How to Improve Internal Controls Before an Audit
An audit can reveal weaknesses that have been sitting quietly inside a business for months or even years.
That does not necessarily mean something has gone seriously wrong. Internal controls can become outdated as a business grows, employees change roles, systems are replaced and financial processes become more complex.
Want expert help? Daintree Consulting's audit and assurance services can take this off your plate. Book a free consultation.
The problem is that weaknesses are often discovered at the worst possible time — when an auditor is already asking questions.
Improving your internal controls before an audit gives your business an opportunity to identify gaps, strengthen processes and organise supporting evidence before the audit process begins.
It can also make the audit more efficient by reducing avoidable questions, missing documentation and last-minute requests.
In this guide, we look at practical ways Australian businesses can review and improve internal controls before an audit.
Quick Answer: How Can You Improve Internal Controls Before an Audit?
Before an audit, businesses can strengthen internal controls by:
Reviewing key financial processes
Checking who has access to financial systems
Separating important responsibilities where practical
Reviewing approval processes
Reconciling accounts regularly
Strengthening documentation and record keeping
Reviewing payroll controls
Checking accounts payable and receivable processes
Monitoring unusual or unexpected transactions
Reviewing access to banking platforms
Updating policies and procedures
Testing whether controls actually operate as intended
Documenting identified weaknesses and corrective actions
Preparing supporting evidence before the audit begins
The goal is not to create unnecessary bureaucracy.
Good internal controls should help protect the business while allowing employees to perform their roles efficiently.
What Are Internal Controls?
Internal controls are the policies, processes, checks and procedures a business uses to manage risk and improve the reliability of its operations and financial information.
They can cover areas such as:
Financial reporting
Payments
Banking
Payroll
Purchasing
Inventory
Revenue
Information access
Asset management
Record keeping
Approvals
Compliance
A control could be as simple as requiring a second person to approve a significant payment.
It could also involve automated system permissions, monthly reconciliations or a formal review of financial reports.
The appropriate controls depend on the size, structure, systems and risks of the organisation.
Why Review Internal Controls Before an Audit?
An audit is not the only reason to have strong internal controls.
However, an upcoming audit can provide a useful reason to step back and examine whether your processes are still working as intended.
Businesses often change faster than their processes.
For example:
A business hires new employees
An accounting system is replaced
A new bank account is opened
A business introduces new payment methods
Responsibilities move between employees
The finance team becomes larger
A business expands into new locations
More transactions are processed electronically
A process that worked well when the business was smaller may no longer provide the same level of control.
An internal controls review can help identify those gaps before they become a larger problem.
1. Map Your Key Financial Processes
Start by identifying the processes that have the greatest effect on financial information and business risk.
Depending on the organisation, this could include:
Sales and invoicing
Customer receipts
Supplier invoices
Payments
Payroll
Banking
Expenses
Inventory
Fixed assets
Financial reporting
Tax and compliance processes
Journal entries
For each process, ask:
Who initiates the transaction?
Who approves it?
Who records it?
Who reviews it?
What evidence is retained?
This simple exercise can highlight areas where too much responsibility sits with one person or where there is no clear review process.
2. Review Segregation of Duties
Segregation of duties is an important internal control principle.
It means, where practical, separating key responsibilities so that one person does not have excessive control over an entire transaction process.
For example, the person who creates a supplier should not necessarily be the same person who approves and pays that supplier.
Similarly, the person preparing a bank reconciliation should ideally have an appropriate independent review.
The exact approach will depend on the size of the organisation.
A small business may not have enough employees to completely separate every responsibility.
In those circumstances, management may use compensating controls such as additional reviews, owner oversight or independent reconciliations.
The important thing is to identify where risks exist and determine whether there is an appropriate control response.
3. Review Financial System Access
One of the easiest areas to overlook is system access.
As employees join, leave or change responsibilities, their access to financial systems should be reviewed.
Check access to:
Accounting software
Online banking
Payroll systems
Expense platforms
Point-of-sale systems
Payment platforms
Cloud storage
Financial reporting systems
Ask:
Does each user still need their current access?
Are former employees still listed?
Can employees approve transactions they should not approve?
Are administrator permissions restricted?
