Control procedures in accounting are the specific policies, steps, and activities a business implements to safeguard assets, ensure financial records are accurate, and prevent fraud or errors. These procedures are the operational backbone of internal control, translating broad principles into daily actions like requiring two signatures on large checks, reconciling bank statements monthly, or locking the supply cabinet.
Background: Why Control Procedures Matter
Accounting control procedures exist because no single person should have unchecked authority over financial transactions. The core idea is separation of duties: dividing responsibilities so one person’s work automatically verifies another’s. This reduces the risk of mistakes going unnoticed and makes fraud much harder to commit without collusion.
These procedures are not optional extras. The Sarbanes-Oxley Act of 2002, passed after major corporate scandals, made public companies legally responsible for maintaining adequate internal controls over financial reporting. Even private businesses and nonprofits adopt control procedures because they protect cash flow, support accurate tax filings, and help secure loans—lenders want to know your financial statements are trustworthy.
Control procedures are part of the broader internal control framework known as COSO (Committee of Sponsoring Organizations of the Treadway Commission). That framework identifies five components: control environment, risk assessment, control activities (the procedures themselves), information and communication, and monitoring. The procedures are the “control activities” piece—the tangible actions taken daily.
Core Control Procedures You Should Know
While every organization tailors its controls to its size and industry, several procedures are nearly universal. These are the building blocks of a solid accounting system:
- Authorization and approval: Transactions require a manager’s approval before they happen. For example, a purchase order must be signed by a department head before the purchasing team orders goods.
- Segregation of duties: No one person should handle all parts of a transaction. The employee who approves an invoice should not also write the check or reconcile the bank statement.
- Physical controls: Locks, safes, password-protected software, and restricted server rooms protect assets and records. For instance, blank checks are kept in a locked drawer, and only the finance manager has the key.
- Documentation and recordkeeping: Every transaction needs a paper or digital trail: receipts, invoices, contracts, and logs. Proper documentation makes it possible to trace any entry back to its source.
- Independent verification: Someone who did not prepare a report reviews it. A senior accountant reviews the monthly bank reconciliation prepared by the junior staff member.
- Reconciliation: Comparing internal records to external records, like bank statements or supplier statements, to catch discrepancies. This is often done monthly.
These procedures work together. For example, a small retail store might require that the cashier counts the register drawer at the start of a shift, the manager verifies the count, and the store owner reviews the daily sales report against bank deposits. Each step is a separate control.
How to Choose the Right Procedures for Your Organization
There is no one-size-fits-all set of control procedures. A multinational corporation needs far more layers than a local bakery. When designing controls, consider these factors:
- Company size and number of employees: With only five staff, you cannot fully separate duties. Instead, you might use owner oversight—the owner reviews all bank statements and signs all checks.
- Industry regulations: Healthcare, government contracting, and financial services have specific compliance requirements that dictate certain controls.
- Technology used: Cloud-based accounting software has built-in controls like user permissions and audit trails. You may need fewer manual checks if your system automatically logs who entered each transaction.
- Risk tolerance: A startup burning through cash might focus on expense approvals, while a mature company might prioritize inventory controls.
Start with a risk assessment: identify where your organization is most vulnerable—cash handling, vendor payments, payroll, or inventory. Then design procedures that address those specific risks. For a small business, the most effective control is often owner involvement: the owner personally reviews bank statements, signs checks, and approves major purchases.
Common Problems and How to Avoid Them
Even well-designed control procedures fail if they are not implemented properly. Here are the most frequent issues:
- “Rubber stamp” approvals: Managers approve every request without reviewing details. This happens when they are overloaded or trust subordinates too much. The fix is to require supporting documentation with each approval request.
- Overriding controls: A senior executive who forces staff to bypass a control “just this once” sets a dangerous precedent. This is how many frauds begin.
- Too many controls: Excessive procedures slow down operations and frustrate employees, leading them to find workarounds. The goal is efficiency, not bureaucracy.
- Lack of monitoring: Controls are not “set and forget.” They need regular testing—someone should periodically check whether the procedures are actually being followed.
One common misconception is that control procedures are only about preventing theft. In reality, they also catch honest mistakes. A data entry error that overstates revenue could lead to bad business decisions or tax problems. Procedures like reconciliations and independent reviews catch those errors before they cause damage.
