Internal audit for small and mid-sized business: where to start

For a small-business owner, the word "audit" usually triggers one of two reactions: "that's for big corporations" or "that means someone is checking on someone else and looking for who's to blame." Both reactions get in the way of seeing how useful internal audit is for a small business — and how much simpler it is to put in place than it seems.

Internal audit is a systematic check of whether the company's processes work the way they're supposed to: whether money is spent as intended, whether accounting data matches reality, and whether there are gaps through which the business is losing money unnoticed.

In this article we'll cover what internal audit really means in a practical, non-corporate sense, where small businesses most often run into problems, and how to build a simple but effective control system without a staff of auditors.

What internal audit actually is

Internal audit is a regular, systematic review of a company's financial and operational processes aimed at uncovering deviations, risks, and opportunities for improvement.

It's important to distinguish three related but different things:

Accounting records what happened. It answers "how much did we earn and spend."

Internal control is a system of rules and procedures that prevent errors and fraud before they happen. For example, the rule "no payment over EUR 250 is executed without two signatures."

Internal audit is the check on whether internal control and accounting actually work the way they were designed to. The auditor doesn't execute operations — they check whether operations are being executed correctly.

In plain words: accounting says "we spent EUR 1,500 on marketing." Internal control says "any marketing expense over EUR 150 must be approved by a manager." Internal audit checks: was every expense over EUR 150 actually approved? Are there cases where the rule was broken?

Why a small business needs audit no less than a large one

A common myth is that internal audit is only for big companies with complex structures. In fact, a small business is in some ways more vulnerable.

Less separation of duties. In a large company, functions are split: one person issues invoices, another processes payments, a third reconciles the bank. In a small business, the same person (often the owner or the bookkeeper) does everything. This creates a natural risk of errors and abuse — not because of bad intent, but because there is no one else to verify the work.

Fewer formalized processes. "We run on trust here" is a typical small-business line. But trust is not a control system. It works until it doesn't, and when it stops working, losses are discovered after the fact, often at a meaningful amount.

Smaller margin for error. A large company can lose EUR 50,000 to inefficiency and not notice it against billion-euro turnover. For a small business, EUR 50,000 in losses can be the difference between a profitable and a loss-making quarter.

Fast growth masks problems. If a business grows 30–40% per year, small cash leaks and inefficiencies are often invisible — the overall numbers still look good. The problem surfaces only when growth slows.

Where problems most often arise: nine risk areas

Based on experience with small and mid-sized businesses, there are several areas where problems most often occur. Let's go through each one — with an example and what to check.

1. Cash and bank transactions

Typical problems: payments without proper approval, duplicate payments of the same invoice, cash transactions without documentation, the owner's personal expenses booked as business expenses without a clear boundary.

What to check: monthly bank-statement reconciliation against the books, supporting documents for every payment above a defined threshold, analysis of duplicate payments (same amount, same recipient, close dates).

Practical example: at a trading company we found that over three months the same supplier was paid twice for the same invoice — the purchasing manager wasn't checking whether an invoice had already been paid before initiating a new payment. The amount, around EUR 2,500, was recovered only after directly contacting the supplier.

2. Receivables and payables

Typical problems: "forgotten" receivables that nobody collects; payments to suppliers earlier than required (a missed opportunity to hold cash longer); the lack of an up-to-date receivables/payables register.

What to check: a monthly register of receivables and payables broken down by aging buckets; reconciliation with counterparties at least once a quarter; a check that every overdue invoice has an action plan.

3. Inventory and physical goods

Typical problems: discrepancies between book and physical stock; poor-quality write-offs of defects or losses without documentation; "leakage" of goods without recording (internal transfers between points of sale that bypass the system).

What to check: regular (quarterly, or monthly for expensive items) physical counts; comparison of book vs. physical balances; analysis of the reasons behind any variance above the accepted tolerance.

Practical example: a chain of three stores discovered during a scheduled count that physical inventory at one location was 12% below the book figure. The investigation revealed a systemic problem: a salesperson was recording part of the sales without a fiscal receipt and pocketing the difference. Without regular inventory counts, this could have continued for years.

4. Procurement and supplier selection

Typical problems: purchases at inflated prices because no alternative quotes are compared; conflicts of interest (buying from a company linked to an employee); no formal process for approving large purchases.

What to check: for purchases above a defined threshold — at least two alternative quotes on file; supplier screening for ties to employees; regular review of prices for recurring purchases (is the agreed price still aligned with the market?).

5. Payroll and HR

Typical problems: "phantom" employees (salary still paid to someone who no longer works there); incorrect calculation of bonuses or premiums; the lack of accurate time-tracking for variable roles.

