Internal control in a small public entity: proportionate, not paperwork

In a small public entity or a project unit of a few people, internal control has a bad reputation. It evokes thick procedure manuals, forms in triplicate and signatures that nobody reads. When the manual is copied from a large administration, the team soon finds it cannot apply it, and starts working around it. The entity then has the paperwork of a control system without the protection.

A proportionate approach starts from the other end: a few risks that really matter, and a few controls that are actually performed.

Start from the risks, not from the manual

Before writing any procedure, list what could seriously harm the entity: a payment made for a service never delivered, a contract awarded without competition, cash or equipment that disappears, a deadline missed with a funding partner. A half-day workshop with the people who run the processes is usually enough to identify the ten or so risks that deserve attention.

A few strong controls rather than many weak ones

For each important risk, one or two well-placed controls are worth more than a long checklist. A payment is released only when proof of delivery is attached and checked by someone other than the person who ordered. The bank reconciliation is done every month and reviewed by the manager. Equipment above a certain value is recorded and counted once a year. These controls are simple, but they must be performed every time.

Segregation of duties with a small team

The classic objection is that a team of four cannot separate every duty. That is true, and it is not required. What matters is that no single person can carry out a sensitive operation from start to finish without anyone else seeing it. When roles cannot be split, compensating controls take over: a monthly review of payments by the coordinator, a second signature above a threshold, an independent look at the bank statements.

Evidence that a control was performed

A control that leaves no trace cannot be shown to an auditor, and is easily skipped on a busy day. The evidence should be light: a dated initial on the reconciliation, an approval in the accounting system, a short monthly checklist signed by the reviewer. Its purpose is to make the control part of the routine, not to produce paper.

A scenario to illustrate

Fictional scenario, written for teaching purposes. A small agency of twelve staff adopts the procedure manual of its parent ministry, written for a much larger organisation. Within a year, most forms are filled in after the fact, and the accountant both prepares and records payments because the second signatory is often travelling. An audit finds several payments without proof of delivery. The agency replaces the manual with a short list of key risks and eight controls, introduces a monthly payment review by the director and an electronic approval when the signatory is away. The next audit finds the controls performed and documented, with less paper than before.

Five questions for your entity

• Which ten risks would seriously harm the entity if they occurred?
• For each one, which control is actually performed, and by whom?
• Can any person carry out a payment from start to finish alone?
• What compensating controls exist where duties cannot be split?
• What evidence shows that each key control was performed last month?

To go further

Our programs Designing an internal control system and Building and using a risk map start from participants’ own processes. For an outside view of your current system, see our assessments and diagnostics.