What Culture Does to Your Financial Controls

The link is stronger than most owners expect.

Controls are followed or they are not, and culture decides which

You can write an approval process. Whether it is followed when the owner is in a hurry and the supplier is waiting is not a policy question.

In audits we see the same pattern repeatedly. The control exists on paper and the file does not evidence it being followed. Not because anyone was dishonest, but because the culture treated the control as an obstacle rather than as the way things are done.

The three signals we see in audit work

Whether the owner follows their own rules.

If the approval threshold applies to everyone except you, it applies to no one. Staff calibrate on what you do, not on what the policy says.

This is the single strongest predictor of whether controls hold.

Whether people raise problems.

Businesses where an error gets someone shouted at are businesses where errors get hidden. Hidden errors compound and surface later, larger.

The practical test: when did someone last tell you something you did not want to hear, and what happened to them?

Whether anyone takes leave.

A business where nobody takes two consecutive weeks off is a business where nothing that requires ongoing concealment ever surfaces.

Mandatory leave is a control disguised as a benefit.

The specific things worth doing

Follow your own thresholds. Publicly, including when it is inconvenient.

React to a reported error by fixing the process, not the person. What people learn from the first error you handle badly is to hide the second.

Insist on leave being taken. Two consecutive weeks, annually, for anyone handling money.

Tell people why a control exists. A control that is explained gets followed. One imposed without reason gets worked around by people trying to be helpful.

What this is worth

Internal losses in small businesses are usually not sophisticated. They are one person controlling both the record and the money, in an environment where nobody looks and nobody asks.

The technical fix is segregation of duties. The reason segregation actually operates, rather than existing on paper, is culture.

What we are not saying

This is not an argument for suspicion. A business run on distrust is unpleasant and does not perform.

The point is different. Controls should not depend on trust in either direction, because a control that only applies to people you doubt is not a control.

Where we fit

We see which businesses have controls that operate and which have controls that are documented. The difference shows up in the management letter after every audit.