Are banking authorities current?
Are shared logins being used?
A review of user access can identify unnecessary permissions before the audit.
4. Strengthen Payment Approval Controls
Payments are a particularly important area for internal control review.
A business should have a clear process for approving significant payments and changes to supplier information.
Consider whether your process covers:
Supplier onboarding
Bank account changes
Purchase approvals
Invoice approvals
Payment preparation
Payment authorisation
Emergency payments
Electronic transfers
Be particularly careful with changes to supplier bank details.
A request to change payment information should be independently verified using an appropriate channel rather than relying solely on an email instruction.
Clear approval processes can reduce the risk of error and fraud.
5. Check Your Bank Reconciliations
Bank reconciliations are a fundamental financial control.
They help identify differences between accounting records and actual bank transactions.
Before an audit, review whether:
Bank accounts are reconciled regularly
Outstanding items are investigated
Old unreconciled transactions are resolved
Unusual transactions are reviewed
Reconciliations are appropriately reviewed
Supporting documentation is retained
Do not simply complete a reconciliation because it is on the monthly checklist.
The reconciliation should actually be reviewed for unusual or unexplained items.
A control is only useful if someone pays attention to what it is telling them.
6. Review Accounts Receivable Controls
Revenue and receivables can create several control risks.
Review how your business:
Creates customer accounts
Sets credit limits where relevant
Raises invoices
Records receipts
Approves credit notes
Writes off debts
Reviews overdue accounts
Consider whether the same person can create a customer, issue invoices, alter customer information and process adjustments without independent review.
Also review your aged receivables.
Long-outstanding balances may require investigation and appropriate management attention.
7. Review Accounts Payable Controls
Accounts payable should also have a defined process.
Check:
How suppliers are created
Who approves purchases
How invoices are checked
How duplicate invoices are identified
Who approves payments
How supplier changes are verified
How outstanding payables are reviewed
If your business has grown significantly, an informal process may no longer be sufficient.
Documenting responsibilities can make the process easier to follow and easier to review.
8. Strengthen Payroll Controls
Payroll contains sensitive employee and financial information, making payroll controls particularly important.
Review:
Employee onboarding
Employee termination
Pay-rate changes
Timesheets
Leave records
Payroll preparation
Payroll approval
Superannuation processing
Payroll reporting
Changes to employee bank details
Consider whether payroll changes are independently reviewed before the payroll is finalised.
For businesses with larger teams, it may also be useful to periodically review the employee master file for unexpected changes.
9. Review Journal Entry Controls
Journal entries can have a significant effect on financial reporting.
Consider whether your business has a clear process for:
Preparing journals
Supporting journals with documentation
Reviewing journals
Approving material adjustments
Recording unusual entries
Restricting access to manual journals
Particular attention may be appropriate for unusual, large or late-period adjustments.
The objective is not to prevent legitimate accounting adjustments.
It is to ensure that significant adjustments have an appropriate explanation and review.
10. Improve Documentation
A control that exists only in someone's head can be difficult to demonstrate.
Before an audit, review whether important processes are documented clearly enough for another person to understand them.
Documentation might include:
Policies
Procedures
Approval records
Reconciliation evidence
Meeting minutes
Supporting invoices
Contracts
System reports
Review sign-offs
Exception reports
Good documentation creates an evidence trail.
It can also make staff changes easier because employees have a clear reference for how important processes should operate.
11. Check Whether Controls Actually Operate
Having a policy does not necessarily mean you have an effective control.
For example, your policy might state that all supplier invoices require approval.
But what happens in practice?
Before an audit, select a sample of transactions and check whether the stated process was actually followed.
You might test:
Supplier invoices
Payments
Payroll changes
Journal entries
Expense claims
Customer credits
Bank reconciliations
Ask:
Was the required approval obtained?
Is there evidence of the review?
Was the control performed on time?
Were exceptions investigated?
This distinction between a documented control and an operating control is important.
12. Review Exceptions Rather Than Ignoring Them
Controls are rarely perfect.
You may find transactions that did not follow the normal process.
Do not automatically treat every exception as evidence that the entire control system has failed.
Instead, understand why it happened.
For example:
Was there an emergency?
