Score your controls in ten minutes

Has everyone in finance acknowledged your code of conduct in the last 12 months?

A code that people have never acknowledged is hard to enforce when someone breaks it.

Does someone outside the finance team, such as an owner or board member, review results at least quarterly and record their questions?

Review by someone who did not prepare the numbers is the first check on management override.

Is there a written approval matrix stating who can approve payments, contracts and journal entries, and up to what amount?

Without written limits, nobody can tell afterwards whether an approval was valid.

Can staff report a concern to someone other than their own manager, anonymously if they choose?

Tips are the most common way occupational fraud is detected, and they only arrive when people have a safe route.

In the last 12 months, has management written down how the finance process could fail or be defrauded, ranked by consequence?

Controls chosen without a written view of risk tend to protect what is easy rather than what matters.

When you add a system, bank account, entity or AI tool, does someone decide which controls it needs before it goes live?

Control gaps often open the day something new is added and nobody is assigned its controls.

Can you name the balances and estimates most likely to be wrong at year end, and who reviews each one?

Knowing where a misstatement is likely tells you where review time is best spent.

Have you considered how a senior person could override controls, for example by posting and approving their own entries?

Management override goes around ordinary controls, so it needs its own detective checks.

Is every change to a vendor's bank details confirmed by calling the vendor on a number already on file?

Calling a known number defeats an attacker who controls only the email thread or the voice on the line.

Do payments above a set amount need a second person to release them in the bank portal?

With dual release, one compromised login or one mistaken click cannot send a large payment.

Does someone other than the preparer review manual journal entries above a set amount?

Manual entries are the simplest way to misstate results, and a self-approved entry gets no second look.

Are bank accounts reconciled within ten business days of month end and signed off by a reviewer?

A late or unreviewed reconciliation lets missing cash and unrecorded payments age unnoticed.

Do management accounts reach leadership within 15 business days of month end, every month?

Information that arrives late cannot catch a problem while it is still small.

Are your finance policies written, dated within the last two years and kept where staff can find them?

People cannot follow a procedure they cannot find, or one that describes a process you no longer run.

When someone finds a control exception, do they know whom to tell, and is the exception recorded?

Exceptions that are fixed quietly hide the pattern that would point to a broken control.

Could you answer a lender's or funder's controls questionnaire from documents you already keep?

Evidence created on request makes outsiders doubt that the control runs the rest of the year.

In the last 12 months, has anyone checked the evidence that your key controls actually ran?

A control that is well designed but skipped in practice gives no protection.

Are audit findings and control exceptions logged with an owner and a due date, and tracked until closed?

Findings without an owner tend to reappear in next year's management letter.

Do you run automated checks over all payments or journal entries, such as duplicate invoices or weekend postings?

Testing every transaction finds what a sample misses, and it costs little once the data is exported.

Does the board or owner receive a report on open control issues at least twice a year?

An oversight body can only push for fixes it knows about.