Control Procedures vs. Internal Controls: What’s the Difference?
People often use “control procedures” and “internal controls” interchangeably, but they are not the same. Internal controls is the umbrella term covering the entire system: the control environment (tone at the top), risk assessment, information systems, monitoring, and the control activities themselves. Control procedures are specifically the control activities—the day-to-day actions.
Think of it this way: internal controls are the strategy, and control procedures are the tactics. For example, a company’s internal control policy might state that “all cash receipts must be deposited intact daily.” The control procedure would be the specific step: the cashier prepares a deposit slip, the manager verifies it, and the office assistant takes it to the bank by 3 PM.
Another related term is “internal control over financial reporting” (ICFR), which is the subset of controls that directly affect the accuracy of financial statements. For public companies, auditors must test these controls annually.
Costs and Benefits: Are They Worth It?
Implementing control procedures costs money and time. You might need to hire additional staff to separate duties, purchase secure software, or spend hours on reconciliations. For a small business, the cost of adding a second person to handle approvals might feel prohibitive.
However, the cost of not having controls is often higher. Fraud can drain a company’s cash, and even minor errors can lead to tax penalties or lost investor confidence. A 2020 report by the Association of Certified Fraud Examiners found that the typical organization loses 5% of its revenue to fraud each year—a figure that highlights the potential payoff of even basic controls.
To balance costs, prioritize the highest-risk areas. A small business might spend nothing extra by simply having the owner review all bank statements and sign all checks. A growing company might invest in accounting software with user permissions and audit trails, which automates many controls.
Template: Simple Control Procedure Checklist
Use this blank checklist to document your key control procedures. Fill in the blanks with your organization’s specific actions and owners.
| Control Area | Procedure | Frequency | Responsible Person | Reviewer |
|---|---|---|---|---|
| Cash receipts | _________________________ | _________ | _________ | _________ |
| Cash disbursements | _________________________ | _________ | _________ | _________ |
| Bank reconciliation | _________________________ | _________ | _________ | _________ |
| Purchase approvals | _________________________ | _________ | _________ | _________ |
| Payroll processing | _________________________ | _________ | _________ | _________ |
| Inventory counts | _________________________ | _________ | _________ | _________ |
| Access to accounting system | _________________________ | _________ | _________ | _________ |
Sample (fictional): For a small retail shop, the “Cash receipts” row might read: “Cashier counts register at start of shift; manager verifies count and signs log.” Frequency: Daily. Responsible: Cashier. Reviewer: Store Manager.
Frequently Asked Questions
What is the difference between a control procedure and a control policy?
A control policy is a high-level statement of intent—for example, “The company will maintain accurate financial records.” A control procedure is the specific action taken to achieve that policy, such as “The accountant will reconcile the bank statement monthly.” Policies set the rules; procedures are the steps.
How many control procedures does a small business need?
There is no magic number. A sole proprietor with no employees might only need a few basic procedures, like keeping receipts and reconciling the bank account. As you hire staff, you add procedures to prevent theft and errors—such as requiring two signatures on checks or having a manager approve timesheets. Focus on your highest-risk areas first.
Can control procedures be automated?
Yes, many can. Accounting software can enforce approval workflows, restrict user permissions, log all changes, and flag unusual transactions. Automation reduces human error and makes it harder to bypass controls. However, automated controls still need human oversight—someone must review the system’s alerts and audit logs.
What happens if we don’t have control procedures?
Without control procedures, you are exposed to higher risks of undetected errors, employee theft, and inaccurate financial statements. This can lead to cash shortages, tax problems, and loss of investor or lender trust. In some industries, lack of controls can also result in regulatory fines.
Who is responsible for implementing control procedures?
Ultimately, senior management and the board of directors are responsible for establishing an effective internal control system. In practice, the CFO or controller often designs the procedures, and managers at all levels are responsible for ensuring staff follow them. Employees are expected to comply with the procedures and report any violations.
How often should control procedures be reviewed?
At least annually, or whenever there is a significant change in your business—like hiring new staff, switching accounting software, or opening a new location. Regular reviews help ensure your controls still fit your operations and that employees are actually following them.