Internal controls that make fraud hard and errors visible.
Approval workflows, segregation of duties, payment controls and reconciliation discipline — designed, documented and tested. Most losses in small and mid-sized businesses are not sophisticated. They are the result of one person having end-to-end control of a process.
experience
worked across
in one team
What our internal control services cover.
Controls are not paperwork. They are the specific points in a process where a mistake or a theft would be caught before it costs you anything.
Control environment review
We walk every process that touches money and document where one person can both start and finish a transaction.
Segregation of duties
Separating who requests, approves, processes and reconciles — with compensating controls where your headcount is small.
Approval workflows
Delegation limits matched to real risk, set in the system, with an audit trail of every approval.
Payment and banking controls
Dual authorisation, verification of supplier bank detail changes, and control over new payees — where fraud succeeds.
Payroll and master data controls
Who can add an employee or change a pay rate, and who independently reviews it before release.
Documented policies and procedures
Procedures written in language your team will follow, so the control survives the person holding it.
Control testing
Periodic testing that controls are actually performed — an unperformed control creates false comfort.
Audit assistance
Schedules, reconciliations and documentation for your auditor, plus help with prior management letter points.
We design, document and test internal controls. We are not auditors of your financial statements, and we do not conduct forensic investigations or expert evidence work. [ASSUMPTION — confirm with HSC Edge: whether fraud investigation support is offered, and whether control testing is provided as a standalone engagement or only alongside ongoing finance work.]
Controls handle the known risks. A risk framework finds the rest.
Internal controls protect the processes you already know about. Enterprise risk management asks the broader question — what could materially damage this business, how likely is it, what would it cost, and who owns doing something about it.
We help build and maintain a risk register that is actually used: risks identified with the people who run the operations, rated on a consistent basis, mitigation assigned to a named owner with a date, and reviewed on a cycle rather than written once for a board pack and never opened again.
Book a consultationFraud prevention and control design for businesses where one person holds too much.
Nobody asks for a control review because they distrust their team. They ask because the exposure has become obvious.
One person does everything in the ledger
Where the same person enters suppliers, processes payments and reconciles the bank, the issue is not the individual — it is that nothing would catch an error or a theft. We design compensating controls that work at that team size.
Informal trust has stopped being a control
What worked at five staff does not work at fifty. As approvals, volumes and locations multiply, controls that were understood rather than written start to fail quietly.
Someone is accountable for oversight
Where a board, committee, funder or grant body expects demonstrable financial governance, we document the control framework and the risk register in a form that stands up to that scrutiny.
Find the gaps, close the ones that matter, check they stayed closed.
Not every gap is worth a control. We prioritise by what could actually cost you money or credibility.
Map what happens now
We walk each finance process with the people who perform it — not as it is written, as it is done — and record who can do what in the accounting and banking systems.
Design controls you can run
Each material gap gets a control sized to the risk and to your headcount. A control that is too onerous to perform will be skipped within a month, which is worse than not having it.
Document, implement, then test
Procedures written down, responsibilities assigned, system permissions changed to match — then tested periodically, because the only evidence a control works is that it is still being performed.
Designing controls requires having seen them fail.
Control frameworks copied from a template tend to cover what is easy to write down and miss what is actually exposed. Knowing which gap matters — and which one is theoretical — comes from having worked inside businesses where something went wrong.
Our principals are Chartered Accountants with more than 20 years across commercial, government, not-for-profit and regulated environments, including audited and grant-funded entities where control documentation is examined by someone external.
Control questions.
If yours isn't here, send it through and we will answer it directly.
Book a consultation01We only have two people in finance. Is segregation of duties even possible?
Not fully, and pretending otherwise is how template frameworks fail. The answer in a small team is compensating controls — owner review of specific reports, dual bank authorisation, independent verification of payee changes — which get most of the protection without the headcount.
02Do you investigate suspected fraud?
Our focus is prevention and detection through control design and testing, not forensic investigation or expert evidence. If you suspect something has already happened, tell us and we will be clear about what we can assist with and where you need a specialist forensic or legal adviser.
03Are you auditing us?
No. This is not a statutory audit and we do not issue an audit opinion on your financial statements. We design, document and test controls, and we assist your external auditor with the information they request.
04Will this slow our team down?
Badly designed controls do. We set approval thresholds so that routine low-value transactions move freely and scrutiny concentrates where the exposure is. If a proposed control costs more in friction than it protects against, we will not recommend it.
05What does this cost?
A control review is normally quoted as a fixed-scope engagement once we know how many processes, entities and systems are involved. Ongoing testing and risk register maintenance can then be provided on an agreed periodic basis.
Find out where you are exposed.
Tell us how your finance team is structured and who can move money. We will set out what a control review would examine and which gaps we would expect to find first.
We reply to every enquiry directly — no call centre, no sales script.