Internal controls for a growing small business: purchasing, payments, maker-checker and a compliance calendar

In a very small business, the owner sees everything. They approve every purchase, sign every payment, know every customer and notice when something looks wrong. As the business grows, this becomes impossible. The owner must delegate purchasing, payments, payroll and administration to others, and with delegation comes risk: errors, overspending, missed deadlines, fraud and scams.

Many owners respond by refusing to let go, approving everything personally and becoming a bottleneck. Others let go completely and hope for the best. Neither works well. The answer is internal controls: simple, routine processes that allow people to act with genuine ownership while protecting the business from mistakes and misconduct.

The founder of a fast-growing consumer products company has described his approach to operational excellence: trust the team, give department heads full ownership, set clear processes such as fixed payment days, insist on competitive quotations, use a “maker-checker” model, and stay personally aware of compliance obligations. This article expands those principles into a practical set of controls for small and medium businesses in Australia.

Principles first

Give ownership, not just tasks

People perform best when they own an area of work, not when they are told what to do step by step and checked on constantly. In the founder’s company, the head of accounts has complete ownership of the function. The founder does not interfere in daily work. Instead, he set clear processes and reviews outcomes.

Trust, with structure

Trusting people does not mean having no controls. Good controls protect trustworthy employees too, by making it clear that they followed the process and by catching honest mistakes before they become expensive. Controls should be routine and impersonal, applied to everyone equally, so they do not signal distrust of any individual.

Expect updates without chasing

When work is delegated with clear expectations, people should report progress and completion without being chased. If you find yourself constantly following up, the process or expectations need fixing.

Keep strong reviews, not constant supervision

Owners should review results regularly and rigorously, but not stand over people while they work. Strong periodic reviews, combined with good controls, give more assurance than constant interference.

Control 1: A delegation of authority

Write down who can approve what, and up to what amount. A simple table works:

A clear delegation of authority lets people act confidently within their limits and escalate decisions above them. Review it as the business grows.

Control 2: Disciplined purchasing

Obtain competitive quotations

For purchases above a set threshold, obtain at least three quotations from different suppliers before deciding. This protects against overpaying and against favouritism. The founder’s rule was three to four quotations for significant purchases.

Evaluate on both technical and commercial grounds

The cheapest option is not always the best. Evaluate quotations on:

• Technical suitability: does the product or machine meet specifications, quality standards and operational needs?
• Commercial terms: price, payment terms, delivery, warranty, service and running costs.

A common approach is to shortlist options that meet the technical requirements, then choose the best commercial offer among them. For capital equipment, consider total cost of ownership, not just purchase price. The article on cost-benefit analysis explains how.

Use purchase orders

Issue a purchase order for significant purchases, stating what is ordered, the agreed price, quantity and delivery terms. It creates a clear record and avoids disputes.

Match before paying

Before paying a supplier invoice, check that three documents agree:

1. The purchase order: what was ordered, at what price.
2. The goods receipt or delivery record: what was actually received.
3. The invoice: what the supplier is charging.

This three-way match catches overcharging, short deliveries and invoices for goods never received. Many accounting systems can automate it.

Control 3: Scheduled payment runs

Instead of paying bills whenever they arrive, set fixed payment days, such as once or twice a week. The founder’s company processes all payments on Mondays and Fridays, with bills approved each morning as they arrive.

Benefits:

• Efficiency: payments are batched rather than processed one by one throughout the week.
• Control: every payment goes through the same approval and checking process.
• Cash management: you can see total outgoings in advance and plan cash flow.
• Fewer rushed decisions: urgency is the favourite tool of scammers, and fixed payment days reduce pressure to pay immediately.

Control 4: Maker-checker

The maker-checker principle, also called segregation of duties, means that no single person should both initiate and complete a sensitive transaction. One person prepares it (the maker), and another reviews and approves it (the checker).

Examples:

• One person enters supplier invoices and prepares the payment batch. Another approves the batch in the banking platform.
• One person adds or changes supplier bank details. Another independently verifies and approves the change.
• One person prepares payroll. Another reviews it before payment.
• One person processes customer credits and refunds. Another approves them.

Most business banking platforms support dual authorisation, requiring two people to approve payments above a set amount. Use it.

In very small businesses where full separation is impossible, the owner can act as checker for the most sensitive transactions, or use compensating controls such as reviewing bank statements regularly.

Control 5: Protect against payment scams

Payment redirection scams, sometimes called business email compromise, are among the most costly frauds affecting Australian businesses. A scammer impersonates a supplier, often using a hacked or look-alike email account, and asks for payments to go to a new bank account. Variations target payroll, asking for an employee’s pay to go to a different account.

Defences:

• Never change bank details based on an email alone. Call the supplier on a phone number you already hold, not one provided in the email, to verify any change.
• Require maker-checker approval for any change to supplier or employee bank details.
• Be suspicious of urgency, secrecy and requests to bypass normal processes, especially those that appear to come from senior managers.
• Train staff to recognise warning signs.
• Use multi-factor authentication on email and banking.

The Australian Cyber Security Centre and Scamwatch publish current guidance. The article on cyber security basics for small businesses covers wider protections.

Control 6: Reconcile regularly

Bank reconciliation compares the business’s records with bank statements to confirm that every transaction is genuine and correctly recorded. Do it at least monthly, ideally weekly. Unexplained differences should be investigated immediately.