What to check: monthly reconciliation of the payroll list against the actual headcount; analysis of calculations against approved salaries and terms; sample checks of the justification for bonuses.

6. Access and permissions in accounting systems

Typical problems: former employees retain access to bank accounts or accounting systems; over-broad permissions (the bookkeeper can both enter and approve transactions without an additional check); no audit log of changes inside the accounting system.

What to check: a quarterly review of users with access to critical systems; the segregation-of-duties principle — the person entering a transaction should not be the one approving it; the existence of a system change log.

7. Corporate cards

This is one of the most underrated risk areas in small and mid-sized businesses. A corporate card brings speed and convenience — but that same convenience often means card spend is controlled far more loosely than ordinary payments processed through the accounting team.

Typical problems: personal expenses booked as business expenses (cafés, taxis, purchases with no clear link to work); missing receipts or supporting documents for part of the transactions; vague or absent category limits; multiple cards issued to a single employee with no consolidated view; spend deliberately "split" into small amounts to stay under the approval threshold.

What to check: a monthly reconciliation of every card transaction against a supporting document (receipt, invoice, bill); analysis of the spending structure by category — does it match the employee's role and tasks; verification of limits and whether they are being systematically exceeded; spot-checking the date and location of transactions against the employee's work schedule and trips.

Practical example: at a service company a regular review of corporate-card statements showed that a sales manager was using the card every month to pay for streaming subscriptions and home food delivery — around EUR 80 a month, hidden inside business travel expenses. Small in absolute terms, but telling: without regular reviews, these expenses accumulate for years and quietly eat into margin.

Practical recommendation: put in place a clear corporate-card policy — which expense categories are allowed, what the limit per transaction is before extra approval kicks in, and the deadline for providing supporting documents after payment (for example, 3 business days). Without a written policy, every review turns into an argument about "but I was told it was fine."

8. Correctness of cash movement

A separate and very important audit area is the logic and sequence of money movement across the company as a whole, rather than the amount of individual transactions. What matters here is not "how much did we spend," but whether the money moved the way it was supposed to.

Typical problems: transfers between company accounts and related parties (the owner, other legal entities in the group) without clear documentation; money that "disappears" in one period and "reappears" in another with no clear explanation; mismatch between the date a transaction is recognized in the books and the actual date of cash movement; payments that loop between several accounts with no obvious economic purpose.

What to check: building a full map of cash movement for the period — from which account to which, for what purpose, on the basis of which document; verifying that every large inbound and outbound payment has a clear economic rationale; reconciling opening and closing balances on all accounts at the same time (not selectively on one); analyzing any transfer between related legal entities or individuals — is it backed by an agreement, and is it reflected correctly in both parties' books.

Why this is critical: it's precisely in the movement of cash between accounts, legal entities, and related parties that accounting errors or deliberate manipulation most often hide. A transaction with goods or a service always leaves a trail (a delivery note, an act of acceptance), but a plain money transfer is easier to mask or forget to document. So regularly checking the correctness of cash movement means checking the reason behind every material transfer, not just its amount.

9. Document flow and archiving

Typical problems: missing originals for material transactions; lost or incomplete contracts; discrepancies between contract terms and actual settlements.

What to check: a complete document package for a sample of transactions (invoice, act, contract, payment); systematic document storage (physical or in the cloud) with the ability to retrieve documents quickly.

How to build a simple internal-audit system

Now the practical part. You don't need to hire a team of auditors or implement corporate standards. Here is a step-by-step approach that fits a team of up to 50 people.

Step 1. Identify the highest-risk areas for your business

Not all nine areas above are equally critical for every business. For retail, the highest risk is inventory and cash. For a service company, it's receivables and procurement. For manufacturing, it's inventory and raw-material procurement.

Pick the 2–3 areas where the potential losses are biggest, and start there.

Step 2. Set simple control rules

For each risk area — a minimum set of rules you can actually enforce. Examples:

• Any payment above EUR X requires sign-off from two people
• No invoice is paid without a check that it hasn't already been paid before
• Inventory count — monthly for category A items (most expensive / fastest moving), quarterly for the rest
• The list of users with bank access is reviewed quarterly
• No employee approves their own expenses or bonuses

The rules have to be simple and written down — not "in the owner's head," but in a document accessible to the people responsible.

Step 3. Assign an owner and a cadence

In a small business, internal audit doesn't require a dedicated role. It can be:

• The owner personally (for a very small business)
• A finance manager or controller who is not involved in the operational processes being reviewed
• An external consultant on a regular basis (once a quarter)

Core principle: the person performing the review must not be the same person performing the operation being reviewed. If the bookkeeper approves their own payments, they cannot be the auditor of their own work.

