Internal Control Is Not a Page Full of Signatures: Five Everyday Gaps

Internal control is not a single policy document. It is the way a company authorises, performs, checks and records its everyday work. It applies to real contracts, purchases, payments, inventory and system access. Clear roles, approvals, reviews and reconciliations help prevent problems, reveal exceptions and make sure someone follows them through. The goal is to reduce errors, duplicate payments, fraud and loss—not to promise that nothing can ever go wrong.

On Monday morning, a supplier calls to chase payment. Finance checks the system and says it was paid on Friday. The bank statement then shows that the same invoice was paid twice. A salesperson and a buyer had each submitted it, the system gave no warning, and every approver looked only at the amount. The form carried four signatures, but nobody asked whether the invoice had already been paid.

That is where internal control is often misunderstood. It is not a contest to collect more signatures or make every process longer. It is a set of everyday rules that makes errors and fraud harder and helps the company spot problems quickly. China’s Basic Standard for Enterprise Internal Control organizes the subject into five broad elements: control environment, risk assessment, control activities, information and communication, and monitoring. Those labels become much easier to understand when viewed through five ordinary business situations.

1. Do not give one person every key

If one employee can create a supplier, change its bank account, confirm delivery, release payment, and record the entry, that person effectively holds the keys to the warehouse, bank, and ledger. Even a completely honest employee can make an error that nobody else gets a chance to catch.

The practical answer is to separate a few important actions: one person requests, another approves, someone releases the money, and someone independent checks the result. System access must match that division. A policy saying “duties are separated” achieves little if one login can still complete the entire process. A small company may not have enough staff for perfect separation, but an owner or second manager can independently review new suppliers, bank-detail changes, and large payments, while someone outside the payment process reconciles the bank account.

2. Do not wait until payment to apply the brakes

If a purchase contract has a poor price or an impossible delivery date, discovering that at payment is usually too late. The goods may have arrived and the work may have begun. Finance is left with two bad choices: pay a questionable bill or hold back money that may already be owed. The most useful control often happens when the transaction begins.

Who checks a new supplier? Were quotations compared? Is the purchase within budget? Does a change in price or delivery date require fresh approval? If a supplier emails new bank details, does someone confirm the change through a previously known contact channel? An approver also needs the information required to make a decision. A form saying only “Please pay RMB 300,000” does not show the contract, budget, or delivery evidence, however neat the final signature may be.

3. A contract and invoice do not prove the work is finished

An invoice received on 30 December does not automatically make the goods a December purchase or prove that a service has been completed. The goods may still be in transit, the project may be half finished, or the contract may require customer acceptance. The accounting period depends on the relevant contract terms and facts, including delivery, service progress, acceptance, and transfer of control—not the invoice date alone.

Operations should retain records that show what happened, such as delivery receipts, project updates, acceptance results, and return information. Finance needs to understand those records. Open orders, goods in transit, unaccepted projects, and returns deserve particular attention at month-end and year-end. Otherwise, entries move into one period and back out in the next, while the real business event becomes harder to see.

4. Finding a difference is not the end of a reconciliation

At month-end, a finance employee finds that the bank statement is RMB 20,000 below the ledger and writes “to be investigated” in a spreadsheet. The next month, the line is copied into a new file. Six months later, the company has six completed reconciliation sheets and the same unexplained difference.

A reconciliation is finished only when the difference is understood and resolved. What caused it? Who will investigate? When is the answer due? What was the conclusion? Who is told if the amount is large or remains open? Bank accounts, customer and supplier balances, inventory, fixed assets, and intercompany activity should be checked at a frequency that matches the risk. Old differences, repeated manual entries, and suspense accounts full of “to be investigated” items can reveal more than one isolated mistake: they show that the process never closes its problems.

5. Keep evidence, and change the control when the business changes

An approver may genuinely have challenged a contract but left no record of the questions. The warehouse may have counted every item, but the count sheet is missing. A manager may have approved a payment in a chat message that cannot be reconstructed six months later. The work may have happened, yet nobody can later see what information was reviewed, why the decision was made, or whether an exception was cleared.

Record-keeping does not mean filling a room with paper. It means retaining the important trail: approval support, system logs, count results, review conclusions, and exception follow-up. Controls must also move with the company. A new system, changed roles, or a new line of business can make yesterday’s access rights and approvals irrelevant. A weakness needs an owner and completion date, followed by a check that the new process actually works.

Walk one recent transaction from beginning to end

Take a recent purchase, sale, or expense claim and ask five plain questions. What serious mistake is this control meant to prevent? Who checks whom? What information can the reviewer see? What record remains afterward? If something unusual appears, who follows it through to resolution? A missing answer shows where the process needs attention.

Internal control provides “reasonable assurance.” In everyday language, that means using measures suited to the company’s size and risk to reduce serious errors, fraud, and loss of control to an acceptable level. It does not promise that nothing will ever go wrong. Good controls allow ordinary work to move without a queue of ceremonial signatures, while making unusual or high-risk events visible to the people who need to act.