CFO insight
Your Startup Has Zero Internal Controls. Your Investor Already Noticed.
Hayat Amin · Updated 2026-11-11
Internal controls for startups are the approval, reconciliation and access rules that prevent money moving without a second pair of eyes. Here are the five controls a fractional CFO implements in week one and why investors check for them before they check your product.
Internal controls for startups are the approval, reconciliation and access rules that prevent money moving without a second pair of eyes. Most companies under £10M revenue have none. Hayat Amin, who has audited the finance functions of over forty growth-stage businesses at Beyond Elevation, says the pattern is the same every time: "The CEO signs everything, the bookkeeper has admin access to the bank, and nobody reconciles anything until the accountant asks for it three months later." According to a 2025 Association of Certified Fraud Examiners report, companies with fewer than 100 employees lose a median of £150,000 per fraud case — more than double the rate at larger firms. That is not a number most Series A companies can absorb.
What Are Internal Controls and Why Do Startups Skip Them?
Internal controls are the policies, procedures and checks that ensure financial transactions are authorised, recorded accurately and safeguarded from error or fraud. Every growing company needs them, but most startups delay building them because the finance function is one person doing everything.
The bookkeeper enters the invoices, approves the payments, reconciles the bank and runs payroll. That is not a finance function. That is a single point of failure.
The reason is cultural as much as structural. Founders optimise for speed. Approval workflows feel like bureaucracy. The implicit assumption is that a team of twelve people who trust each other does not need the controls that a 500-person company needs.
That assumption is correct — right up until the moment it is not.
The inflection point is usually one of three events: a misposted transaction that misstates a board report, a duplicate payment that nobody catches for six weeks, or a fraud that could have been stopped by a £0 policy change. Hayat Amin calls these "control-zero events" — the incident that forces a founder to realise the finance function has no safety net.
Which Internal Controls Should a Startup Implement First?
The five internal controls every startup needs from day one are payment authorisation, bank reconciliation, expense approval, payroll verification and access segregation. You do not need an enterprise ERP system to implement them. You need one written policy per control and a named person responsible for each check.
Hayat Amin's Five-Control Foundation is the framework Beyond Elevation deploys in the first two weeks of every new fractional CFO engagement:
1. Dual payment authorisation. No payment above £500 leaves the account without two approvals. The person who creates the payment is never the person who approves it.
2. Weekly bank reconciliation. Every Friday, someone other than the bookkeeper reconciles every bank account and flags unmatched items. Time to complete: 20 minutes for a startup with one bank account.
3. Expense approval by category owner. Every expense above £100 is approved by the budget holder before it is paid. No retrospective approvals.
4. Independent payroll review. Someone outside the payroll process reviews the payroll run before it is submitted. Check headcount, check totals, check new starters and leavers.
5. Access segregation. The person who enters invoices cannot also approve payments. Admin access to banking platforms is restricted to two named individuals. Credentials are not shared.
None of these controls costs money. All of them take less than two hours a week combined. The gap between having them and not having them is the gap between a clean due diligence and a deal that stalls in the data room.
When Do Investors Start Checking for Internal Controls?
Investors start looking at internal controls the moment a company raises institutional capital, and they check harder at every subsequent round. At Series A, the questions are informal: who approves spend, how often do you reconcile, who has access to the bank. By Series B, a formal controls assessment is standard due diligence. At PE entry, the absence of basic controls can reduce a valuation by 5 to 15 percent or kill a deal entirely.
Hayat Amin reminds founders that the investor is not checking for perfection — the investor is checking for awareness. "If you cannot describe your three most important internal controls in one sentence each, the investor knows you have none. That goes on the risk register, and it reprices the deal."
The 2025 Deloitte Private Equity Due Diligence Survey found that 68 percent of deal teams flagged weak financial controls as a material risk factor, and 23 percent reduced their offer price as a direct result. The fix costs less than the typical monthly spend on software subscriptions. The failure to fix it costs multiples.
What Happens When a Startup Has No Internal Controls?
The most common outcome of missing internal controls is not fraud — it is financial misstatement. A payment posted to the wrong account, a revenue entry doubled, an accrual missed. Small errors that compound. The board sees numbers that do not match reality, makes decisions on those numbers, and the gap widens quarter after quarter.
The second most common outcome is fraud that nobody catches. The ACFE data is unambiguous: organisations without basic anti-fraud controls lose twice as much per incident. In a 30-person startup, the loss hits the cash runway directly.
The third outcome is the one that costs the most: a due diligence finding that delays or kills a raise. Hayat Amin has seen it firsthand — a growth-stage company with £8M ARR that entered Series B due diligence with no bank reconciliation history, no expense approval records and shared admin credentials on the banking platform. The lead investor paused the process for 90 days. The company implemented controls in six weeks, but the delay cost them their preferred terms.
How Does a Fractional CFO Build Internal Controls That Scale?
A fractional CFO builds internal controls in three phases: immediate risk controls in weeks one and two, process controls in weeks three to six, and monitoring controls in months two and three. The sequence matters because the first phase stops the bleeding, the second phase builds the system, and the third phase proves to investors that the system works.
Beyond Elevation follows Hayat Amin's Five-Control Foundation as the first phase, then layers on two more phases that take the finance function from reactive to audit-ready.
Phase 2 — Process controls (weeks 3 to 6):
Purchase order workflow for all spend above £1,000. Monthly close checklist with named sign-off dates. Vendor onboarding with payment terms documented before the first invoice. Revenue recognition policy documented and applied consistently.
Phase 3 — Monitoring controls (months 2 to 3):
Monthly management accounts reviewed against budget with variance commentary on every line above 10 percent. Quarterly control self-assessment — fifteen yes-or-no questions, thirty minutes. Board reporting that includes a one-paragraph control summary so investors see governance without asking for it.
The total cost of this programme when delivered by a fractional CFO is typically £3,000 to £5,000 per month for three months — roughly the cost of one month of a full-time CFO hire's salary, for a permanent upgrade to the finance function that survives after the fractional engagement ends.
If your startup has no internal controls today, that is fixable. If your startup still has no internal controls after your next fundraise, that is a choice your investors will remember. Book a finance function audit with Beyond Elevation and find out where you stand before your investor does.
FAQ
How many internal controls does a startup actually need?
Most startups need five core controls: payment authorisation, bank reconciliation, expense approval, payroll review and access segregation. These cover roughly 80 percent of the financial risk in a company under £20M revenue. Additional controls layer on as the company scales past Series B or enters regulated industries.
At what stage should a startup implement internal controls?
The moment the company has more than one person touching money. In practice, that means before the first institutional fundraise. Investors at Series A and beyond expect basic controls to be in place, and the cost of retrofitting them under due diligence pressure is higher than building them early.
Can a bookkeeper build internal controls?
A bookkeeper can execute controls but should not design them. The person who builds the control framework needs to be independent of the person who handles daily transactions — that separation is the foundation of every control system. This is why most companies bring in a fractional CFO to design the framework and hand it off.
How long does it take to implement internal controls from scratch?
A fractional CFO can implement the five core controls in two weeks and build a complete control framework in three months. The time investment is typically two to four hours per week during the build phase, dropping to under one hour per week for ongoing monitoring.
What is the cost of not having internal controls?
The median fraud loss for companies with fewer than 100 employees is £150,000 per incident according to the ACFE. Beyond fraud, the cost includes misstated financials, delayed fundraises and reduced valuations. Any single one of those outcomes can exceed the total cost of implementing controls by ten times or more.
