One person takes the money, records it and reconciles it

The problem it solves

Nobody has to be under suspicion for the exposure to be visible. The company grew and the handling of money stayed where it was when there were four people: whoever invoices receives the payment, records it, and reconciles the account at month end. Nobody designed that arrangement and nobody has revisited it; it simply stayed, the way things stay when they work while a company is small.

What surrounds it is equally familiar. The owner signs without looking at the document behind the payment, because the person preparing it is trusted and pausing to check would feel like a statement about that person. Passwords are shared so the work does not stop during a week off. And that same person has gone years without taking a full holiday, because nobody else knows how the process runs, a fact that in any other area would immediately be read as a continuity risk.

There are two costs and both are real. One belongs to the company: an error nobody reviews looks exactly like an irregularity and stays invisible for exactly as long. The other falls on the person: whoever controls the entire cycle carries a suspicion they could not disprove if money ever went missing, however blameless they are. And on the day they leave, the company discovers that nobody knows how its own money moves.

What it covers

The workshop starts with the map, because controls designed without one end up protecting what was already protected. In a group exercise each company draws how money comes in, whether as cash, transfer, field collection or advance, how it goes out, and who holds the inventory, the petty cash and the assets. On that drawing the group marks the points where one person performs functions that ought to sit apart from each other.

The second block tackles the real problem of a small company: separating duties when the team is three people. The answer is not to hire, it is to compensate. Controls are designed to scale, such as the owner opening the bank statement first, every new supplier and every change of deposit account passing a second pair of eyes, the reconciliation being reviewed by someone other than whoever prepared it, and one task rotating. Each control is judged by what it costs to sustain, because a control that interrupts the operation does not survive the first busy month.

The third block covers approval limits, dual signatures and access to systems, passwords and signatures, which is the part that decays fastest whenever someone joins or leaves. It also treats reconciliation as a control rather than a chore, with the questions of who performs it, who reviews it, and what happens to items that have been sitting unresolved for months.

The closing block defines the periodic review the owner performs and does not delegate, short enough to be sustainable, and rehearses it through scenario analysis on a control that quietly stopped working: exceptions that became routine, a reconciliation always done at the last minute, an account only one person can explain. This is management education. It designs controls going forward and does not constitute an audit or an investigation, neither of which ALUD performs.

What participants learn

• Map how money, inventory and assets come in, go out and are held.
• Design compensating controls that separate duties inside a small team.
• Establish approval limits and second-pair-of-eyes review.
• Implement access control over systems, signatures and passwords.
• Identify the signs of a control that has stopped working.

Agenda

1. 01Mapping the money: in, out and held
2. 02Separating duties when the team is three people
3. 03Compensating controls and cross-review
4. 04Approval limits and dual signatures
5. 05System access, passwords and signatures
6. 06Reconciliation as a control, not a chore
7. 07The periodic review the owner does not delegate
8. 08What internal control does not replace

What the organisation leaves with

• Your company's money map: what comes in, what goes out, what is held, and who takes part at each point.
• A table of incompatible duties with a compensating control assigned to each one.
• Written approval limits and a register of access, signatures and passwords with an owner against each entry.
• The owner's periodic review defined: what gets looked at, how often, and what happens when something does not add up.