Other reconciliations worth doing regularly:

• Debtors: are customer balances correct, and are overdue accounts being followed up?
• Creditors: do supplier statements match your records?
• Stock: do physical counts match system records? Regular cycle counts catch losses and errors.
• Credit cards and expense claims: are all purchases legitimate and supported by receipts?

Control 7: Standard operating procedures and automation

Document how routine work is done: how purchases are requested and approved, how invoices are processed, how payroll is prepared, how month-end is closed. Standard operating procedures make work consistent, simplify training and make delegation safer.

Provide the tools that make procedures easy to follow, such as accounting software, purchasing systems, approval workflows and automated bank feeds. Automation reduces errors and frees people for more valuable work. The article on choosing an ERP system for a small manufacturer covers larger systems.

Control 8: A compliance calendar

Compliance obligations are easy to miss, and penalties for missing them can be significant. The founder’s advice is that while your team prepares and lodges returns, you must personally know the key dates and understand the main obligations. Sit down regularly with your accountant or tax adviser to understand changes in the rules.

Build a compliance calendar listing every obligation and its due dates. For many Australian businesses, it includes:

• Business activity statements, monthly or quarterly, reporting GST and PAYG withholding and instalments.
• Single Touch Payroll reporting each time employees are paid.
• Superannuation guarantee contributions for employees. Under Payday Super reforms that began on 1 July 2026, employers generally need to pay super at the same time as wages rather than quarterly. Check the ATO’s current guidance.
• Payroll tax, if wages exceed the threshold in your state or territory.
• Workers compensation insurance renewals and wage declarations.
• Income tax returns and any instalments.
• ASIC annual review for companies.
• Industry licences, registrations and certifications.
• Insurance renewals: public liability, professional indemnity, property and others.

Assign an owner for each obligation and a reminder well before each due date. Review the calendar with your accountant at least once a year.

Keep records

The ATO generally requires business records to be kept for five years. Keep invoices, receipts, contracts, payroll records and bank statements organised and accessible, preferably in digital form.

What the owner should keep

As the business grows and you delegate operations, some responsibilities should stay with you. The founder’s view is that owners should retain:

• Key relationships: with major customers, partners, lenders and investors.
• Vision and direction: where the business is going, and why.
• Communication with investors and other major stakeholders.
• Oversight of controls and compliance: not doing the work, but knowing that it is done properly.

Everything else can, with good controls, be delegated.

Signs your controls need attention

• Payments made without approval, or approvals given after the fact.
• Supplier bank details changed without verification.
• Bank reconciliations months behind.
• Missed BAS, super or other compliance deadlines.
• Stock discrepancies that nobody can explain.
• One person who handles all aspects of payments, with nobody reviewing their work.
• The owner approving every transaction personally, causing delays.

Frequently asked questions

Won’t controls slow the business down? Well-designed controls usually speed it up. Clear approval limits mean people stop waiting for the owner to approve small purchases, and fixed payment runs replace constant interruptions. Keep controls proportionate: strict for payments and bank details, light for low-value routine purchases.

What if we only have one person in accounts? Use the owner or another manager as checker for payments and bank detail changes, turn on dual authorisation in the banking platform and review bank statements and reconciliations personally each month. An external bookkeeper or accountant can provide an independent check periodically.

How do I introduce controls without offending long-serving staff? Explain that controls protect everyone, including the people who follow them, and that they apply equally to all, including the owner. Involve staff in designing the procedures, because they often know where the risks lie.

A worked example

A precision engineering business has grown from 8 to 35 employees. The owner still approves every purchase and signs every payment, and is working evenings to keep up. Last year, the business narrowly avoided paying a fake invoice that arrived from an email address almost identical to a regular supplier’s.

With help from the accountant, the owner:

• writes a delegation of authority table, allowing the operations manager to approve purchases up to $20,000;
• introduces a three-quote rule for purchases above $5,000, with technical and commercial evaluation recorded;
• moves to twice-weekly payment runs, with the accounts officer preparing batches and the operations manager or owner approving them in the bank’s dual-authorisation system;
• requires a phone call, using a known number, to verify any change to supplier bank details;
• has the accounts officer complete bank reconciliations every Friday, reviewed monthly by the owner;
• builds a compliance calendar in the shared calendar, with an owner and reminders for every obligation.

Within three months, the owner’s evenings are free, payments are on time, purchasing costs fall because quotations are compared consistently, and a second attempted payment scam is stopped at the verification call.

Summary

Internal controls let growing businesses delegate safely. Give people ownership within a written delegation of authority. Require competitive quotations and evaluate them on technical and commercial grounds. Use purchase orders and three-way matching. Process payments on fixed days. Apply maker-checker to payments, bank detail changes, payroll and credits, and verify bank detail changes by phone. Reconcile bank accounts, debtors, creditors and stock regularly. Document procedures and automate where possible. Keep a compliance calendar, know the key dates yourself and keep records for at least five years. Retain relationships, vision, investor communication and oversight, and delegate the rest with confidence.

---

Sources: small-business training notes on operational excellence shared by a consumer products founder, together with general Australian small-business finance and compliance practice. Requirements change, so confirm current obligations with the ATO, ASIC, your state revenue office and your accountant. This article is general information, not financial, tax or legal advice.