Internal Controls for Growing Businesses

As a business grows, its internal controls must grow with it, and failing to keep them aligned with growth is one of the most common and most costly weaknesses we see. A small business can usually run on informal controls: the oversight that comes naturally when the founder and a few people know everything that happens. As volume, headcount and complexity increase, that informal oversight stops covering the risks, and the business needs deliberate, structured controls instead. The ones that make the change in time protect themselves; the ones that don’t usually find out through an error, a fraud or a difficult first audit.

This guide is practical. It sets out which controls matter at each growth stage, a minimum controls checklist, how to handle segregation of duties when the finance team is two people, the fraud risks that hit growing businesses hardest, the new corporate offence of failure to prevent fraud, and the point at which a Financial Controller becomes necessary. For the discipline of designing controls itself, including control objectives and a control matrix, see our companion guide to designing financial controls; this page deliberately does not repeat it.

Why Controls Must Grow With the Business

Controls manage risk, and risk grows with the business. In a small company the owner sees every payment, knows every supplier and notices when something looks wrong. That works until transaction volumes outstrip what one person can review, until people are hired who the owner does not work alongside every day, and until decisions are delegated to managers who were not there when the informal rules were set.

A business that grows while still relying on the informal controls of its early days becomes progressively more exposed, because its controls no longer match its risks. The exposure usually goes unnoticed until a problem reveals the gap, by which point the money has gone or the accounts are wrong. Anticipating that gap, rather than reacting to it, is the core of the job.

How Control Needs Change as a Business Grows

The turnover bands below are a guide rather than rules; headcount, transaction volume, regulation and outside investment matter as much as revenue. A £3m business with investors and 40 staff may need the controls of a £10m owner-managed one.

Start-up to around £5m: protect the cash

At this stage the finance function is typically a bookkeeper, an external accountant and the founder. The priority is protecting cash and keeping records clean enough to rely on. The essentials are dual authorisation on bank payments (the bookkeeper sets up, a director approves), a monthly bank reconciliation reviewed by someone other than the preparer, a documented process for changing supplier bank details, basic expense rules, and a simple monthly management pack so the owner sees the numbers rather than inferring them from the bank balance. Cloud accounting and banking platforms make most of this cheap to set up; the risk is that nobody switches the features on.

Around £5m to £20m: formalise and delegate

This is where the owner can no longer see everything, and where most control failures happen. Headcount rises, managers start committing spend, and finance usually grows to a small team led by a Finance Manager or first Financial Controller. The business now needs a written authorisation matrix (who can commit what, up to what value), purchase orders or approval workflows for spend above a threshold, a structured month-end close with balance sheet reconciliations reviewed and signed off, payroll changes approved outside payroll, access controls in the finance system, and a fixed asset and stock count process where relevant. Many businesses also cross the audit threshold during this stage. Since 6 April 2025 a company is small if it meets two of: turnover up to £15m, balance sheet up to £7.5m, and up to 50 employees, so growth past those levels typically ends the small company audit exemption and brings a first statutory audit, with an auditor who will test controls. Our guide to preparing for your first audit covers what that involves.

£20m and above: embed, evidence and monitor

By this point controls need to be embedded in systems and evidenced, not just performed. Expect an ERP or a more capable finance system with workflow approvals and system-enforced segregation, a documented control framework, periodic user access reviews, formal treasury and credit control policies, group consolidation controls if there are several entities, and some form of independent review, whether internal audit, an outsourced review or a structured self-assessment. Medium companies now go up to £54m turnover, £27m balance sheet and 250 employees; beyond that, larger organisations come within scope of the failure to prevent fraud offence described below. Our guide to the three lines of defence in finance teams explains how responsibilities for operating, overseeing and assuring controls are split at this size.

The Controls a Growing Business Particularly Needs: A Minimum Checklist

The table below is a minimum, not a full framework. If any control marked for your stage is missing, fix it before adding anything more sophisticated.

A well-run close underpins most of these controls; our guide to optimising the month-end close covers how to make it reliable as volumes grow.

