What are internal controls?
- By Book Keeping Pros
- Sources checked 16 Oct 2026
Definition
Internal controls are the checks and procedures a business builds into its finances to protect its money and keep its records accurate. Examples include limits on who can approve a payment or use the bank accounts, regular reconciliations and comparing actual results with the budget, so that mistakes and fraud are more likely to be picked up.
Internal controls build a check into the normal routine instead of relying on someone noticing a problem by chance. Some controls aim to stop a problem before it happens, such as limiting who can approve spending or use internet banking. Others aim to find it afterwards, such as reconciling the bank and card accounts, matching supplier statements to the bills recorded and comparing actual results with the budget.
Controls also protect the quality of the bookkeeping. When each payment needs a source document and a sign-off, and the accounts are reconciled regularly, errors are more likely to be found while they are still easy to trace. The checks should suit the size of the business: a sole trader needs far fewer than a business with several staff handling money, and splitting tasks between people, known as segregation of duties, depends on having others to share the work.
Controls help for as long as people keep following them. Writing them down, checking now and then that they are still in use, and updating them when staff, activities or banking arrangements change keeps them part of the routine.
In Australia
The Australian Charities and Not-for-profits Commission (ACNC) writes its guidance on fraud and financial controls for registered charities, so it is not a set of rules for businesses in general. Its guide to protecting a charity from fraud says a charity's internal controls or its audit process can pick up most fraud, and counts internal financial controls among the most effective ways of uncovering it. The warning signs it asks charities to watch for include reconciliations that are not done regularly or checked for discrepancies, duplicated payments and unexplained variances from budgets or forecasts.
The ACNC's factsheet on strong financial controls suggests sharing the responsibility for authorising and completing transactions that bring money in or send it out, rather than leaving it with one person, and using financial delegations so that only certain people can approve spending above a set value. It also suggests keeping online banking passwords secure, knowing who can access the bank accounts, tracking results against the budget during the year, and giving the board or committee regular financial information, such as actual figures compared with the budget, so issues are spotted early. The fraud guide also lists using financial controls and procedures that suit the charity's size and nature as part of the role of its Responsible People, meaning its board or committee members or trustees.
Worked example
| Control | Type | What it helps catch |
|---|---|---|
| A second sign-off for payments above a set amount | Prevents | Payments for false or duplicated bills |
| Limited internet banking access, with passwords changed when someone leaves | Prevents | Payments made without authority |
| Regular bank and card reconciliations | Detects | Missing, duplicated or wrongly recorded transactions |
| Matching supplier statements to the bills recorded | Detects | Bills recorded twice, or not at all |
| Comparing actual results with the budget | Detects | Spending or income that has moved unexpectedly |
Illustrative example only: these rows show the method and are not sourced data.
Common mistakes
- Setting up payment sign-offs and then letting them lapse when the business gets busy.
- Leaving bank and card reconciliations for months, so a problem surfaces long after it happened.
- Keeping the same internet banking password after someone with access has left.
- Treating controls as something only large organisations need.
Related terms
Related service
Small business bookkeeping
Your books kept current, every month.
Sources
- Protect your charity from fraud
Australian Charities and Not-for-profits Commission. Current at 16 October 2026, released 10 July 2023. Checked 16 October 2026.
© Commonwealth of Australia 2018 Licence: CC BY 4.0.
- Establishing strong financial controls at your charity
Australian Charities and Not-for-profits Commission. Current at 16 October 2026, released 10 July 2023. Checked 16 October 2026.
© Commonwealth of Australia 2018 Licence: CC BY 4.0.