Internal Controls

Internal Controls | Finin2min CFO Hub: Finin2min practical finance and law reference.

CFO Office Hub

Internal Controls

Practical CFO playbook for finance leaders, founders and controllers. Built for operating discipline, decision quality and audit-ready documentation.

What this module solves

It builds a practical control matrix that distinguishes preventive controls (which stop an error before it happens) from detective controls (which catch one after it already has), rather than treating "controls" as a single undifferentiated idea.

Operating framework

Area	What good looks like	Common failure	Finin2min action
Ownership	Named owner, due date and review layer	Shared responsibility with no accountability	Create RACI and maker-checker tracker
Data	Single source of truth reconciled to books/banks	Different numbers in MIS, ERP and board deck	Reconcile every key metric before reporting
Controls	Preventive and detective controls documented	Ad hoc approvals and spreadsheet errors	Use control matrix and exception log
Decision support	Clear recommendation with risk and upside	Only historical reporting	Add CFO commentary and next action

Practical examples

Example 1

A company requires two signatures on any payment above a threshold (a preventive control) but has no one independently reviewing bank statements against the general ledger afterward (a missing detective control). A fraud structured to stay just under the payment threshold sails past the first control with nothing left to catch it after the fact.

Example 2

A control documented in the policy manual but never actually tested for a full quarter is, for audit purposes, indistinguishable from a control that does not exist at all.

Testing a control, not just documenting it

A control matrix entry is only as credible as the evidence that the control actually operated. For each control, retain a specific, dated sample of it working: the approval trail for a transaction above the payment threshold, the signed reconciliation for a specific month, the escalation record for a specific exception. A control tested once a year, right before the statutory audit, is a materially weaker control than one with evidence generated as a routine by-product of doing the work each month — the former is easy to game for a single point-in-time check; the latter is not, and it is also far less work to assemble when the auditor eventually asks for it.

Checklist

Define owner and reviewer.
Document source systems.
Reconcile to ledger/bank/returns where relevant.
Capture exceptions, judgement areas and open risks.
End every report with decision or action required.

Q&A

Question	Finin2min answer
Who should own this?	The CFO office should own the framework; process owners own inputs and finance controls the review.
What is the biggest red flag?	Different versions of the same number across MIS, books, bank, tax filings or board material.
How frequently should it be reviewed?	Monthly for operating items, quarterly for board-level governance, annually for design refresh.

Finin2min crux

Crux: A control that exists only on paper is not a control. Every preventive and detective control on the matrix should have a named owner who can demonstrate it operated, not just that it was designed.