The snapshot
A business that worked with one signatory, one store, and a bookkeeper who knew every supplier will hire, open a second site, or take on a contract larger than last year’s turnover. The operation scales first. The control often scales later, after a payment, a stock loss, or a report that nobody can explain.
The useful review, before that, is small. It asks who can move money, who can change a master record, and who checks the person who did.
The trap
Headcount doubles. The same people still approve by message, because that is how it was done when the team was eight. A new supervisor can raise a purchase and receive the goods. The bank token sits with the accountant who also posts the cash book. Nothing is stolen on day one. The file, when someone asks, cannot show who agreed.
Familiar does not mean controlled. It means the old room is gone and the habit stayed.
This is an illustration, so the point can be said out loud. It is not a client matter.
What to put in place first
Three controls earn their place before a new site or a new contract, because they fail quietly and cost a lot to rebuild:
- Separate the steps that should not sit with one person. Who requests, who approves, who receives, who pays, who posts. Where one person still holds two of those, name it and say why.
- Lock the master file. New suppliers, new bank details, and new user rights are where a growing team gets hurt. A change needs a second person and a record of the old detail.
- Close on a date. Stock, bank, and the ledger agree at a stated cut-off. A second site that catches up “at month end” is a site you cannot review.
Training helps after the rule exists. A workshop that describes a control the system cannot enforce will be forgotten by the next hire. Write the rule where the work happens: the payment run, the goods-received note, the access list.
What to do
- If you are about to hire or open a site: list the approvals that currently depend on one person being in the room. Replace each one with a step a new person can follow.
- If you run internal audit: test the master-file change and the payment run before you test the policy manual. The manual sits downstream of those two.
- If you keep the books: do not let the new site keep a private sheet. It joins the same close, on the same date.
- If you own the business: ask who can change a supplier’s bank account today, and who would see it. If the answer is the same name, fix that before the next contract.