Regulatory compliance & internal controls

It means no single person controls a transaction end to end. The four incompatible functions are authorization, custody of assets, record-keeping and reconciliation.

When one person can set up a vendor, approve an invoice, release the payment and reconcile the bank account, there is no point at which an error or a diversion would be caught by the process itself: detection depends entirely on someone happening to look. It is the most common control gap we find in businesses under fifty employees, and the one most frequently cited in occupational fraud cases.

Not completely, and pretending otherwise produces a control matrix nobody follows, which is worse than admitting the constraint.

In a small team the answer is compensating controls: an owner or board member reviews the bank statement independently of whoever reconciles it; new vendors need a second approval; payments above a threshold need dual authorization; someone outside accounting reviews the monthly close. The objective is that no single person can both cause and conceal a misstatement. That is achievable at nine people even when full segregation is not.

SOC 1 reports on controls relevant to a client's financial reporting: what a payroll processor or claims administrator provides so their clients' auditors can rely on their processing. SOC 2 reports on security, availability, processing integrity, confidentiality and privacy, and is what a SaaS or technology vendor is usually asked for in procurement.

Each comes as Type I, testing design at a point in time, or Type II, testing operating effectiveness over a period of usually six to twelve months. Most enterprise buyers want Type II, so plan for the observation window rather than assuming it can be produced in a fortnight.

Section 404 internal control reporting applies to SEC registrants, so a private company is not directly subject to it.

It becomes relevant in three situations: you are preparing for an IPO and need a control environment that will withstand scrutiny; a private equity sponsor requires SOX-equivalent controls as a portfolio standard; or you are being acquired by a public company and will be folded into their framework. In all three, the work is far cheaper done ahead of the requirement than in response to it.

For a business under 100 employees, four to six weeks: process walkthroughs across the revenue, purchasing, payroll, treasury and close cycles; documentation of the controls that actually operate rather than those written down; a segregation of duties matrix tested against real system access; and a findings report ranking gaps by likelihood and impact with a remediation plan.

Remediation itself typically runs a further one to two quarters, depending on how much of it is system change rather than process change. System change is slower but sticks; process change is faster but decays without testing.