Groundwork ← Back Finance   The cluster All guides
Groundwork
← Back All guides
Finance

Financial Controls When There Is Only One of You

Every standard financial controls framework rests on segregation of duties, which is impossible with one person. This guide rebuilds them around three substitutes: a delay instead of an approver, a record instead of a reviewer, and a rule set in advance instead of judgment under pressure. Includes a six step setup, a twenty point checklist, and the five failures that actually happen at this size.

Aziz Chaabane11 min read21 September 2026
Share
On this page
    Quick answer

    Financial controls are the rules that stop money leaving your business by mistake, by theft, or by a decision you would not have made if you had stopped to think. Every standard framework rests on segregation of duties, meaning the person who approves a payment is never the person who makes it. In a business of one that is impossible, so the controls have to be rebuilt around a different idea: replacing the second person with a delay, a record, or a rule you set in advance. The process below takes an afternoon, and the checklist further down is the finished artefact you keep.

    Search this term and you get IBM, NetSuite and the US Department of Labor. All of them are describing a control environment with an approver, a preparer, a reviewer and an audit committee. That is the correct answer for a company with a finance department, and it is useless on a Tuesday when you are the finance department.

    The underlying risk does not disappear at your size. It changes shape. A business with staff worries about an employee committing fraud. A business of one worries about paying an invoice that was never real, losing a year of records with a dead laptop, or discovering in March that a subscription you cancelled in August has been billing you ever since.

    How to Set Up Financial Controls in an Afternoon

    Work through these in order. None of them requires research, because every answer is already in your bank account or your inbox. Each step produces a row in the checklist further down.

    1. Separate the money first. One business account, one business card, and nothing personal touching either. This is the single control that makes every other one possible, because a mixed account cannot be reconciled and cannot be reviewed. If you have been running through a personal account, this step alone is worth the afternoon.
    2. Set the amount that makes you stop. Pick a number above which you do not pay on the same day. It can be low. The point is not the number, it is the pause: a forced delay is what replaces the second pair of eyes you do not have. Below it, pay normally. Above it, sleep on it.
    3. Write the rule for new payees. Any first payment to a new supplier or contractor gets their bank details confirmed by voice, not by email. Invoice fraud works by intercepting or imitating an email and changing the account number, and the whole attack fails against one phone call to a number you already had.
    4. Fix the record. Decide where receipts go, how often you reconcile the bank against your books, and where the backup lives. Double entry bookkeeping exists precisely because it catches errors that a single list cannot, and a consistent chart of accounts is what makes a reconciliation take ten minutes instead of an afternoon.
    5. List everything that bills you automatically. Every subscription, every standing order, every card on file, with the renewal date and the cancellation route. Recurring charges are the quietest way money leaves a small business, because nothing ever goes wrong loudly enough to get your attention.
    6. Set the review dates. One monthly review of the numbers you actually watch, and one annual pass with whoever does your accounts. Put both in the calendar. A control with no review date stops being a control and becomes a thing you used to do.

    That is the whole setup. It takes an afternoon rather than a project because you are not designing a system for other people to follow. You are writing down the decisions that currently live in your head, so that the version of you who is tired, busy and mid-project does not have to make them again under pressure.

    Aziz's take: Step two is the one people skip and it is the one that pays. Almost every genuinely bad payment decision I have seen came from paying something the moment it arrived, while distracted, because it looked routine. A rule that says anything over a set amount waits until tomorrow costs you nothing when the invoice is real, and it is the only defence you have against a convincing fake. You are not trying to catch a criminal. You are trying to not be in a hurry.

    The Financial Controls Checklist

    This is the artefact. Twenty controls across five areas, each with a state so the gaps are visible rather than remembered. Fill in the highlighted values, mark anything missing as MISSING rather than deleting the row, and you have an honest audit of your own business in one page.

    Financial controls checklist
    How to use this

    Fill in

    • Every highlighted value. Where a control does not exist yet, write MISSING so the gap stays visible.
    • Section 01 first. Nothing else works on a mixed account.
    • Be specific enough that a tired version of you could follow it without re-deciding.

    Check before you file it

    • Nothing marked Must exist is still blank.
    • The approval threshold in 02 is a real number, not "when it feels large".
    • Both review dates in 05 are in your calendar, not only in this document.

