Internal controls documentation

The core deliverable is a control matrix: one row per control, columns for the process it belongs to (close, AP, AR, payroll), the control owner by name or role, the frequency (transaction-level, daily, monthly, quarterly), the type of evidence it leaves (a sign-off email, a system approval log, a reconciliation tie-out), and a plain-language description of what actually happens. Alongside the matrix, each major cycle gets a short process narrative, typically one to two pages, that a new hire or an outside reviewer could read and understand without a walkthrough call.

We also produce a segregation-of-duties review specific to your access setup in QuickBooks Online, Xero, NetSuite, or Bill.com, showing who has create, approve, and reconcile permissions across vendor records, bill payment, and bank reconciliation. Where one person holds an incompatible combination, we note it against the control matrix rather than leaving it as a separate, easy-to-ignore memo.

We open with a scoping call to understand your current systems, headcount, and any existing policy documents, even outdated ones, since they show what the business intended even if practice has drifted. Interviews with whoever actually performs each step follow: the person who codes a bill, the person who approves it, the person who reconciles the account. We do not rely solely on a manager's description of how the process runs, because that description and the actual practice diverge more often than either side expects.

A draft matrix and narrative set goes back to your team for correction, since only the people doing the work can confirm we captured it accurately. After that review round, we finalize the document, log it with a version number and date, and walk your controller or CFO through the gaps we flagged along with a proposed fix for each one, sized to your headcount rather than copied from a Fortune 500 controls library.

Companies heading into a first external audit, a Series A or later diligence process, a bank covenant review, or SOC 2 readiness are the most common fit, because each of those counterparties will ask the same underlying question in a different wrapper. Nonprofits preparing for a single audit under 2 CFR 200 also need this, since the control environment around federal award spending gets specific scrutiny in that context.

It is also worth doing before any of those triggers exist. A company with ten to thirty employees and no written controls is usually fine day to day. The risk shows up the first time someone new joins finance, a system gets replaced, or a dollar figure moves that nobody can immediately explain, and there is no document to point to.

The most frequent finding across engagements is one person holding vendor-create, payment-approval, and bank-reconciliation access at the same time, usually because the company started with one bookkeeper and never revisited access as headcount grew. Close behind that is a manual journal entry process where the person recording an adjusting entry also approves it, with no second reviewer before it posts to the general ledger.

Payroll is another recurring gap: whoever runs payroll in Gusto or ADP frequently also has the ability to change their own pay rate or add themselves as a new employee, without a compensating review catching that specific combination. We also see stale user access, former employees or contractors who still have login credentials to the accounting system months after they left, which is one of the easiest findings for an auditor or examiner to flag and one of the cheapest to fix.

We document controls inside whatever system you already run: QuickBooks Online or Xero for the general ledger, Bill.com for AP approval routing and vendor payment workflows, and Excel for the matrix and narrative deliverables themselves, since most auditors expect that format and it stays portable regardless of which accounting platform you use next. Where payroll runs through Gusto, ADP, Rippling, or Deel, we review the access and approval settings inside that specific platform rather than assuming a generic payroll control applies uniformly.

Nothing about your existing subscriptions changes. We work inside your login, under access you grant and can revoke, and the finished document belongs to you, not to a proprietary platform we control.

This engagement is scoped separately from ongoing monthly bookkeeping because the work is front-loaded: interviews, drafting, and a review round happen over a defined window rather than every month. Cost depends mainly on how many process cycles need documentation, revenue, purchasing, payroll and cash disbursement are the most common, and how many systems and approval steps sit inside each one. A single-entity business running one accounting platform with straightforward approvals costs less to document than a multi-location business with several systems, manual sign-off steps, and no consistent approval trail to start from. See the pricing note below for how to get an exact figure once we understand your process count.

A finished control matrix should let someone outside your finance team, an auditor, a lender's credit analyst, or a new controller, answer three questions without a follow-up call: who approves what, how often each control runs, and what evidence proves it happened. If a reviewer still needs to ask 'but who actually does this in practice,' the narrative was not specific enough, and we treat that as a defect to fix, not a normal caveat.

We also track how many gaps flagged in one engagement recur unresolved at the next review cycle. A gap that stays open for a year despite being written down plainly is a signal the fix we proposed did not fit how the team actually works, and we revise the recommendation rather than repeat it.