Designing Internal Controls

Three categories

• —Preventive — stops an error or fraud before it happens: segregation of duties, credit limits, the three-way match.
• —Detective — catches it afterwards, before real damage compounds: bank reconciliation, physical verification, the trial balance scan.
• —Corrective — fixes what detective controls find: a rectifying journal entry, a stock shrinkage write-off.

A well-designed system uses all three together. Preventive controls alone will not catch what slips past them; detective controls alone let avoidable problems happen first.

Classifying real controls

• —Separating the PO-raiser, GRN-confirmer and payment-approver — preventive.
• —Monthly bank reconciliation — detective.
• —A rectifying entry for a ₹68,000 misclassification — corrective.
• —Physical verification of fixed assets — detective.
• —Independent verification of a new supplier’s bank details — preventive.

Cost against risk

Every control costs something — time, staff, friction in getting work done. A control earns its place when the risk it prevents or catches, weighted by likelihood and potential size, genuinely exceeds that ongoing cost.

Three approvals for a ₹500 petty cash voucher is over-controlled for almost any small business. Independent verification before adding a new supplier is proportionate to a risk that is real and potentially large. Same principle, opposite answers.

Is “more approval” always safer?

Suppose a team proposes the owner personally signing off every purchase over ₹100, on the logic that more approval is always safer. Good control design?

No. The volume of such purchases would bottleneck the owner’s time without meaningfully reducing risk, because genuinely low-value transactions carry low exposure regardless of who signs them.

Worse, a control that makes normal work impossible gets worked around — and a bypassed control provides no protection while still consuming the effort of pretending to exist. Good design calibrates friction to the actual size of the risk.

Designing a new one

Take a real, identified gap: a customer master with no credit limit field, so nothing stops a large order going to a customer already badly overdue.

A proportionate new control: before any sales order above ₹5,00,000 is confirmed for a customer more than 60 days overdue on an existing balance, require explicit owner approval.

It is preventive (it stops the order before it compounds existing exposure), proportionate (it triggers only on genuinely material, genuinely risky situations), and it closes a gap someone had already identified rather than a hypothetical one.

Documentation is part of the control

A control that exists only as an unwritten habit in one person’s head is not a reliable control. It depends entirely on that person remembering every time, with nothing to check against when they don’t — and it leaves with them.

Writing down what triggers it, who is responsible, and what action is required is part of designing it properly, not bureaucratic overhead added afterwards.

Common mistakes

• —Adding approval layers in response to an incident without weighing cost against risk.
• —Relying entirely on detective controls and never preventing anything.
• —Setting thresholds so low that staff route around the control to get work done.
• —Leaving a control undocumented, so it depends on one person’s memory.
• —Designing controls for hypothetical risks while a known gap stays open.
• —Never revisiting whether a control still matches the risk it was built for.