Was the responsible employee unavailable?
Was the transaction misunderstood?
Was the procedure unclear?
Did the system prevent the normal process?
Is the exception happening repeatedly?
Repeated exceptions can indicate that the underlying process needs to change.
13. Review Your Approval Limits
As businesses grow, approval limits can become outdated.
A limit that made sense when the business had $500,000 of annual revenue may not be appropriate when the business is significantly larger.
Review who can approve:
Purchases
Expenses
Payments
Discounts
Credit notes
Payroll changes
Contracts
Capital expenditure
Make sure approval responsibilities reflect current roles and risk.
14. Protect Important Financial Information
Internal controls are not limited to physical documents and accounting transactions.
Financial information is increasingly stored in cloud-based systems and shared electronically.
Review who can access:
Financial reports
Customer information
Payroll data
Supplier information
Banking details
Accounting records
Contracts
Management reports
Access should be appropriate to the employee's role.
Where systems support it, businesses should also consider appropriate authentication and activity monitoring practices.
15. Review Your Fixed Assets
Fixed assets can sometimes receive less attention than revenue and expenses.
Review whether the business maintains appropriate records for significant assets.
Consider:
Asset registers
Asset purchases
Disposal records
Ownership documentation
Capitalisation policies
Depreciation records
Physical existence where appropriate
If assets have been sold, disposed of or replaced, make sure the accounting records appropriately reflect what happened.
16. Look at Inventory Controls
For businesses holding inventory, stock can represent a significant financial balance.
Review controls around:
Purchasing
Receiving
Storage
Stock movements
Stock counts
Adjustments
Damaged goods
Obsolete stock
Inventory write-offs
Consider whether physical stock counts are performed appropriately and whether differences are investigated.
Inventory controls should reflect the nature and complexity of the business.
17. Review Related-Party Transactions
Transactions involving owners, directors, related businesses or other connected parties may require particular attention.
Make sure these transactions are appropriately identified, recorded and supported.
Before an audit, review whether:
Related-party balances are reconciled
Loans are documented
Transactions are recorded consistently
Supporting agreements exist where relevant
Management understands the nature of the transactions
Do not assume that an informal arrangement does not need documentation.
18. Create an Internal Controls Checklist
Once you have reviewed the major processes, create a practical checklist of the controls that matter most.
For each control, record:
What the control is
Why it exists
Who performs it
How often it occurs
What evidence is retained
Who reviews it
What happens if there is an exception
This does not need to become a huge manual.
The objective is to create enough structure that important controls are consistently performed and can be demonstrated when required.
19. Prioritise the Highest-Risk Weaknesses
You do not necessarily need to fix everything at once.
Start with the areas where a control failure could have the greatest impact.
Consider prioritising:
Banking access
Payment approvals
Payroll
Revenue recognition processes
Financial reporting
Significant reconciliations
Manual journal entries
Supplier master data
System access
High-value assets
Once the highest-risk areas have been addressed, work through lower-risk process improvements.
20. Document What You Have Changed
If you identify a weakness and correct it before an audit, keep evidence of the change.
For example, you may:
Update an approval process
Remove unnecessary system access
Introduce an independent review
Update a policy
Add a reconciliation review
Change supplier verification procedures
Introduce additional documentation
Documenting the improvement can help management understand what changed and why.
It also provides useful context when reviewing controls in the future.
Common Internal Control Problems to Look for Before an Audit
Some weaknesses appear repeatedly as businesses grow.
Watch for:
Too much responsibility with one person
One employee can create suppliers, process payments and reconcile the bank without independent review.
Outdated system access
Former employees or people who changed roles retain unnecessary access.
Informal approvals
Important decisions are approved verbally without a reliable evidence trail.
Unreconciled accounts
Balances remain unresolved for extended periods.
Poor documentation
The business performs a control but cannot demonstrate that it happened.
Outdated procedures
Written processes no longer match how the business actually operates.
Manual workarounds
Employees regularly bypass standard systems or processes because they are inefficient.
No follow-up on exceptions
Problems are identified but not investigated or corrected.
These issues do not automatically mean that financial statements are incorrect.
However, they can indicate areas where controls could be strengthened.