Step 4. Build a checklist

The checklist is the single most important tool. Without it, a review degenerates into "let's look around and see if things look fine" — which is not an audit.

Example of a simplified monthly checklist:

• ☐ Bank-statement reconciliation against the books — are all transactions recorded?
• ☐ Check for duplicate payments in the period
• ☐ Receivables register — anything overdue > 30 days?
• ☐ Payables register — nothing missed for payment?
• ☐ Payroll list = actual headcount?
• ☐ Sample 5 random payments — full document package on file?
• ☐ Review of bonuses/premiums for the period
• ☐ Corporate-card reconciliation — supporting documents in place?
• ☐ Transfers between related accounts / legal entities — is there a rationale?

Example of an extended quarterly checklist (on top of the monthly one):

• ☐ Full inventory count and reconciliation with the books
• ☐ Reconciliation with key counterparties (signed reconciliation acts)
• ☐ Review of users with access to the bank and accounting systems
• ☐ Review of prices on recurring purchases — still in line with the market?
• ☐ Verification of alternative quotes for large purchases during the quarter
• ☐ Review of write-offs and defects — documented?
• ☐ Cash-flow map between all accounts — is the logic of every transfer clear?
• ☐ Analysis of corporate-card spend by category for the quarter

Step 5. Document findings and actions

Every review should end with a short report: what was checked, what was found, what actions were taken. Not for bureaucracy — but to see the trend. If the same issue keeps coming up every quarter, what's needed is a process change, not a one-off fix.

Auditing financial statements: a separate but related process

In addition to operational audit (described above), it's worth mentioning the audit of the financial statements themselves — how well P&L, Cash Flow, and the balance sheet reflect reality.

What to check in the statements:

Consistency between reports. Net income from the P&L should logically tie back to the change in cash on the Cash Flow (accounting for non-cash items). If the statements don't "talk to each other," there's an error somewhere.

Logical dynamics. If gross margin suddenly jumps from 35% to 55% with no obvious reason, that's a cue to check whether expenses for the month were classified correctly.

Completeness of expense recognition. Are all invoices for the period included, even if they haven't been paid yet? A classic mistake is recognizing only paid expenses and ignoring accrued ones, which distorts the real profitability of the period.

Consistency of the accounting policy. Are similar transactions classified the same way month after month? If in January marketing went into OpEx and in February part of it ended up in COGS without any change in the business logic, that's a sign of carelessness in the books.

Red flags to check immediately

Some signals point to elevated risk and deserve an immediate review rather than waiting for the next scheduled audit:

A sudden change in a counterparty's behavior. A supplier who worked on standard terms for years suddenly insists on cash payment or routing through a new company.

Unusual payments at the end of the reporting period. Large amounts wired on the last day of the month or quarter, especially to new or infrequent recipients.

Resistance to transparency. The employee responsible for a process avoids providing documents, postpones reconciliations, and reacts defensively to standard questions.

Recurring discrepancies. If the same discrepancy comes up every month "for technical reasons," dig deeper instead of writing it off as a "system glitch."

An employee who never takes vacation. A classic feature of fraud stories: the person who controls a critical process never goes on leave because "there's no one to hand things over to." This often means the process is undocumented and opaque to others.

How much time this actually takes

Small-business owners often avoid setting up internal audit, viewing it as additional bureaucratic load. In practice, a systematic approach saves time in the long run.

Monthly checklist (baseline): 2–4 hours for a team of up to 20 people. Bank reconciliation, receivables/payables review, sample document checks.

Extended quarterly audit: 1–2 working days, including inventory count (if physical stock is held).

Compare this with the cost of an undetected problem. Losing 5% of turnover to undetected fraud, inefficient procurement, or accounting errors — for a business with EUR 150,000 in annual turnover, that's EUR 7,500. A few hours of monthly review cost meaningfully less.

When to bring in an external auditor

Self-run internal audit is fine for regular, operational control. But there are situations where an external specialist is worth bringing in:

• Before raising investment or selling the business (due diligence)
• If there is suspicion of serious fraud and a legally defensible, independent review is required
• Once every year or two — for a fresh, unbiased look at processes that those inside no longer notice
• During significant growth, when internal processes haven't caught up with the new scale

An external auditor doesn't replace regular internal control — they complement it with a periodic independent review.

Bottom line: audit as a habit, not an event

The most important idea in this article: internal audit is effective when it becomes a regular habit, not a one-off campaign of "let's check everything after something happened."

Start small: identify the 2–3 highest-risk areas, set simple control rules, assign an owner, build a checklist, and stick to a cadence. It doesn't require large resources — but it gives the owner confidence that the business is working the way it should, not just the way it appears at first glance.

Regular reviews let you catch problems before they become expensive.