8 Warning Signs of Weak Internal Controls

What internal controls actually are, stated plainly

Internal controls are the specific procedures, segregation of duties, approval limits, reconciliations, physical safeguards, that ensure transactions are authorised correctly, recorded accurately, and that assets are protected, independent of any one individual's personal vigilance or integrity. They exist not because employees are assumed to be dishonest, but because even entirely honest people make errors, and because a system with no independent checks is also a system with no way to catch an error, or a deliberate manipulation, before it compounds.

Eight warning signs worth checking against your own business today

1. One person controls a transaction from start to finish, with no independent check. If the same person can raise a purchase order, approve it, receive the goods, and process the payment, with no separate party involved at any stage, there is no control in that process at all, only trust.

2. Bank reconciliations are irregular or significantly delayed. A business that is not reconciling its bank accounts against its books promptly and regularly has no reliable, timely way of knowing whether recorded cash matches actual cash, which is one of the most basic and most important controls in any business.

3. Petty cash or expense claims are approved without supporting documentation. A pattern of expenses reimbursed or petty cash disbursed without receipts, or with receipts that are not actually checked against the claim, is a specific and common gap that compounds quietly over time.

4. Inventory counts rarely happen, or never reconcile cleanly against records. A business that cannot explain a gap between recorded inventory and a physical count has lost visibility over a major asset, and cannot distinguish between ordinary shrinkage, recording errors, and something more serious.

5. Vendor and payroll master data can be changed without a second approval. The ability for one person to add a new vendor, change vendor bank details, or add an employee to payroll, without any independent review, is one of the more common vectors through which both errors and deliberate manipulation occur in growing businesses.

6. Financial reports are produced but rarely reviewed critically by anyone other than the preparer. A monthly management report that management receives but does not actually interrogate, checking a variance against an expectation, asking why a number moved, provides far less protection than it appears to, since an unreviewed control is barely a control at all.

7. The business has grown headcount or locations faster than its documented processes have kept pace. New employees, particularly at a new location, effectively invent their own version of "how things are done" when no documented procedure exists, and that improvisation is where control gaps most often originate.

8. There has never been an internal control review, ever, regardless of how much the business has grown. A business that has scaled significantly since it was founded, but has never once stepped back to formally assess whether its controls scaled with it, is very likely operating with meaningful gaps it simply has not yet had a reason to discover.

Why this matters more as a business grows, not less

Every one of these gaps exists in small businesses too, but the owner's direct oversight substantially compensates for them at small scale, since the owner personally sees most transactions as they happen. That compensating oversight breaks down mathematically as the business adds people, locations, and transaction volume, precisely the growth phase covered in how to know whether your business is ready to scale. A control gap that was invisible and low-risk at a smaller scale becomes a real, material exposure at a larger one, without the underlying process ever having changed at all.

What good practice looks like, proportionate to size

Internal controls do not need to be elaborate to be effective; they need to close the specific gaps above in a way proportionate to the business's actual size and risk. At minimum: separate the person who approves a transaction from the person who executes it wherever practical, reconcile bank accounts and inventory on a fixed schedule, require a second approval for any change to vendor or payroll master data, and ensure someone genuinely reviews the monthly management report, not just receives it.

How this connects to due diligence and valuation

Weak internal controls are precisely the kind of gap a buyer's or investor's due diligence, covered in buying a business in Nepal? Start with financial due diligence, is designed to surface, and discovering them late in a transaction process damages both the timeline and the trust underpinning the negotiation. Addressing control gaps well before any transaction is contemplated is far cheaper, in both cost and reputational terms, than having them discovered by someone else's diligence team.

How Veritas helps close these gaps

We run a structured internal control review against the size and complexity of your specific business, identify which of the gaps above actually apply, and help implement proportionate, practical controls that do not slow the business down unnecessarily. See our internal audit service for how this review is scoped and delivered.

Frequently asked