What internal control is (and why small businesses need it)
A house has a lock on the door, a smoke alarm and a fire extinguisher. The lock stops trouble before it starts. The alarm tells you something is wrong. The extinguisher helps you fix it. Financial controls do the same for money.
- Before this course: Small Business Reporting (course 2.13.3). You can produce reliable statements. Controls make sure the numbers stay reliable even when you are not watching every transaction.
- Internal control means the rules, checks and habits a business uses to reach its goals, keep reliable records, follow the law and protect its assets.
- COSO (the Committee of Sponsoring Organizations of the Treadway Commission) issued a revised Internal Control - Integrated Framework in 2013. The US Government Accountability Office (GAO) Green Book uses the same structure: five components supported by 17 principles:
| Component | Plain meaning | Small business example |
|---|---|---|
| Control environment | The tone and honesty the leaders set | The owner follows the same rules as everyone else |
| Risk assessment | Thinking about what could go wrong | A list of the top money risks, reviewed yearly |
| Control activities | The actual checks | Approvals, reconciliations, two people for payments |
| Information and communication | The right information reaches the right people | Written rules everyone has read |
| Monitoring | Checking that the controls still work | Testing a sample of payments each quarter |
- Three kinds of control (teaching model):
| Kind | Purpose | Example |
|---|---|---|
| Preventive | Stop a problem before it happens | A second person approves new supplier bank details |
| Detective | Find a problem after it happens | Monthly bank reconciliation reviewed by the owner |
| Corrective | Fix it and stop it repeating | Correcting entry plus a new rule |
- Small businesses are not too small for controls. In its 2026 fraud study, the ACFE notes that small organisations often face heightened vulnerability. In a small business, one or two people often handle every money task, so mistakes and misuse are easier to miss.
- Controls cost time. Match the strength of a control to the size of the risk. A coffee receipt does not need three signatures; a new supplier bank account does.
- List every way money enters and leaves your business (sales, card payments, bank transfers, cash, payroll, owner draws).
- For each one, write what could go wrong: an error, a theft, a fake bill, a missing record.
- Rate each risk 1 to 3 for how likely and 1 to 3 for how bad. Multiply to get a score from 1 to 9.
- For the three highest scores, write the control you have today and mark it preventive, detective or corrective.
- Write the control you are missing for each one.
- Note which COSO component each control belongs to.
- Check: your top three risks each have at least one preventive or detective control and an owner.
Videos by other creators on YouTube, for reference. They are not made by or affiliated with The Future Market.
Read the video script
[Host] "A lock, an alarm and an extinguisher. Every business needs all three for its money."
[Text on screen: Prevent, Detect, Correct] "Preventive controls stop problems, detective controls find them, corrective controls fix them."
[Text on screen: Environment, Risk, Activities, Information, Monitoring] "Professionals group controls into five components, from the tone at the top to checking that controls still work."
[Host] "Start with your three biggest money risks and give each one a control and an owner."
Build a one-page risk and control list for your business or a practice shop, with your top three risks, their controls and an owner.
ClaudeStuck? Copy a ready-made prompt for Claude
Copy this, open Claude, paste it, and Claude will walk you through the lesson step by step.
For a grown-up: Claude is for adults (18+). Copy this, paste it into Claude, and use the answer to explain the lesson to your child.
I'm learning "Financial Controls: internal controls and working with accountants" on The Future Market. Lesson 1: "What internal control is (and why small businesses need it)". What the lesson teaches: - Before this course: Small Business Reporting (course 2.13.3). You can produce reliable statements. Controls make sure the numbers stay reliable even when you are not watching every transaction. - Internal control means the rules, checks and habits a business uses to reach its goals, keep reliable records, follow the law and protect its assets. - COSO (the Committee of Sponsoring Organizations of the Treadway Commission) issued a revised Internal Control - Integrated Framework in 2013. The US Government Accountability Office (GAO) Green Book uses the same structure: five components supported by 17 principles: - Component - Plain meaning - Small business example - Control environment - The tone and honesty the leaders set - The owner follows the same rules as everyone else - Risk assessment - Thinking about what could go wrong - A list of the top money risks, reviewed yearly - Control activities - The actual checks - Approvals, reconciliations, two people for payments The exercise I'm working on: Build a one-page risk and control list for your business or a practice shop, with your top three risks, their controls and an owner. I'm stuck. Please: 1. Explain the main idea in plain, simple words with one everyday example. 2. Walk me through the exercise one small step at a time. Ask me what I've done so far before giving the next step. 3. Don't just give me the final answer. Help me do it myself, and check my work when I share it.
