How do you identify key control points in financial processes?
A process that tries to check every step slows down; a process that checks none notices errors only at month end. The real job is to find the points where an error would be most costly and place the control there.
A key control point is a step in a financial process where both the likelihood and the impact of an error or irregularity are high, and where a control therefore adds the most value. The point of identifying them is not to make the process bureaucratic but to direct limited attention where it helps most.
A risk-based approach
For each step in a process, two questions are asked:
- What can go wrong here? (wrong amount, wrong account, wrong period, unauthorised transaction, missing entry)
- What is the impact if it does? (financial amount, cash loss, reporting error, tax risk)
Steps where both likelihood and impact are high are key control points.
| Low impact | High impact | |
|---|---|---|
| High likelihood | Simple, automated checks | Key control point |
| Low likelihood | Control may not be needed | Periodic review |
Main financial processes and typical control points
| Process | Typical risk | Example control point |
|---|---|---|
| Sales to collection | Unbilled deliveries, wrong prices, uncollectable receivables | Shipment–invoice matching, price list approval, credit limit check |
| Purchase to payment | Duplicate payments, unapproved purchases, fictitious suppliers | Three-way match of order, delivery note and invoice; approval of supplier master changes |
| Payroll | Wrong pay, payments to leavers | Headcount–payroll reconciliation, separate approval of changes |
| Inventory | Differences between records and physical stock, impairment | Periodic counts, slow-moving stock report |
| Cash and bank | Unauthorised payments, reconciliation differences | Dual approval, daily or weekly bank reconciliation |
| Close and reporting | Missing accruals, wrong period | Close checklist, analytical review |
Features of a good control
- Timely: it catches the error when it happens or soon after. A month-end control tries to find a month’s worth of accumulated errors.
- Based on segregation of duties: the person who performs a transaction and the person who checks it are different wherever possible.
- Documented: it leaves a trace of when it was performed, by whom and with what result.
- Proportionate: its cost does not exceed the risk it prevents.
Preventive and detective controls
Preventive controls stop errors from happening: approval before payment, authority limits defined in the system, mandatory fields. Detective controls find errors that have happened: reconciliations, analytical reviews, exception reports.
A sound structure uses both. A process relying only on detective controls finds errors but corrects them expensively; one relying only on preventive controls cannot see when a control has been bypassed.
Data-supported control
Analyses that run on all of the accounting data greatly widen the reach of detective controls. Duplicate payments, accounts with the wrong-sign balance or entries bunched at period end can be found in minutes by scanning every entry. I give examples in What can e-ledger data reveal?
Control and speed
When control points are in the right places, the process speeds up rather than slows down. Because errors are caught as they happen, fewer corrections are needed at month end and the monthly close gets shorter.
For the general framework, see the audit and financial control page.
Frequently asked questions
How can segregation of duties work in a small finance team?
Full segregation may not be possible. Compensating controls then apply: for example, a manager regularly reviewing bank movements and large payments.
How often should control points be reviewed?
Whenever the process, system or organisation changes, and at least once a year. Moving to new software or starting a new line of business can shift where the risks are.