Duplicate payment.
  - Payment to wrong vendor.
  - Payment for goods/services not received.
  - Fraud (payment to fictitious vendor).

Information Technology Controls

Minimal IT controls for startups:

• Access controls: who has admin access to accounting systems, bank portals, and payroll?
• Password policy: no shared passwords. 2FA required on all financial systems and bank accounts.
• Audit trails: all financial systems must have audit trails enabled (who did what, when).
• Backup: financial data backed up daily. Test the restore.
• Termination checklist: revoke access to all financial systems within 24 hours of departure.

Monitoring & Testing

Quarterly, test that controls are actually working:

Control	Test Procedure	Frequency
Payment approval	Sample 10 payments, verify approval evidence	Quarterly
Bank reconciliation	Review last 3 reconciliations, verify they tie	Monthly
Vendor master changes	Review all vendor additions, verify W-9 on file	Quarterly
Journal entry review	Review all manual JE's > $5,000 for support	Quarterly
Access review	Review who has access to each system, verify still appropriate	Quarterly
Payroll verification	Sample 3 payroll runs, verify against employment agreements	Semi-annually

Output Format

• Control environment assessment (what's in place, what's missing)
• Approval matrix (ready for implementation)
• Segregation of duties matrix
• Process documentation for key cycles (AP, AR, Payroll, Close)
• Quarterly control testing schedule
• Remediation plan for gaps

Done Criteria

The skill is complete when:

1. Current state is assessed and gaps are identified, prioritized by risk.
2. Cash controls are designed with segregation of duties (initiate, approve, reconcile).
3. Approval matrix is defined by transaction type and dollar threshold.
4. Segregation of duties matrix is documented for all key processes with compensating controls identified where segregation isn't possible.
5. Process documentation is created for at least the top 3 highest-risk cycles (cash/AP, payroll, revenue/AR).
6. IT access controls are defined (2FA, access reviews, termination checklist).
7. A quarterly testing schedule is established.

Pitfalls

• Building SOX-level controls for a seed-stage company — 20-person startups don't need 200-page control manuals. Proportionality is the key design principle. Build what you need, not what the Fortune 500 has.
• Designing controls that nobody follows — a perfect control framework that sits in a Google Drive folder untouched is worse than no controls. Controls must be practical, trained, and enforced.
• Creating segregation of duties that doesn't exist — in a 10-person company, you can't fully segregate. That's okay. Document compensating controls and test them. Don't pretend segregation exists when it doesn't.
• Implementing controls without training — the AP clerk needs to know WHY the approval matrix exists. Controls work when people understand them, not when they're policy documents.
• Letting controls degrade over time — the approval matrix that worked at 30 people is wrong at 60 people. Controls must evolve with the company size and complexity.

Heuristics

• Cash controls first: 90% of startup fraud is cash-related. Control the bank accounts, control the risk.
• CEO review is the most powerful startup control: in a 10-person company, the CEO reviewing every payment > $500 is more effective than any formal system.
• Controls should be proportional: don't build SOX controls for a seed-stage startup. But don't have NO controls either.
• Document when you can't segregate: compensating controls are valid. Document them and test them.
• Audit trail > manual approval: a system that logs who did what is often better than an email approval chain.

Edge Cases

• Remote / distributed teams: physical controls (locked check stock, secure filing) don't apply. Digital controls (2FA, access logs, audit trails) matter more.
• Crypto / digital asset companies: wholly different control needs. Multi-sig wallets, hardware keys, on-chain verification.
• International subsidiaries: local statutory audit requirements may impose additional control requirements.
• Whistleblower / reporting mechanism: at Series A+, have a way for employees to report concerns confidentially. It's a requirement for a strong control environment.

Verification

Can you answer "Who can approve a $10,000 vendor payment?" and "Is there a compensating control for the fact that Jane both initiates and records AP?" and "When was the last time we tested whether our controls are actually working?" If not, the control environment isn't fully understood or documented.

Example

User: "Design our internal controls — we're a 25-person Series A SaaS company." Expected behavior: You assess the current state, prioritize cash controls first, design an approval matrix (CEO approves all payments > $1,000), create a segregation of duties matrix documenting which duties are separated and which have compensating controls, document the AP process with a 10-step procedure, set up IT access controls (2FA on all financial systems), and establish a quarterly testing schedule.

User: "We had a near-miss with a fraudulent vendor payment. Fix our AP controls." Expected behavior: You review the current AP process and identify the control gaps (no W-9 requirement for new vendors, no dual approval on new vendor additions, no monthly vendor statement reconciliation). You implement: new vendor approval workflow requiring CEO sign-off, W-9 collection before first payment, monthly statement reconciliation, and a vendor master change log reviewed quarterly.

Linked Skills

• Close process design → monthly-close-process
• Audit readiness → audit-preparation
• AP controls → accounts-payable-management
• AR controls → accounts-receivable-management
• Payroll controls → payroll-processing