    What goes wrong

    • Filling it in aspirationally. A record of the controls you intend to have is worth nothing.
    • Setting the approval threshold so high it never triggers, which is the same as having none.
    • Never reopening it, so it describes a business that stopped existing two years ago.
    BusinessYOUR BUSINESS NAME
    01Separation4 controls
    Business accountWHICH ACCOUNT, NOTHING PERSONAL IN ITMust exist
    Business cardWHICH CARD, WHO HOLDS ITMust exist
    Personal drawingsHOW YOU PAY YOURSELF, HOW OFTENMust exist
    Who else has accessNAMES, OR NONEMust exist
    02Money going out4 controls
    Approval thresholdAMOUNT ABOVE WHICH YOU WAIT A DAYMust exist
    New payee ruleCONFIRM BANK DETAILS BY VOICE, ALWAYSMust exist
    Recurring chargesWHERE THE LIST LIVES, WHEN REVIEWEDMust exist
    Payment methodHOW SUPPLIERS GET PAID, AND HOW THEY DO NOTRecommended
    03Money coming in4 controls
    Invoice numberingSEQUENTIAL, NO GAPS, WHERE ISSUEDMust exist
    Payment matchingHOW YOU CONFIRM WHAT LANDED AND WHYMust exist
    Overdue reviewHOW OFTEN YOU CHECK WHO HAS NOT PAIDMust exist
    Deposit ruleWHAT YOU TAKE UP FRONT, AND WHENRecommended
    04The record4 controls
    ReconciliationHOW OFTEN BANK IS MATCHED TO BOOKSMust exist
    Receipt captureWHERE RECEIPTS GO, AT WHAT MOMENTMust exist
    BackupWHAT IS BACKED UP, WHERE, HOW OFTENMust exist
    Record retentionHOW LONG YOU KEEP WHATRecommended
    05Access and review4 controls
    Bank securityTWO FACTOR ON, PASSWORD MANAGER USEDMust exist
    Statement reviewWHEN YOU READ EVERY LINE, NOT THE TOTALMust exist
    Monthly numbersWHICH FIGURES YOU CHECK, AND WHENMust exist
    Annual reviewDATE, AND WHO LOOKS AT IT WITH YOURecommended

    What Financial Controls Actually Are

    A financial control is any rule that has to be satisfied before money moves, or any check that catches an error after it has. That is the whole definition, and it usefully rules things out: a spreadsheet is not a control, a budget is not a control, and intending to review something is not a control. A control has a trigger and an action.

    Standard frameworks group them three ways. Preventive controls stop something before it happens, like requiring approval above a threshold. Detective controls find it afterwards, like a bank reconciliation. Corrective controls fix it and close the hole, like cancelling a card and changing the rule that let the charge through. A sound setup has all three, because prevention is never complete and detection alone means you only ever find out late.

    What a control is not is a matter of trust. The reason accountants insist on them has nothing to do with suspicion and everything to do with the fact that attention is finite. You will at some point be tired, behind, and handling something that looks routine. The control is what covers that moment.

    Why Every Textbook Control Assumes Two People

    Open any standard list and the first principle is segregation of duties: whoever approves a payment must not be the person who executes it, and whoever records a transaction must not be the person who reconciles it. The logic is sound. Two people have to collude to hide something, and collusion is rarer and riskier than one person acting alone.

    Then you read it as a business of one and realise you are the approver, the executor, the recorder and the reviewer. The principle does not bend at your size. It simply does not apply.

    So it has to be substituted. In practice there are three things that stand in for a second person, and all three appear in the checklist above.

    A delay substitutes for an approver. You cannot have someone else sign off, but you can refuse to pay anything over a set amount on the day it arrives. Almost every payment you would regret looks fine in the moment and obviously wrong the next morning. The pause is doing the job the second signature would have done.

    A record substitutes for a reviewer. Sequential invoice numbers, a reconciliation on a fixed date, a receipt captured at the moment of purchase rather than at year end. None of these stop anything, but they make an error findable, and findable is the difference between a small correction and a year of untangling.

    A rule set in advance substitutes for judgment under pressure. Deciding today that new suppliers get a phone call is easy. Deciding it while a plausible invoice sits in your inbox marked urgent is much harder, which is exactly when you would need to.

    What Actually Goes Wrong at This Size

    The failures are specific and they are not the ones the frameworks are built for.

