Three requests from the field examiner
Picture an illustrative company with $40 million in revenue that is refinancing its credit line. The lender's field examiner sends a short list: the March bank reconciliation with the reviewer's sign-off, everyone who can release wires, and every manual journal entry above $50,000 from the fourth quarter with its approval. The controller produces the reconciliation in ten minutes. The wire list takes a call to the bank and turns up a former employee who still has release rights. The journal entry list shows that most large entries were posted and approved by the same person.
None of this is fraud, and none of it changes a number in the financial statements. It surfaces because someone outside the company asked for evidence that controls exist and run. The checklist below is built for that moment. It follows COSO's Internal Control: Integrated Framework (2013), which sets out five components and 17 principles, and turns each principle into checks a growing company can answer with a document or a system report.
COSO's executive summary notes that a smaller entity's system "may be less formal and less structured, yet still have effective internal control." Less formal is fine. Missing is not: the framework requires each component and relevant principle to be present and functioning.
404(b) relief leaves the tests standing
On May 19, 2026, the SEC proposed collapsing public company filer categories into two, large accelerated filers and non-accelerated filers, and raising the large accelerated filer threshold from $700 million to $2 billion of public float (Release No. 33-11419). Non-accelerated filers do not need an auditor's attestation on internal control over financial reporting under Section 404(b), so more companies would fall outside it. Comments closed on July 20, 2026. As of November 2026 the proposal is not final.
Two things would not change, and the SEC's release says so directly. Management would still have to assess and report on internal control under Section 404(a). And the financial statement audit would still require the auditor to understand internal control and to communicate significant deficiencies and material weaknesses in writing to management and the audit committee.
For private companies, Section 404 never applied. The same tests arrive from other directions:
- Lenders read covenant compliance certificates and borrowing base reports, and asset-based lenders send field examiners to test receivables and inventory. They want reconciliations that tie and a cash process they can rely on.
- Buyers and their quality-of-earnings teams pull journal entries, revenue cutoff, related-party transactions and reconciliations. Weak controls tend to come back as price adjustments, escrows or specific indemnities.
- Auditors who find controls they cannot rely on test more, take longer and put the findings in writing to management.
Start with the control environment
Principles 1 to 5 cover how the organization is run.
- Integrity and ethical values. A written code of conduct, acknowledged by every employee in the last 12 months, that names a way to raise concerns outside the reporting line.
- Independent oversight. A board, audit committee or outside owner receives financial results and open control issues at least quarterly, and the minutes show questions asked.
- Structure and authority. A written delegation of authority states who may sign contracts, approve spending and open bank accounts, with dollar limits.
- Competence. Each finance role has a description, and the person in it has the skills it needs or a plan to get them. Backups exist for the close, payroll and payments.
- Accountability. Every key control has a named owner, and control duties appear in job descriptions and performance reviews.
Risk assessment means writing risks down
- Clear objectives. Reporting objectives are stated: the close deadline, the reporting framework, the covenants and the grant terms you must meet.
- Risk identification. A dated list of risks to those objectives exists, by process, each with an owner.
- Fraud risk. Fraud schemes are considered explicitly, including management override. A fraud risk assessment run in one afternoon is enough to start.
- Change. A new system, an acquisition, rapid hiring, a new bank or turnover in finance triggers a review of the controls it touches.
Control activities are where money moves
- Controls mapped to risks. Each risk on the list maps to at least one control. The basics: bank reconciliations reviewed within 15 days of month-end, approval of bills above a threshold, and review of manual journal entries by someone other than the preparer.
- Technology controls. Access to the ERP, bank portals and payroll is reviewed quarterly against job duties, administrator rights are limited to as few people as possible, and leavers lose access on their last day.
- Policies and procedures. Written procedures exist for the close, payments, vendor setup and changes, payroll changes and expense reimbursement. Segregation of duties is designed in, and where a small team cannot split a duty, a compensating review is named. The three-person duty split shows one way to do it.
Information must reach the right people
- Reliable information. Reports used in controls are complete and accurate. Someone has checked that the aged receivables report ties to the general ledger and that system reports used in reviews pull every record.
- Internal communication. People know which controls they run, when, and how to raise a problem. A close checklist with owners and dates is the simplest form.
- External communication. Lenders, auditors, funders and the board receive consistent information, and vendors and customers have a way to report concerns.
Monitoring proves the rest still works
- Ongoing and separate evaluations. Someone other than the preparer checks key controls on a schedule, and at least once a year a person or a tool tests whether they actually ran: a sample of approvals, a scan of journal entries, a fresh access export.
- Deficiencies reported and fixed. Findings go on a log with an owner, a date and a status, and the board sees the open items.
The ACFE's Occupational Fraud 2026 study of 2,402 cases found that three weaknesses accounted for 70% of the frauds: a lack of internal controls (33%), an override of existing controls (19%) and a lack of management review (18%). Principles 10, 12 and 16 are where those three are won or lost.
Evidence to have ready first
If time is short, prepare these before anyone asks. They are among the first items a refinancing, an audit or a sale process requests:
- Twelve months of bank reconciliations for every account, each showing preparer, reviewer and date.
- A current list of bank accounts, signers and portal users with their limits.
- The year's manual journal entry listing, with approvals for entries above your threshold.
- The vendor master change log for 12 months, with verification evidence for every bank change.
- User and role exports from the ERP and payroll system, and the date of the last access review.
- The delegation of authority and the close checklist.
- Board or owner minutes showing that results and control issues were discussed.
Where to start
Answer the checklist with one of three answers per line: yes with evidence, yes without evidence, or no. The middle column is usually the longest, and it is the one a lender or buyer will find. The free controls health self-check asks 20 questions across the same five components and scores each one. For an outside view tested against your own ledger, a controls health check ranks the gaps by consequence and sets out the order in which to fix them.