Five design decisions carry the load
Control frameworks run to dozens of pages. In a company with a lean finance team, five design decisions do most of the work. Get them right and the rest of the control set stays short.
Approval limits follow risk, not seniority
An approval matrix should ask what a transaction could cost if it were wrong, not who is most senior. A $9,500 software renewal and a $9,500 wire to a new vendor carry different risk. We set thresholds by transaction type, require a second approver for new payees regardless of amount, and check the ledger for invoices split to land under a limit, such as three payments of $4,900 to one vendor in a week against a $5,000 threshold.
Access sits beneath every other control
An approval workflow means little if the approver can also edit the vendor master or post a journal entry directly. We compare user roles in the accounting system, the bank portal and payroll against job duties, and treat bank portal administrator rights with the same care as signing authority. For a first look at your own team, the segregation-of-duties conflict finder lists the common conflicting pairs.
Reviews leave evidence others can follow
Initials on a reconciliation prove that someone touched it. A useful review records what was compared, which differences were found and how each was cleared. We write review steps so that an auditor, a new controller or a buyer's diligence team could repeat them.
Manual entries need their own rules
Manual entries are where errors and pressure on results tend to surface. We look at who can post them, whether anyone reviews them before close, and when they are posted. An entry booked at 23:48 on the last day of the quarter by the person who will approve it deserves a second look, even if it turns out to be correct.
Small teams rely on compensating controls
Where three people cannot split six duties, a compensating control watches the overlap instead. Examples include a monthly owner review of a vendor-change report, a bank rule that holds payments above $25,000 for a second approver, and an alert when anyone edits a payee's bank account.
Public and private standards overlap
COSO's Internal Control, Integrated Framework (2013), sets out five components and 17 principles. Public companies use it to support the management assessment required by Section 404(a) of the Sarbanes-Oxley Act, and larger filers also need an auditor's attestation under Section 404(b). Private companies are bound by neither, but lenders, investors and buyers ask the same questions.
In May 2026 the SEC proposed raising the large-accelerated-filer threshold to $2 billion in public float, which would remove the 404(b) attestation for companies below it. As of November 2026 the proposal is not final, and the 404(a) management assessment would remain either way. Our SOX and ICFR readiness work is built around that management assessment.
AI tools now sit inside controls
Invoice-coding assistants, reconciliation bots and close agents now perform steps that people used to perform. Each one is a user with permissions, and the same separation rules apply to it. COSO's February 2026 guidance, Achieving Effective Internal Control Over Generative AI, maps its 17 principles to generative AI and pays particular attention to tools adopted without approval. We include AI tools and their service accounts in every access review and write their limits into the approval matrix. The article on controls to put in writing before AI agents run the close covers where to begin.