I'm a parent helping my child (about 8 years old) with a lesson called "What internal control is (and why small businesses need it)" from the course "Financial Controls: internal controls and working with accountants". Here's what the lesson says: A house has a lock on the door, a smoke alarm and a fire extinguisher. The lock stops trouble before it starts. The alarm tells you something is wrong. The extinguisher helps you fix it. Financial controls do the same for money. The activity: Build a one-page risk and control list for your business or a practice shop, with your top three risks, their controls and an owner. Please explain this so an 8-year-old understands: short sentences, a fun everyday example, and no hard words. Then give me 3 simple questions I can ask my child to check they understood, and a way to do the activity together, one tiny step at a time.
Sources
- US GAO, Standards for Internal Control in the Federal Government (Green Book, GAO-14-704G), text version: www.gao.gov/assets/670/665714.txt
- COSO, Internal control guidance: www.coso.org/internal-control
- ACFE, Occupational Fraud 2026: A Report to the Nations, key findings: www.acfe.com/about-the-acfe/newsroom-for-media/press-releases/press-re
Approval rules and the three-way match
This lesson is part of full access: every course and every level for one payment.
Separating duties when your team is small
This lesson is part of full access: every course and every level for one payment.
Fraud risk: the triangle and the red flags
This lesson is part of full access: every course and every level for one payment.
Protecting payments, cash and payroll
This lesson is part of full access: every course and every level for one payment.
Access, audit trails and keeping records
This lesson is part of full access: every course and every level for one payment.
Year-end handover and working with accountants
This lesson is part of full access: every course and every level for one payment.
Test your controls and teach them
This lesson is part of full access: every course and every level for one payment.
Final project
This lesson is part of full access: every course and every level for one payment.
Quiz
Name the five components of internal control in the COSO framework.
Control environment, risk assessment, control activities, information and communication, and monitoring.
What is the difference between a preventive and a detective control?
A preventive control stops a problem before it happens; a detective control finds it afterwards.
Why is an approval after payment not a real control?
The money has already left; it is only a review.
Order 40 units at 12.50, 38 arrive, invoice charges 40. How much should you pay?
475 (38 × 12.50), and ask about the 25 difference.
Which four duties should be separated?
Authorising, custody of the money, recording and reconciling or reviewing.
What can a two-person business do when duties cannot be separated?
Add compensating controls, such as the owner reviewing bank statements and approving large payments, and someone else checking the reconciliation.
What are the three sides of the fraud triangle?
Pressure, opportunity and rationalisation.
In the ACFE 2026 study, what was the most common way fraud was detected?
Tips (43% of cases).
An email asks you to pay a supplier's new bank account. What should you do?
Call the supplier on a number you already had on file, confirm, and get a second approval before changing anything.
Petty cash float 200.00 and receipts total 123.95. How much cash should be in the box?
76.05.
Why do record retention periods need a country box?
Each country's tax agency sets its own period, and they differ.
What level of assurance does a review give, compared with an audit?
A review gives limited assurance; an audit gives reasonable assurance.
You test 25 payments and 2 lack approval. What is the exception rate?
8%.
Who is responsible for the books and statements when an accountant helps?
The business owner.
Final exam
This lesson is part of full access: every course and every level for one payment.
Certificate
This lesson is part of full access: every course and every level for one payment.