Internal Audit for Small Businesses, Without Hiring Anyone

Here is how to run it yourself.

Pick one process, not everything

A programme covering the whole business is how these efforts die in month two.

Pick the process where money leaves the building. For most UAE small companies that is supplier payments. If you handle a lot of cash, start there instead.

One process, done properly, beats a survey of eight.

Step 1. Write down how it is supposed to work

Not the ideal. What you believe currently happens.

Who raises a purchase. Who approves it. Who sets up the supplier. Who releases the payment. Who reconciles the bank.

Five lines. If you cannot write them, that is your first finding.

Step 2. Test three months against it

Pull every payment in the period from your ledger. For a sample of them, follow the document trail backwards.

Was there an approval? From whom? Was that person authorised to approve that amount? Did the same person raise and approve it? Did the supplier bank details match the invoice?

You are testing whether the process on paper is the process in practice. It usually is not.

Step 3. Run four data checks over everything

These take minutes on a ledger export and find more than the sample testing does.

1. Payments clustering just below an approval threshold.
2. Duplicate payments. Same supplier, same amount, close dates.
3. Suppliers with bank details matching an employee.
4. Suppliers added in the period, and who added them.

Step 4. Write one page and do something about it

What you found, how serious it is, what changes, who owns the change, by when.

One page. If it runs to five, you have written a report instead of making a decision.

Who should do this if not you

The independence requirement is real. The person testing payments cannot be the person making them.

In practice that means the owner, a non-executive shareholder, or an outside firm for a day or two. It does not mean your finance manager reviewing their own department.

How often

Once a quarter on a rotating process. Payments this quarter, payroll next, receipts after that.

Four short reviews a year covers more than one annual exercise nobody finishes.

What this will not achieve

It will not satisfy your free zone. That needs a statutory audit from an approved firm.

It will not catch a determined person controlling several parts of the process. It raises the effort and shortens the time to discovery.

And it will not work if you do not act on what you find. The finding is not the output. The change is.

Where we fit

We run this as a one or two day focused review and give you the one page. If you would rather run it yourself, the four data checks above are the place to start.