When an owner-managed business grows, controls that depended on the promoter's personal attention stop working, and the gaps usually come to light during the year-end audit. The weak points tend to be payments, sales adjustments, inventory, manual journals and system access. The remedy is to record how work is really done, make sure no key process rests on one person, and add checks in proportion to the risk.
Why do controls weaken as a business grows?
In the early years, the owner is the control. In a unit with one factory and one bank account, the promoter often sees every purchase order and would spot an odd payment immediately.
Expansion changes this. A second unit opens, a branch starts in another district, and several staff are given net-banking rights. The promoter's attention is spread across more places, and nothing formal takes its place. Because those checks were never written down, nobody notices when they stop.
How do control gaps show up at the year-end audit?
From the auditor's side, weak controls appear as unexplained balances and transactions without a clear approval trail. Common examples:
- Payments. One accounts executive creates the supplier, approves the bill and releases the payment. Approvals are given orally or on a messaging app, leaving no record.
- Sales adjustments. Credit notes and discounts are passed without a consistent sign-off, and supplies continue to customers who are over their credit limit.
- Inventory. Physical verification happens rarely, and differences between book stock and physical stock are written off with no explanation.
- Journals. Manual entries are posted in the last days of the year with nobody reviewing them.
- System access. Staff share one login to the accounting software, or people who have left can still sign in.
These are often raised with management as audit observations, and are harder to resolve once the books have closed.
Why is it risky when only one person knows a process?
Many growing businesses have a long-serving accountant who alone knows how to prepare the stock statement for the bank or reconcile the supplier ledgers. This affects the reliability of the accounts as well as staffing: nobody else can catch that person's errors, and if they leave, the business may struggle to explain its own figures to the auditor.
A written note of the steps, and a second person who reviews or performs the task from time to time, reduces both risks.
Where should a business start?
Pick one process and follow a few real transactions from beginning to end. For each one, ask who raised it, who approved it, what document supports it and where it was recorded. Compare the answers with how management believes the process works. The difference between the two is where the risk usually sits.
Record what you find in a one-page table: the risk, the check that addresses it, who performs the check, how often, and what evidence it leaves.
How many controls are enough?
Every approval adds time. The aim is to cover the risks that would matter if something went wrong, and leave the rest. Measures that often prove useful:
- written approval limits for each role, with a value ceiling for each;
- changes to supplier details, especially bank accounts, made by someone who cannot release payments;
- a monthly look at out-of-pattern items, for instance large credit notes, journals posted after closing and edits to bank details;
- written procedures for any task that currently depends on one person.
What will banks, investors and auditors look for?
A lender reviewing stock and receivables statements, an investor carrying out due diligence and an auditor testing transactions are all asking whether the numbers can be relied on. Closing the gaps before those questions arrive takes less effort than explaining them afterwards, and it gives the owners figures they can trust for their own decisions.