Login
Most organisations have financial controls in place. Purchase orders require approval, bank reconciliations are completed each month and payroll follows an established process. But how often are those controls tested to make sure they’re actually working?
As organisations grow, processes naturally evolve. Staff take on additional responsibilities, systems change, and shortcuts can develop to keep work moving. Over time, even well-designed controls can become less effective if they aren’t followed consistently.
That’s where internal audit can add real value. Rather than simply reviewing documented procedures, it tests whether controls are working in practice, helping organisations identify weaknesses before they result in payment errors, fraud, financial loss or unreliable reporting.
Whether you’re an owner-managed business, charity, school or growing organisation, Leisyen Cox, Risk and Assurance Partner looks at why regularly reviewing your financial controls can provide greater confidence that your processes are protecting both your finances and your people.
Why financial controls need testing, not just documenting
Having a documented process is only the first step. A control is only effective if it’s followed consistently.
For example, your finance policy may require all supplier payments to be approved before they’re processed. However, if urgent invoices are routinely paid without review to avoid delays, the control exists on paper but not in practice.
It’s often only after an error, supplier dispute or suspected fraud that weaknesses become apparent. Internal audit helps identify these issues earlier, allowing organisations to strengthen controls before they become expensive problems.
Where should internal audit focus first?
Rather than reviewing every financial process at once, internal audit should focus on the areas that present the greatest risk to your organisation.
This will depend on your size, sector and how your finance function operates, but common areas include:
- Purchase approvals
- Supplier payments
- Payroll changes
- Expenses and company cards
- Bank reconciliations
- Credit control and aged debtors
- Cash handling (where applicable)
- Management accounts and financial reporting
- System access and user permissions
By prioritising higher-risk activities, organisations can gain the greatest value from an internal audit while keeping the review proportionate and practical.
Strengthening supplier payment controls
Supplier payments are one of the most common areas where weak controls can expose organisations to unnecessary risk.
Problems often arise where one individual can create new suppliers, approve invoices and release payments without independent oversight. While this may seem efficient, it increases the risk of both genuine mistakes and fraudulent activity.
Common weaknesses include:
- Supplier bank account changes accepted by email without independent verification.
- Invoices paid before a purchase order or approval has been obtained.
- One employee controlling the entire payment process from start to finish.
Simple measures such as segregating duties, verifying supplier bank detail changes by telephone and introducing approval limits can help to reduce these risks while protecting both the organisation and its employees.
Payroll, expenses and employee-related controls
Payroll and expenses require particularly strong controls because they involve recurring payments, sensitive personal information and employee trust.
Internal audit may review:
- Starter and leaver processes
- Salary amendments
- Overtime and bonus payments
- Pension deductions
- Employee expenses
- Company card transactions
For example, an internal audit may identify that a former employee remained on payroll after leaving, salary increases were processed without formal approval or expense claims were reimbursed without receipts or a clear business purpose.
These controls aren’t simply designed to prevent fraud. They also help make sure that employees are paid accurately, consistently and in line with company policy.
Reconciliations and management reporting
Reconciliations are one of the most important financial controls an organisation can perform.
A reconciliation simply checks that two sets of financial records agree. Where differences exist, they should be investigated and resolved rather than carried forward indefinitely.
Internal audit can review whether:
- Bank reconciliations are completed every month.
- Control accounts are reconciled regularly.
- VAT and payroll reconciliations are performed accurately.
- Aged debtor and creditor reports are reviewed.
- Outstanding differences are investigated promptly.
Reliable management information depends on reliable underlying data. For example, management accounts may indicate a healthy cash position, but if historic unreconciled items remain unresolved, the true financial position may be less certain than it appears.
What does a control test actually involve?
Internal audit doesn’t usually involve reviewing every transaction.
Instead, auditors typically select a representative sample and test whether the expected controls were followed. The emphasis is on evidence rather than explanation.
For example, an internal auditor may:
- Select 20 supplier payments and confirm invoice approval, payment authorisation and evidence supporting supplier bank details.
- Review a sample of employee expenses to check receipts, approvals and business purpose.
- Test whether payroll amendments were approved before being processed.
- Confirm monthly bank reconciliations were completed, independently reviewed and signed off.
This approach helps to identify whether controls are working consistently across the organisation.
Turning findings into improvements
Finding a weakness isn’t a sign that the organisation has failed. In many ways, it’s the purpose of the exercise.
The greatest value comes from turning observations into practical improvements that reduce future risk.
Recommendations may include:
- Separating key financial duties where possible.
- Introducing additional approvals for higher-risk transactions.
- Reviewing finance system access permissions.
- Improving process documentation.
- Providing refresher training on approval procedures.
- Scheduling follow-up reviews to confirm improvements have been implemented.
The aim isn’t to create unnecessary bureaucracy, but to strengthen processes in a way that’s proportionate to the organisation’s size and level of risk.
Financial controls checklist
Before your next internal audit, consider the following questions:
- Can one person create suppliers and approve payments?
- Are supplier bank detail changes independently verified?
- Are expenses supported by receipts and a clear business purpose?
- Are payroll changes approved before processing?
- Are leavers removed from payroll promptly?
- Are bank reconciliations completed and reviewed each month?
- Are aged debtors and creditors reviewed regularly?
- Are management reports supported by reliable financial records?
- Are user access rights reviewed periodically?
- Are unusual or unexpected transactions investigated and documented?
Strong financial controls aren’t just about preventing fraud. They help organisations produce reliable financial information, protect valuable assets and give directors, trustees and business owners greater confidence that key processes are operating as intended, supporting better decision-making across the organisation.
We’re here to help
Our internal audit specialists help organisations understand whether their financial controls and processes are working as intended. We work with businesses, charities, education providers and other organisations to review key controls, identify risks and provide practical, proportionate recommendations for improvement, helping reduce the risk of errors, fraud and poor financial oversight before issues escalate.
Get in contact with Leisyen or one of the team to find out more today by calling 0330 058 6559 or email hello@scruttonbland.co.uk
Back