Audit support
Internal controls documentation
Internal controls documentation from Finbryn writes down how your close, payroll, AP and AR processes actually run: who approves what, how often, and where duties are split. We draw on Single Touch Payroll and compulsory super (SG) approval records; any formal opinion on those controls comes from a registered auditor.
Auditor request list
Illustrative client · August 2026
AUD
- Trial balance and general ledger exportDone
- Bank confirmations and statementsDone
- Receivables and payables listingsDone
- Fixed asset register with additionsIn progress
- Accruals and prepayments supportNext
Illustrative. An example of the document, not a client's figures.
What a reviewer actually asks
An Australian lender, funder or first-time auditor rarely questions whether controls exist. They ask how a specific one works: who approved this payment run, who reconciled that account, who could raise and approve the same invoice unsupervised. If the honest answer lives in one person's head, that is worth finding first.
Payroll and super, specifically
Single Touch Payroll Phase 2 reporting and compulsory super (SG) contributions each carry their own approval trail. We document who checks the STP submission before it lodges and who authorises the super payment run, since that pairing is exactly what a payroll-cycle control review looks for.
Segregation of duties in a small team
Lean finance teams often run with one person able to create a vendor, approve a payment and reconcile the account it hits. We flag that concentration plainly and suggest a practical fix, such as a second approver above a set payment threshold, rather than a checklist entry nobody acts on.
What this is not
Writing the controls down is not an assurance opinion or a certification that they operate effectively over time. Where that determination matters, it comes from an ASIC-registered auditor or ACNC-approved reviewer working to the applicable standards. A written control matrix does, however, give your board or audit committee something concrete to review each year, rather than a verbal assurance that everything is fine.
This feeds SOC readiness bookkeeping for companies pursuing a US-style examination and working papers when a reviewer wants evidence of how a control actually runs.
Questions
Frequently asked questions: Internal controls documentation
Is documenting controls a legal requirement for a small Australian business?
No single law requires it at small scale, but a lender, investor or first-time auditor will often expect to see it, and it is far easier to write down before a problem forces the question.
Do you cover superannuation and Single Touch Payroll approvals specifically?
Yes. We document who checks the STP submission and who authorises the linked compulsory super (SG) payment, since payroll controls are one of the areas a reviewer checks first.
Will you tell us about a gap even if it is uncomfortable?
Yes. A gap we do not flag is a gap your reviewer will find instead, so we write it down along with a workable fix.
Do you implement the fix, or just document the gap?
We document the process, the matrix and a practical fix. Building a new approval step inside your systems is done together with whoever owns that software.
Who decides which controls actually get documented?
We document the controls you already run, such as approval limits and segregation of payment duties, and flag gaps for your decision. We do not impose controls your business has not agreed to operate.
Is this a certification of our controls?
No. We document how controls actually work today and flag gaps; any formal attestation or opinion comes from an independent, credentialed auditor you engage separately.
Do we need this if we are a small company?
Even a lean team benefits from writing down who approves what. It shortens the questions an auditor or lender asks and reduces the risk of a single person controlling a whole process.
How do we get started with internal controls documentation?
Getting started with internal controls documentation begins with a short review of your current records and software access. Once that is done we confirm scope and timing in writing, and ongoing work begins on the schedule agreed with you.
What if our records for internal controls documentation are not up to date?
If your records are behind, we scope a catch-up first so internal controls documentation starts from a clean, reconciled base. That catch-up is priced and timed separately from the ongoing engagement, so you always know what each part costs.
Related services
- Audit supportWorking paper preparationSupporting schedules and reconciliations built the way an auditor expects to see them, cross-referenced to the trial balance, so review comments come back with fewer open questions.
- Audit supportSOC readiness bookkeepingFinancial recordkeeping and evidence-gathering support for companies preparing for a service-organization examination, keeping the accounting-side documentation consistent while the technical control work is led by your security team or examiner.
Industries
Next step
Talk to the team that would run your books
A short call covers your setup, your software and what a first month would look like. You get a written scope and price after it.