Segregation of Duties With a Small Team

Textbook segregation needs different people to initiate, approve, record and reconcile. A finance team of two cannot do that, and pretending otherwise produces controls that exist on paper only. The practical answer is to separate the few duties that matter most and add compensating controls where full separation is impossible.

• Separate payment set-up from payment approval. This is the one segregation that should never be compromised. If the bookkeeper creates payments, a director or the Finance Manager releases them, and nobody can do both.
• Keep supplier master data away from the payment run. Whoever changes supplier bank details should not be the person who pays suppliers, or every change should be independently verified.
• Use the owner or a director as a reviewer. A director reviewing the bank reconciliation, the payment list and the payroll variance each month is a strong compensating control and takes less than an hour.
• Use the system. Banking platforms and accounting software can enforce dual approval and restrict permissions. Switch those features on rather than relying on people to remember.
• Bring in an outside reviewer. An external accountant or a fractional Financial Controller reviewing reconciliations and journals each month gives independent challenge without a full-time salary.
• Rotate and take leave. Making sure everyone takes a proper holiday, with someone else covering their tasks, is an old-fashioned control that still uncovers problems.

AI tools in finance raise a newer version of the same question: who reviews what the tool produced, and who can change its configuration. Our guides to human-in-the-loop AI controls and an AI usage policy for finance teams cover that angle.

Fraud Risks in Growing Businesses

Growing businesses are attractive targets: payment volumes are rising, new staff do not yet know what normal looks like, and processes are still informal. The risks below account for most of the losses we hear about from clients and candidates.

Payment diversion and supplier bank detail changes

The most common external fraud. A criminal, often using a compromised or spoofed supplier email account, tells accounts payable that the supplier’s bank details have changed. The next genuine invoice is paid to the fraudster. The emails often look entirely legitimate because they come from a real, hacked account in the middle of a real conversation. The control is simple and must be absolute: no bank detail change is processed on the strength of an email or letter alone. Verify it by phone using a number already held on file, not one in the message, have a second person approve the change, and consider a small test payment confirmed by the supplier for large accounts. The National Cyber Security Centre’s guidance on business email compromise sets out the technical defences alongside the process ones.

Impersonation of senior people

An urgent request apparently from the CEO or a director asking finance to make a confidential payment today. Voice cloning and convincing fake video calls have made this harder to spot. The control is a rule, communicated from the top, that no payment bypasses the normal approval process whoever asks, and that staff will never be criticised for checking.

Internal fraud

Ghost employees or inflated pay in payroll, fictitious suppliers, personal spending on company cards, and refunds or credit notes diverted to the fraudster’s account. These usually exploit the gaps in segregation described above, and are usually found through a reconciliation or variance review that someone finally looked at properly.

The failure to prevent fraud offence

Since 1 September 2025, under the Economic Crime and Corporate Transparency Act 2023, a large organisation can be criminally liable if an employee, agent or other associated person commits a fraud intended to benefit it, unless it had reasonable fraud prevention procedures in place. A large organisation is one meeting two of three tests: more than 250 employees, more than £36m turnover and more than £18m total assets. The Home Office guidance on the offence is built around six principles: top-level commitment, risk assessment, proportionate risk-based procedures, due diligence, communication and training, and monitoring and review.

Note the direction of the offence. It targets fraud committed for the organisation’s benefit, such as misleading customers or investors or false accounting to hit a covenant, rather than fraud against it, although good controls address both. Growing businesses approaching the thresholds, and those inside a larger group, should start documenting their fraud risk assessment before they cross them rather than after.

Building Controls That Scale

Controls that scale are embedded in systems and processes rather than dependent on individual effort. A person reviewing every invoice cannot keep up with doubling volume; an approval workflow with value thresholds can. When a business is choosing or replacing its finance system, build the controls into the design: approval routes, mandatory fields, restricted access and audit trails. Our guide to the Financial Controller’s role in an ERP or finance system change covers why that is easier at implementation than afterwards.

Scalable controls are also built ahead of growth, not after it. Controls built after a problem reveals the gap arrive too late. And they are proportionate: strong enough to manage the real risks, but not so heavy that they slow the business or encourage people to work around them. A three-signature process for a £200 purchase is as much a control failure as no process at all, because it teaches people that controls are obstacles. Our finance transformation roadmap places controls within wider finance function development.

