Every company has controls. In a small one they live in the founder's head: nothing is paid without their say, and they know every supplier. As the company grows, that stops working. Writing the controls down is how a company keeps them.
Why write it down
Undocumented controls fail quietly. A new accountant does not know that payments to new suppliers need a second approval. A branch office invents its own purchase process. The person who reconciled the bank every Friday leaves, and nobody notices for three months.
Documentation does three things. It makes the control visible, so someone can check it happens. It makes it transferable, so it survives a change of staff or system. And it makes it defensible, so the board can show investors, lenders and regulators how the company is run.
What the law expects
The Companies Act, 2013 uses the phrase "internal financial controls" and defines it broadly, in the explanation to section 134(5)(e), as the policies and procedures a company adopts to ensure the orderly and efficient conduct of its business: adherence to its policies, safeguarding of its assets, prevention and detection of frauds and errors, accuracy and completeness of its accounting records, and timely preparation of reliable financial information.
- Listed companies. The directors' responsibility statement must say that the directors have laid down internal financial controls and that they are adequate and operating effectively (section 134(5)(e)).
- Most other companies. The Companies (Accounts) Rules, 2014 require the board's report to give details in respect of the adequacy of internal financial controls with reference to the financial statements (rule 8(5)(viii)). One person companies and small companies prepare their board's report in an abridged form under rule 8A.
- Independent reporting. For many companies the auditor's report also comments on the adequacy and operating effectiveness of these controls (section 143(3)(i)), subject to exemptions for certain private companies.
- Audit committee and vigil mechanism. Companies required to have an audit committee must also evaluate internal financial controls through it (section 177(4)(vii)), and certain companies must set up a vigil mechanism for directors and employees to report concerns (section 177(9)).
In every case the starting point is the same: a board cannot say its controls are adequate unless someone can show what the controls are.
The four documents to write first
| Document | What it contains | Who uses it |
|---|---|---|
| Process maps | Each main cycle drawn step by step: purchase to payment, order to cash, payroll inputs, record to report. Who does each step, in which system, with what document | Process owners; new joiners; system implementers |
| Delegation of authority | Who may approve which spend, contract, hire or write-off, and up to which limit | Everyone who approves anything; the bank; the board |
| Risk and control matrix | For each process step: what could go wrong, the control that prevents or detects it, who performs it, how often, and what evidence it leaves | Finance head; the company's own reviewers; the audit committee |
| Standard operating procedures | Short, numbered instructions for each recurring task | The person doing the task |
Start with the cycles where the money moves: purchase to payment and payroll inputs are usually the highest-risk and the easiest to improve.
Delegation of authority
If you write only one document this year, write this one. A delegation of authority matrix lists categories of decision down the side (capital spend, operating purchases, contracts, hiring, credit notes, write-offs, bank signatories) and roles across the top, with a limit in each cell.
- Tie it to the board's own powers. Some decisions must be taken by the board at a meeting (Companies Act, 2013, section 179(3)); others can be delegated by board resolution. The matrix should show which is which.
- Make limits cumulative and unambiguous: per transaction, per supplier per year, or both.
- Match the bank mandate and the ERP approval workflow to the matrix. A matrix the systems don't enforce is a wish list.
- Have the board approve it, and review it once a year.
- Controls that exist only in someone's head disappear when they leave.
- Write the delegation of authority first and make the systems enforce it.
- Every control should leave evidence: a signature, a log entry, a reconciliation.
- Size the controls to the company. Too many and people route around them.
The risk and control matrix
The matrix is where process maps become controls. For each step, ask what could go wrong: a payment to a supplier who doesn't exist, an invoice paid twice, a salary change nobody approved, revenue recorded in the wrong month. Then record the control that deals with it.
- Preventive or detective. A second approval before a new supplier is created prevents; a monthly review of supplier master changes detects. Most processes need some of each.
- Manual or automated. A system-enforced three-way match of order, receipt and invoice is more reliable than a person checking, and cheaper to evidence.
- Owner and frequency. Every control names a role, not a person, and says how often it runs.
- Evidence. If a control leaves no trace, nobody can show it ran.
Resist the temptation to control everything. A growing company is better served by twenty controls that run every time than by two hundred that run sometimes.
Personal data inside processes
Payroll, recruitment and customer processes handle personal data. The Digital Personal Data Protection Act, 2023 requires a data fiduciary to take reasonable security safeguards to prevent personal data breaches (section 8(5)). The Digital Personal Data Protection Rules, 2025 were notified in November 2025, with most obligations of data fiduciaries applying eighteen months after notification. Process documentation is the natural place to record what personal data each step uses, who can see it, and when it is deleted.
Keeping it alive
- