Internal Audit & Risk Management
Find the gaps before somebody outside the business does.
Internal audit sounds like something that happens to large companies with compliance departments.
In an owner-operated business it’s a much simpler question: who could take money out of this business without you noticing, and how long would it take you to find out? For most businesses under about fifty staff, the honest answers are “several people” and “months”.
Make approval and review visible between setting up a supplier and moving money.
Where it usually sits
Not elaborate schemes. Ordinary gaps.
The kind that open up when a business grows faster than its processes.
- One person raises the supplier and pays it
End-to-end control of a money movement, with no independent check anywhere in it.
- Bank access granted to someone who left
Two years ago, and nobody has been through the list since.
- Cards and petty cash nobody reconciles
Or a reconciliation that is prepared and never actually read.
- Payroll only one person can run
And nobody else understands it well enough to check it or cover it.
- Quotes and variations approved verbally
Then argued about later, with no record of what was agreed.
- Backups nobody has tested
A backup you have never restored from is an assumption, not a control.
None of these mean anything is wrong today. They mean that if something did go wrong, you’d find out late and struggle to prove what happened.
What a review involves
Follow the money. Then follow the access.
Step 01
Map how money moves
In, around and out of the business — then look for the points where a single person has end-to-end control with no independent check.
Step 02
Do the same for information
Who can access what, who approves what, and what happens operationally if a key person is unavailable for a month.
Step 03
Rank it by damage and cost to fix
You get a short report: what we found, in order. Not a compliance document — a list of things to change.
Risk isn’t only fraud
Most of what surfaces isn’t dishonesty
It’s concentration.
Those are the risks that actually take businesses down, and they’re invisible from inside because they’ve been true for years and nothing has gone wrong yet.
- One client is 40% of revenue
The business is one relationship away from a different set of numbers entirely.
- One supplier with no alternative
A price rise or a failure upstream lands on you with nothing to switch to.
- One employee holds knowledge nobody wrote down
It works perfectly until the week they resign or fall ill.
- One piece of equipment, twelve-week lead time
No backup, and a replacement window longer than the business can absorb.
Trace the business’s dependence on a customer, supplier, key person or piece of equipment.
Separation of duties
One idea, in plain terms
No single person should be able to complete a money movement end to end without anyone else seeing it. The person who sets up a new supplier isn’t the person who approves the payment. The person who runs payroll isn’t the only person who can see it. The person who reconciles the bank isn’t the person with sole access to it.
Achievable in a six-person office
A second set of eyes on the handful of steps where money actually leaves — and a bank reconciliation someone other than the preparer reads once a month. That single change closes more exposure than any amount of policy documentation.
Scaled to the business
A business with nine staff doesn’t need a listed company’s controls
Imposing one would be a waste of money that slows everything down. So the recommendations are scaled, and some of what we suggest costs nothing at all.
Sounding Board SolutionsWhere these controls get maintained rather than reviewed once.
When to do this
Four moments worth the review
The pre-sale case is the one owners underestimate.
- Before a sale
A buyer’s due diligence will find whatever you didn’t. Weak controls don’t just create risk — they reduce what a buyer will pay, because everything they can’t verify gets discounted.
- After rapid growth
Processes designed for a smaller business are still in place, and nobody has revisited them.
- When a long-serving finance person leaves
The handover is the one moment the whole process is visible.
- After something has already gone wrong
And you want to know what else is exposed.
What it involves and what it costs
Two to three weeks, fixed fee
Interviews with the people who handle money and information, a walk through the systems, and a written report. Agreed up front and scaled to the size of the business. It’s a one-off piece of work rather than a retainer, though larger businesses often repeat it every couple of years.
Most of what we recommend costs nothing to implement. The value is in knowing which five things to change, not in the size of the engagement.
Start with a consultation
How the business runs, and where you’re uneasy.
A conversation about how the business runs and where you’re uneasy. Owners are usually right about where the soft spots are; they just haven’t looked directly at them.
Book a consultation