Internal Controls for Small Teams: Splitting Duties With One Bookkeeper

In many small companies, one bookkeeper issues invoices, chases customer payments, records every transaction, prepares supplier transfers and reconciles the bank account. The owner approves or signs whatever arrives. This is fast, and it does not mean anyone is dishonest. But no step has a second pair of eyes, so errors linger, and if someone does intend to steal, nothing in the system will surface it quickly.

A small company cannot hire extra staff just to separate duties the way a large one does. It can move a few steps to the owner and add compensating controls for what cannot be separated. This article covers the four duties that should not sit with one person, a sample task split between bookkeeper and owner, compensating controls that work in practice, and what the owner should check personally in about 30 minutes a month.

Four duties that should not sit with one person

Segregation of duties means arranging work so that one person's work is checked by another. The Minnesota Office of the State Auditor in the United States puts it plainly: no single person should be able to authorize a transaction, record it in the books and obtain custody of what results from it, because that person could commit an irregularity and cover it up. Its examples include having different people sign checks and reconcile the bank accounts. In a small company, money work splits into four duties.

• Authorization: deciding whether a transaction should happen, such as purchases, payments, new suppliers, special discounts and credit notes.
• Custody: actual access to money or goods, such as releasing transfers in internet banking, holding petty cash, keeping the checkbook or controlling the warehouse.
• Recording: entering transactions in the accounting software and editing master data, such as the supplier list, supplier bank accounts and the employee list.
• Reconciliation: comparing what was recorded with reality, such as bank reconciliations, cash and stock counts, and exception reports.

The most dangerous combination is a person who can move money and who also records the books and reconciles the bank. An illustrative example: the bookkeeper transfers 38,500 baht to an account they control and records it as a raw material payment to a supplier. The books match the bank statement to the baht, so the reconciliation finds nothing, because the person checking is the person who did it.

Why small teams should care

Occupational Fraud 2026: A Report to the Nations, published by the Association of Certified Fraud Examiners (ACFE) in May 2026, analyzed 2,402 cases of fraud committed by people inside their own organizations across 143 countries and territories. The findings most relevant here:

• The median loss was $104,000 per case, and the median scheme lasted 12 months before detection.
• Fraud detected within the first six months had a median loss of $40,000, while schemes lasting more than five years caused median losses exceeding $1.1 million.
• More than half of all cases involved either a lack of internal controls or an override of existing controls.
• Tips uncovered 43% of cases, and more than half of those tips came from employees.
• Median losses caused by owners and executives were more than nine times greater than those caused by employees.

These figures cover organizations of every size worldwide, not just small businesses, but two lessons apply directly: losses grow with every month nobody looks, and a control that is easy to bypass is barely better than none.

The Institute of Chartered Accountants in England and Wales (ICAEW) notes that in a smaller entity, management's direct involvement forms a large part of internal control, but the same position can be abused to override controls. The owner is both the strongest control and the weak point of a small company. The fix is to have the owner check the bookkeeper's work, and to have a partner, another director or the accounting firm see the owner's own expense claims and company card spending.

Splitting the work between bookkeeper and owner

The principle: the bookkeeper does the time-consuming steps, the owner keeps approval and review, and the person who can move money is never the last person to look at that transaction. The table shows one way to split the work in a company with a single bookkeeper.

An outside accounting firm can be the second person. Staff in the company handle documents and prepare payments, while the firm records the books and reconciles from statements it gets directly from the bank. See choosing an accounting firm and auditor.

Compensating controls when duties cannot be separated

The Minnesota auditor's guidance says that when an organization is too small to separate accounting functions, management should stay constantly aware of the gap and use additional controls to compensate, such as numbered receipts and marking paid invoices so they are not paid twice. For a Thai SME, these five controls give the most protection for the time spent.

The owner sees the bank account directly

Get view access to the company accounts in the owner's own name and send alerts for outgoing transactions to the owner's phone. A statement forwarded as a file does not count, because files can be edited. If the company's internet banking can separate the maker who prepares a transaction from the approver who releases it, make the bookkeeper the maker and the owner the approver. If it cannot, the bookkeeper sends the payment list with documents and the owner makes the transfers.

Supplier details change only after verification

An article in ACCA's Accounting and Business magazine describes payment fraud as a commonly committed fraud, carried out by creating false customer accounts to generate false payments, altering payee details or self-authorizing payments. For every request to change a supplier's bank account, whether it arrives by email or letter, call back on the number already in your system, not the number in the request, and have the owner approve the change.

Numbered documents, and the owner checks for gaps

Section 86/4 of the Thai Revenue Code requires a tax invoice to show its sequence number and, if there is one, the book number. Apply the same discipline to receipts, credit notes and payment vouchers. Each month, the owner checks which numbers were voided or skipped, and the company keeps voided documents as a complete set.

Mandatory leave, with someone else doing the work

Have the bookkeeper take at least one consecutive week of leave a year, and have the owner or the accounting firm actually do the work that week rather than letting it pile up. Odd items tend to surface when someone else has to do the job. ACFE found that 84% of perpetrators displayed at least one behavioral red flag before detection, and refusal to take vacations is among the red flags with the highest median losses, at $250,000.

System access by person

Give everyone their own login and never share passwords. Keep the audit log switched on and, if the software allows it, restrict deleting posted entries and editing closed periods.

The owner's 30-minute monthly review

Compensating controls only work if the owner actually looks every month. Set a fixed day, such as the fifth working day of the month, after the bookkeeper finishes the reconciliation, and go through this list.

One rule to remember: every baht that leaves the company is seen by at least two people, the one who prepares the payment and the one who approves or reviews it.

Where to start

1. List every money task and who does each step.
2. Circle the tasks where one person holds two or more duties, especially anyone who can move money and also records or reconciles.
3. Move payment approval and supplier data changes to the owner first, because that is how money leaves the company.
4. Get the owner view access and alerts from the bank, and ask whether preparing and approving transfers can be split.
5. Put the monthly review and the bookkeeper's leave on the calendar for the year.
6. When you can hire a second person, separate recording from paying first.

Internal controls make the numbers in your financial statements trustworthy. They underpin a monthly bank reconciliation and a monthly close finished in 10 working days.

The company and figures in the transfer example are illustrative.

Sources

• Occupational Fraud 2026: A Report to the Nations (behavioral red flags with the highest median losses) — ACFE
• Key Findings from Occupational Fraud 2026: A Report to the Nations (May 2026) — ACFE
• Segregation of Duties - Part I (January 2025) — Minnesota Office of the State Auditor
• Segregation of Duties - Part II (January 2025) — Minnesota Office of the State Auditor
• Understanding internal control in a smaller ISA audit — ICAEW
• Internal controls matter (December 2023) — ACCA Accounting and Business
• Revenue Code, Chapter 4 Value Added Tax, Sections 85–86 (Section 86/4, tax invoice contents; Thai) — Revenue Department