Internal Controls and Audit Readiness Are Not the Same Thing
It is important to distinguish between improving internal controls and preparing for an audit.
Internal controls are part of how a business manages risk and operates effectively.
Audit readiness is about ensuring that the business is prepared to provide appropriate information, evidence and access within the scope of the audit.
The two are closely connected, but they are not identical.
A business should not introduce unnecessary controls simply because an audit is approaching.
Instead, use the audit as an opportunity to consider whether existing processes are appropriate for the organisation's current size, complexity and risk profile.
When Should You Review Internal Controls?
Ideally, internal controls should not be reviewed only immediately before an audit.
A business can review them when:
The organisation grows significantly
New systems are introduced
Employees change roles
New banking arrangements are established
The business acquires another operation
There is a significant fraud or error
Financial reporting changes
New risks emerge
An audit identifies control weaknesses
For many businesses, periodic internal control reviews are more useful than treating the process as a once-a-year exercise.
How Daintree Consulting Can Help
Daintree Consulting provides Audit & Assurance support for Australian businesses that need greater confidence in their financial records, controls and reporting.
Internal control support can include reviewing processes, identifying control gaps, considering how responsibilities are structured and helping management prepare for audit or assurance work.
Depending on the engagement, this may involve:
Internal-control reviews
Process reviews
Audit preparation and readiness
Financial reporting review
Documentation and evidence organisation
Identification of control weaknesses
Practical recommendations and action tracking
Coordination around audit requirements
The focus is on understanding the business and identifying improvements that are practical for its circumstances.
Final Thoughts
Improving internal controls before an audit is not about making your business unnecessarily complicated.
It is about making sure important processes are clear, responsibilities are appropriate, financial information is reliable and significant transactions can be supported by evidence.
Start with the areas that carry the greatest risk.
Review system access.
Check payment approvals.
Test reconciliations.
Review payroll.
Examine journal entries.
Strengthen documentation.
Then test whether the controls actually operate in practice.
The earlier you identify weaknesses, the more time you have to address them before they become an audit-day problem.
Strong internal controls can also provide benefits beyond the audit itself. They can support more reliable reporting, clearer accountability and better management oversight throughout the year.
Preparing for an Upcoming Audit?
If you are concerned about internal control gaps or want a clearer view of your audit readiness, Daintree Consulting can help review the processes and reporting that matter.
Book a free 30-minute discovery call to discuss your business and the support you may need before your next audit.
Frequently Asked Questions
What are internal controls in an audit?
Internal controls are the policies, procedures and processes an organisation uses to manage risks and support reliable operations and financial information. Depending on the audit scope, auditors may consider relevant controls as part of their work.
How can I prepare my internal controls for an audit?
Start by identifying key financial processes, reviewing access and approval responsibilities, checking reconciliations, testing important controls, strengthening documentation and addressing significant weaknesses before the audit begins.
What internal controls should a business review before an audit?
Common areas include banking, payments, purchasing, payroll, revenue, accounts receivable, accounts payable, financial reporting, journal entries, system access and asset management.
What is segregation of duties?
Segregation of duties involves separating important responsibilities so that one person does not have excessive control over a complete transaction or financial process. Smaller businesses may use compensating controls when full separation is impractical.
What happens if an internal control is weak?
A weak control does not automatically mean that an error or fraud has occurred. However, it can increase risk or make errors more difficult to detect. The appropriate response depends on the nature and significance of the weakness.
Should a small business have internal controls?
Yes. Internal controls should be proportionate to the size, complexity and risks of the business. A small business may use simpler controls, such as owner review of payments and independent bank reconciliations, rather than a large corporate control framework.
Should internal controls be reviewed every year?
There is no single review frequency suitable for every organisation. Controls should be revisited when the business changes significantly and periodically to confirm that they remain appropriate and are operating as intended.
Can Daintree Consulting review our internal controls before an audit?
Daintree Consulting can provide internal-control and process review support, along with audit preparation and readiness assistance, depending on the agreed scope of the engagement.
Talk to Daintree about your audit
Our ex-Big 4 team gives clear, senior-reviewed advice so you can act with confidence.
Book a free consultation →
Or explore our audit and assurance services.