The Common Control Failures of Growing Businesses

• Controls that do not grow in step with the business. The most fundamental failure: relying on informal oversight long after it has stopped covering the risks.
• No segregation in the payment process. One person able to change supplier details, create payments and release them.
• An inadequate authorisation framework. Delegating spend and contracts without written limits, so commitments are made that nobody approved.
• Reliance on key individuals. Controls that depend on one person’s knowledge, which fail when the business outgrows them or when they leave.
• Reconciliations prepared but not reviewed. A reconciliation with unexplained items carried forward for months is not a control.
• Controls that exist only on paper. A policy says two people approve payments; in practice one person holds both banking logins.

Controls Through Specific Growth Transitions

Rapid growth is the most testing, because the business can outgrow its controls faster than anyone notices. A business doubling in a year should review its controls at least twice in that year.

Owner-managed to delegated management is the transition where most failures occur. The owner’s informal oversight has to be replaced by an authorisation matrix, reviewed reconciliations and management information the owner trusts, and often by a first Financial Controller. Our guide to when to upgrade from a bookkeeper to a Financial Controller covers the signs.

Outside investment brings investor reporting, covenants and often a requirement for audited accounts, together with an expectation that controls are documented.

Acquisitions bring in another business’s controls, which may be weaker or simply different. Payment and bank mandates, supplier master files and system access should be brought under the group’s controls early.

The first audit exposes every informal process at once. A Financial Controller who has run the year end before is usually the difference between a smooth first audit and an expensive one; our guide to Financial Controller audit preparation sets out the year-end checklist.

When Controls Need a Financial Controller

A bookkeeper and an external accountant can operate the start-up controls. Designing, owning and evidencing the £5m-plus controls is a Financial Controller’s job. The usual signs are: the owner can no longer review every payment, an audit is coming, investors or lenders want reliable monthly numbers, the finance team has grown past two or three people, or a control failure has already happened.

For an owner-managed business turning over £5m to £15m, a permanent Financial Controller typically costs £65k–£82k in London, £54k–£70k in the South East and £48k–£64k in the Midlands and North. From £15m to £40m, the bands rise to £78k–£98k, £65k–£84k and £58k–£75k. PE-backed businesses typically pay £88k–£115k. Full benchmarks are in our Financial Controller salary guide, and our guide to hiring a first Financial Controller for a growing business covers the brief.

Not every business needs that full-time. A fractional Financial Controller in London typically costs £29k–£39k a year for one day a week, or £52k–£68k for two days, which is often enough to design the controls, review the team’s work and own the audit. Where a specific problem needs fixing quickly, such as a fraud, a failed audit or a system migration, an interim Financial Controller typically costs £400–£650 a day in London, £350–£550 in the South East and £310–£490 in the Midlands and North. Our guide to finance team costs shows how the whole function’s cost changes as the business grows.

Frequently Asked Questions

What are the most important internal controls for a small business?

Dual authorisation of bank payments, independent verification of supplier bank detail changes, a monthly bank reconciliation reviewed by someone other than the preparer, and clear expense rules. Those four prevent most of the losses small businesses suffer.

How do you achieve segregation of duties with only one or two finance staff?

Separate payment set-up from approval, keep supplier bank detail changes away from the person running payments, and use a director or outside reviewer as a compensating control over reconciliations, payments and payroll. Use your banking and accounting software to enforce approvals.

Does the failure to prevent fraud offence apply to my business?

It applies to large organisations meeting two of: more than 250 employees, more than £36m turnover and more than £18m total assets, and has been in force since 1 September 2025. Smaller businesses are outside its scope but face the same fraud risks, and those that belong to a large group may be caught at group level.

When should a growing business hire a Financial Controller?

Typically around £5m turnover, or earlier if there is outside investment, an approaching audit or a finance team of several people. A fractional Financial Controller is often the right first step before a full-time hire.

How often should internal controls be reviewed?

At least annually, and whenever the business changes materially: a new system, an acquisition, a major hire, rapid growth or a control failure. Fast-growing businesses benefit from reviewing twice a year.