Internal controls and segregation of duties for growing Philippine companies

Internal controls are the policies, procedures and system settings that make sure transactions are authorized, recorded accurately and protected from loss or fraud. The most fundamental is segregation of duties (SoD): no single person should control a transaction from start to finish. As a Philippine business grows from a founder-run company into a group with many branches, controls need to move from personal trust to designed processes.

The core idea of segregation of duties

Separate four functions for any important process:

When one person can authorize, hold and record, errors and fraud go undetected.

SoD conflicts to avoid

When you are too small to separate everything

Smaller teams can't always separate duties fully. Use compensating controls: management review of reports, mandatory vacations with job rotation, surprise counts, and independent reconciliation by someone outside the process.

Key controls by area

Access controls

• User accounts tied to individuals, never shared
• Roles grant only what the job needs
• Access reviewed quarterly; separated employees removed on their last day
• Changes to master data (suppliers, customers, prices, salaries, bank details) logged and approved

Approvals

• Approval matrix defined and enforced in the system (approval workflows)
• No self-approval
• Split transactions to avoid limits flagged

Reconciliations

• Bank accounts reconciled monthly by someone who does not handle cash
• Subledgers (AR, AP, inventory, fixed assets) reconciled to the general ledger
• Physical counts of inventory, cash, PDCs and assets compared to records

Physical controls

• Cash and checks in secure storage with custody logs
• Inventory areas restricted; gate passes for property leaving the premises (gate pass guide)

Fraud red flags

• Suppliers with addresses or bank accounts matching employees
• Round-number invoices just below approval limits
• Frequent manual journal entries near period end
• Inventory adjustments without counts
• Employees who never take leave and resist sharing tasks
• Customers with many credit memos

A quarterly control self-assessment

Ask each process owner to confirm, every quarter:

1. Who has access to create, approve and change transactions in their area, and is it still appropriate?
2. Were all required reconciliations performed and reviewed on time?
3. Were there any overrides of approvals, and were they justified?
4. Were there any losses, errors or near misses, and what changed as a result?
5. Are there new processes, branches or systems that need controls?

Internal audit or the finance head reviews the answers and tests a sample. The goal is to find gaps before auditors or fraudsters do.

How systems strengthen controls

Controls on paper rely on people remembering them. Controls in a system are applied every time:

• Role-based permissions that prevent conflicting access
• Workflow enforcement: no payment without an approved voucher
• Activity logs showing who did what and when
• Exception reports for unusual transactions

Cirquolus supports page permissions and predefined permission groups, and activity logs provide log views and permission-based access for oversight. Financial management adds approvals and voucher review, and inventory and asset audits support independent verification.

Frequently asked questions

What is segregation of duties?

Dividing authorization, custody, recording and reconciliation among different people so no one can complete and conceal an error or fraud alone.

What are examples of internal controls?

Approval limits, segregation of duties, access controls, reconciliations, physical counts, secure storage and activity logs.

How do small finance teams handle segregation of duties?

Use compensating controls such as management review, independent reconciliation, job rotation and surprise counts.

How often should user access be reviewed?

At least quarterly, and immediately when employees change roles or leave.