A control is not a policy PDF. It is a repeatable action that prevents or detects a named failure, leaves evidence, and has an owner. Internal audit then tests whether the action operated, not whether the policy sounded serious.
Map risk to a control and evidence
For each material process, write the failure first: fictitious vendor, duplicate invoice, unauthorized refund, altered payroll, or unreconciled bank item. Then name whether the control prevents or detects it, who performs it, how often, and what evidence survives.
COSO’s five components prevent a narrow checklist: approvals are control activities, but staff access, risk assessment, communication, and monitoring determine whether those approvals work. Keep a one-page matrix linked to invoices, bank logs, and access records.
Separate duties in a small team
A five-person team may lack four finance roles, but it can separate moments. The requester uploads the invoice; a budget owner approves it; a founder with bank access releases it; someone without release rights completes the monthly reconciliation.
Where separation is impossible, use a compensating control: a weekly bank-export review by a non-payer, immutable alerts for beneficiary changes, and retrospective board review above a documented threshold. Shared passwords are not a compensating control.
Test operation, not policy
Worked test as of July 2026: inspect all 24 payments in one month, in their transaction currency. Find two without receipts and one approved by its requester. Exception rate = 3 / 24 × 100 = 12.5%; this is a labeled case, not an expected fraud or control benchmark.
Assumptions: the 24-item population is complete, bank IDs are unique, reversals are identified, and evidence existed by the payment date. Calculation steps are population, attribute test, exception count, root cause, remediation owner, and retest date.
- Payments tested24 count
- Missing receipts2 count
- Self-approvals1 count
- Duplicate payments0 count
IIA Global Internal Audit Standards (2026-07). Worked monthly population and findings, not industry prevalence.
Prioritize and retest exceptions
Sensitivity should change scope, not manufacture precision. If payment volume doubles to 48 while three exceptions remain, the rate is 6.25%; the self-approval still demands remediation because severity is independent of frequency. Conversely, many missing low-value receipts can reveal a broken workflow.
The IIA standards require independence and objective communication. In a startup without an audit function, assign testing to someone outside the process and report unresolved high-risk findings to the board; do not call management’s own sign-off an independent audit.
Frequently asked questions
Do startups need an internal auditor?
Not always a full-time role, but material controls need objective testing by someone outside the process.
Can one founder approve every payment?
Approval alone is insufficient if the same person creates beneficiaries, releases funds, and reconciles.
How often should bank reconciliation run?
Monthly at minimum; high-volume or high-risk cash activity warrants weekly review.
Does a low exception rate prove no fraud?
No. It measures tested control attributes, not hidden fraud; scope and severity still matter.
Answers to the questions this topic usually leaves hanging.
How we sourced this
Every statistic in Controls Should Separate Authority, Evidence, and Review is attributed. Where a number is an estimate rather than a census, the note says so.
- COSO Internal Control FrameworkFive-component structure for effective internal control.
- IIA Global Internal Audit StandardsIndependence, planning, evidence, and communication.
- ACFE 2024 Report to the NationsAuthoritative occupational-fraud research; not used as a local benchmark.
- NIST Cybersecurity Framework 2.0Access governance and monitoring context for financial systems.
Primary sources used for this edition.
The bottom line
Choose one material payment process, preserve its evidence, and test last month’s complete population.
If you want the adjacent decisions after Controls Should Separate Authority, Evidence, and Review, start with Record keeping, Process automation, Financial compliance, Finance team design.
