Control procedures in accounting are the specific policies, practices, and physical safeguards that a company uses to protect its assets, ensure the accuracy of its financial records, and prevent fraud or error. They are the day-to-day actions that turn a broad internal control framework into reality, such as requiring two signatures on large checks, locking the supply closet, or reconciling bank statements each month.
Background: Why Control Procedures Matter
Accounting control procedures are not a modern invention. As long as businesses have had money and inventory, owners have needed ways to make sure those resources were not stolen or mismanaged. The modern push for formalized control procedures came in the late 20th century, especially after high-profile corporate scandals revealed how weak oversight could hide massive fraud. In the United States, the Sarbanes-Oxley Act of 2002 made senior executives personally responsible for establishing and maintaining adequate internal controls, including specific control procedures. Since then, auditors and regulators worldwide have treated documented control procedures as a core expectation for any organization of meaningful size.
Control procedures sit within a larger concept called internal control, which also includes the overall control environment (the tone set by management), risk assessment, information systems, and monitoring. The procedures themselves are the tangible, often repetitive steps that employees follow. Without them, even the most ethical staff can make honest mistakes, and dishonest staff have an easier path to theft.
How Control Procedures Work in Practice
A control procedure typically follows a simple logic: identify a risk, then design a step to reduce that risk to an acceptable level. For example, the risk of paying a fake invoice is reduced by requiring a manager to approve every vendor payment. The risk of inventory disappearing is reduced by counting stock periodically and comparing it to records.
Most control procedures fall into one of these categories:
- Authorization: Requiring approval before a transaction occurs. Example: a department head must sign a purchase order before the company orders supplies.
- Segregation of duties: Dividing responsibilities so no single person controls all parts of a transaction. Example: the person who records cash receipts is not the same person who deposits the cash.
- Physical controls: Locks, safes, passwords, and security cameras that protect assets and records. Example: a cashier’s drawer is locked when not in use.
- Documentation and recordkeeping: Using pre-numbered forms, receipts, and logs so transactions can be traced. Example: every sales invoice has a unique number, and missing numbers are investigated.
- Independent verification: Having someone check another person’s work. Example: a supervisor reviews the daily cash count.
- Reconciliation: Comparing two sets of records to find differences. Example: the bank statement is compared to the company’s cash ledger each month.
These procedures are most effective when they are written down, communicated to staff, and consistently enforced. A procedure that exists only in the owner’s head is not a real control.
How to Choose the Right Control Procedures
Not every business needs the same level of control. A small shop with two employees cannot fully segregate duties, so it must rely on other procedures like daily owner review of sales records. A multinational corporation, on the other hand, needs elaborate approval chains and automated system checks.
When choosing control procedures, consider these factors:
- Size of the organization: More employees mean more chances for collusion and error, so more formal procedures are needed.
- Nature of the assets: Cash, easily resold inventory, and sensitive customer data require stronger controls than office furniture.
- Cost of the control: The procedure should not cost more than the loss it prevents. A $500 lock is overkill for a $50 petty cash box.
- Risk tolerance: A startup may accept more risk to keep operations fast, while a public company must meet regulatory expectations.
A practical approach is to list the most likely fraud or error scenarios, then design one simple control for each. For example, if employee timesheets could be inflated, require a manager to approve them before payroll is run.
Common Problems and Misconceptions
One common misconception is that control procedures are only about preventing theft. In reality, they also catch honest errors, such as a misplaced decimal or a transposed number. Another is that more controls are always better. In fact, excessive procedures can slow down operations and frustrate employees, leading them to bypass the controls entirely.
A frequent problem in small businesses is the owner who thinks, “I trust my staff, so we don’t need controls.” Trust is not a control. Even honest people make mistakes, and someone under financial pressure can rationalize theft. Another issue is having procedures but not enforcing them. If a policy says all checks need two signatures, but the office manager signs alone when the owner is away, the control is worthless.
Segregation of duties is often the hardest to implement in small teams. When one person does the bookkeeping, handles cash, and reconciles the bank, there is little to stop them from covering up a theft. A practical workaround is for the owner to review the bank statement personally every month, even if they do nothing else.
Control Procedures vs. Internal Controls
The terms are sometimes used interchangeably, but they are not identical. Internal controls is the umbrella term for everything an organization does to ensure reliable financial reporting, operational efficiency, and compliance with laws. Control procedures are a subset of that. The other components—such as the control environment, risk assessment, and monitoring—are not procedures themselves but they support the procedures.
For example, a company might have an excellent procedure for approving purchase orders, but if management never reviews the approval logs (a monitoring activity), the procedure may fall into disuse. Similarly, if the company culture is lax about following rules (a weak control environment), even well-designed procedures will be ignored.
Cost and Practicality of Implementation
Implementing control procedures costs money and time. The direct costs include software, locks, safes, and the hours employees spend on approvals and reviews. There is also an indirect cost: slower processes. A purchase that could be done in one day might take three with multiple approvals.
For a small business, the most cost-effective controls are often the simplest: separate the person who writes checks from the person who signs them, use a petty cash log, and reconcile the bank monthly. These require little or no expense. For larger companies, the cost of an internal audit team and enterprise software can be significant, but the potential loss from a single fraud scheme often dwarfs those costs.
It is also worth noting that auditors will test control procedures as part of a financial statement audit. If the procedures are weak or not followed, the auditor may charge more for extra testing or issue a report that flags the weakness. That can affect loan terms or investor confidence.
Alternatives and Limitations
Control procedures are not foolproof. Two or more employees can collude to bypass them, and a determined executive can override them. Insurance (such as fidelity bonds) and background checks are complementary measures, not substitutes. Some businesses use software-based controls, like automated approval workflows or system alerts for unusual transactions, which can be more reliable than manual steps but still depend on proper setup.
Another alternative is outsourcing certain functions, such as payroll or accounts payable, to a third party. That shifts some control responsibilities to the vendor, but the company still needs to review the vendor’s reports and ensure the data they send is accurate.
Frequently Asked Questions
What is the difference between a control procedure and a control activity?
In most accounting contexts, they are the same thing. The COSO internal control framework uses the term “control activities” to describe the actions taken to address risks. “Control procedures” is a more common term in everyday business language and in many textbooks. Both refer to the specific policies and steps that enforce management’s directives.
Do small businesses really need formal control procedures?
Yes, but they can be informal. A small business can use simple procedures like the owner signing all checks, counting the cash drawer daily, and reviewing the bank statement personally. The key is to have some procedure that reduces the risk of theft and error, even if it is not written in a policy manual.
Can control procedures prevent all fraud?
No. Even the best procedures can be defeated by collusion or management override. However, they significantly reduce the risk and make fraud harder to conceal. The goal is to reduce risk to an acceptable level, not to eliminate it entirely.
What happens if a company has no control procedures?
The company is at much higher risk of undetected errors and fraud. Financial statements may be inaccurate, assets may be stolen, and auditors will likely issue a negative opinion or require extensive testing. In extreme cases, the company could face legal penalties if the lack of controls leads to regulatory violations.
Control Procedures Template
Use the table below to document your key control procedures. Fill in one row for each significant process (e.g., cash receipts, payroll, inventory).
| Process | Risk Addressed | Control Procedure | Who Performs It | Frequency | Evidence of Performance |
|---|---|---|---|---|---|
Sample (fictional): Process: Cash receipts. Risk: Cash stolen before deposit. Control Procedure: Two employees count cash together; one prepares deposit, the other verifies. Who Performs It: Cashier and office manager. Frequency: Daily. Evidence: Both sign the deposit slip.