    The mixed account. Personal and business money in one place is the root failure, because it makes everything downstream unreliable. You cannot reconcile it, you cannot see what the business actually costs, and at tax time you are reconstructing intent from memory. The wider finance setup assumes this separation exists before anything else does.

    Invoice fraud. Someone imitates a supplier you already use, or intercepts a real invoice and changes the bank details. It is convincing because the invoice is often genuine, and it targets small businesses precisely because there is no second approver. The voice confirmation rule in section 02 is the entire defence.

    Subscription drift. Tools you stopped using, plans that auto upgraded, annual renewals you forgot were annual. This never announces itself, which is why it needs a scheduled review rather than vigilance. Expense tooling helps, but the list and the review date are what matter.

    The lost record. A dead laptop, a closed cloud account, a year of receipts that lived in an inbox you no longer control. Nothing was stolen and the damage is the same.

    The invisible slide. No single event, just a slow drift where margin erodes and nobody is reading the numbers monthly. Cash flow is where it shows up first, and the profit and loss statement is where it becomes undeniable.

    Where to Start If You Have None of This

    Do not try to fill in the whole checklist in one sitting. Work in the order of consequence.

    Start with section 01, because a mixed account makes every other control unreliable and there is no way around it. Then section 02, because money going out is where a single bad moment costs the most. Then 04, the record, because once the first two exist there is something worth recording accurately. Sections 03 and 05 can wait a week without anything breaking.

    One honest caveat. A checklist with three rows marked MISSING is more useful than a complete one filled in with intentions, because the value is in seeing the real state of the business. An accurate gap is information you can act on. A tidy fiction is not. Financial controls are one of the six systems in the operations map, and the same rule applies across all of them.

    Frequently Asked Questions

    Financial controls are the rules and checks that govern how money moves through a business. A control has a trigger and an action: something must be satisfied before a payment goes out, or something is checked afterwards to catch what slipped through. They fall into three groups. Preventive controls stop a problem in advance, such as requiring a pause above a set amount. Detective controls find problems afterwards, such as reconciling the bank against the books. Corrective controls fix the issue and close the gap that allowed it. A budget or a spreadsheet is not a control on its own, because neither has a trigger.
    The standard five, from the COSO framework that most guidance is based on, are the control environment, risk assessment, control activities, information and communication, and monitoring. That vocabulary is built for organisations with departments. Translated to a business of one it comes out as: separate the money, decide what could realistically go wrong, set the specific rules that prevent it, keep a record that makes errors findable, and review both on a fixed date. The five areas in the checklist above are that translation.
    Preventive, detective, corrective and directive. Preventive controls stop something happening, detective controls identify it after the fact, corrective controls repair the damage and close the hole, and directive controls tell people what they are supposed to do in the first place. In a one person business the directive category collapses into the other three, because you are both the person setting the rule and the only person following it. That leaves prevention, detection and correction as the three that do real work.
    No, and it is the reason most financial controls guidance does not transfer to a business of one. Segregation of duties requires that the approver, the executor, the recorder and the reviewer are not the same person, which is impossible when there is only one. Three substitutes do the same work: a mandatory delay above a set amount replaces the approver, a record that makes errors findable replaces the reviewer, and a rule decided in advance replaces judgment made under time pressure. None is as strong as a genuine second pair of eyes, and together they cover most of what actually goes wrong at this scale.
    Concrete examples for a one person business: a separate business account with nothing personal in it, an amount above which you never pay on the same day, confirming a new supplier's bank details by phone rather than email, sequential invoice numbering with no gaps, reconciling the bank against your books on a fixed date each month, a written list of every recurring charge with its renewal date, two factor authentication on the bank, reading every line of the statement rather than the total, and a calendar entry for the annual review. Each one has a trigger and an action, which is what separates a control from an intention.
    An afternoon for a first honest pass, and it will be incomplete, which is correct. None of the six steps requires research because every answer is already in your bank account or your inbox. Sections 01 and 02 of the checklist are worth completing properly in that first sitting, since separation and outgoing payments are where the real exposure sits. The rest can be marked MISSING and filled in over the following weeks without anything breaking in the meantime.
    Not to set them up. Every control in the checklist is a decision you can make yourself, and most of them cost nothing. An accountant is worth involving for the annual review in section 05, because a second reader catches the thing you have stopped seeing, and for anything with a tax consequence such as how you take money out of the business. The setup itself is yours. Waiting for professional help is one of the more common reasons a business of one never gets round to it.