Audit support
Internal controls documentation
Internal controls documentation from Finbryn writes down how your close, AP, AR and payroll source-deduction processes actually run today: who approves what and how duties are split. Our accounting team builds the control matrix and flags gaps in plain language; any formal opinion on those controls comes from a licensed CPA.
Auditor request list
Illustrative client · August 2026
CAD
- Trial balance and general ledger exportDone
- Bank confirmations and statementsDone
- Receivables and payables listingsDone
- Fixed asset register with additionsIn progress
- Accruals and prepayments supportNext
Illustrative. An example of the document, not a client's figures.
Why a Canadian reviewer asks about controls
A lender or a first-time auditor rarely asks whether controls exist in the abstract. They ask who approved a specific EFT payment, who reconciled the GST/HST return before it was filed, or who could enter and approve the same journal entry unsupervised. If the answer lives only in one person's head, that is the gap worth finding before they do.
We walk your finance team through the close, AP, AR and payroll cycles, including how source deductions get remitted to CRA, then write process narratives describing what actually happens today, not an idealized version of it. A control matrix follows, listing each control, its owner and how often it runs.
Segregation of duties in a small Canadian team
Many private companies here have one person who creates a vendor, approves the EFT, and reconciles the bank account it hit. We flag that concentration plainly and suggest a workable fix, such as a second approver above a set dollar threshold, rather than a checklist line nobody acts on.
What this is and is not
Writing down your controls is not an attestation or a formal opinion on whether they operate effectively. That determination, where a reviewer needs one, comes from a CPA licensed in your province, not from the documentation itself.
This work feeds directly into SOC readiness bookkeeping for companies serving customers who demand it, and into working papers whenever a reviewer wants evidence of how a specific control operates.
Keeping the document current
A controls document written once and left untouched stops being accurate the first time a system changes or someone leaves the finance team. We keep the file version-controlled so it can be updated as your business grows, instead of rediscovering the same gaps at the next review.
Questions
Frequently asked questions: Internal controls documentation
Is this required for a small private Canadian company?
No law requires it at small scale, but a lender or first-time auditor often expects to see it, and it is easier to write down before a gap forces the question.
Will you flag a control gap even if it is uncomfortable to raise?
Yes. A gap we do not flag is one your reviewer or bank will find instead, so we write it down plainly with a practical fix attached.
Do you cover payroll source deductions in this documentation?
Yes. The control narrative covers how source deductions are calculated, approved and remitted to CRA, alongside the close, AP and AR cycles.
What exactly is included in internal controls documentation?
Process narratives for the financial close, AP, AR and payroll cycles, and a control matrix listing each control, its owner and how often it runs. This work runs inside Excel or QuickBooks Online, whichever your business already has in place, and it rolls into your regular monthly close rather than sitting off to the side as a separate, unreconciled process.
What happens to our internal controls documentation records if we switch providers?
Everything stays inside your own Excel or QuickBooks Online account, so the full history transfers with the subscription, not with Finbryn. You can hand internal controls documentation to another provider or bring it in-house at any point without losing a reconciliation or having to rebuild the file first.
Is this a certification of our controls?
No. We document how controls actually work today and flag gaps; any formal attestation or opinion comes from an independent, credentialed auditor you engage separately.
Do we need this if we are a small company?
Even a lean team benefits from writing down who approves what. It shortens the questions an auditor or lender asks and reduces the risk of a single person controlling a whole process.
How do we get started with internal controls documentation?
Getting started with internal controls documentation begins with a short review of your current records and software access. Once that is done we confirm scope and timing in writing, and ongoing work begins on the schedule agreed with you.
What if our records for internal controls documentation are not up to date?
If your records are behind, we scope a catch-up first so internal controls documentation starts from a clean, reconciled base. That catch-up is priced and timed separately from the ongoing engagement, so you always know what each part costs.
Related services
- Audit supportWorking paper preparationSupporting schedules and reconciliations built the way an auditor expects to see them, cross-referenced to the trial balance, so review comments come back with fewer open questions.
- Audit supportSOC readiness bookkeepingFinancial recordkeeping and evidence-gathering support for companies preparing for a service-organization examination, keeping the accounting-side documentation consistent while the technical control work is led by your security team or examiner.
Industries
- Startups and VC-backed companiesBookkeeping and reporting for early-stage, venture-backed companies watching burn, runway and investor reporting closely.
- SaaSBookkeeping and reporting for subscription software businesses tracking recurring revenue, deferred revenue and burn.
- Professional servicesBookkeeping for professional service firms such as engineering, architecture and IT consulting billing clients by project or retainer.
Next step
Talk to the team that would run your books
A short call covers your setup, your software and what a first month would look like. You get a written scope and price after it.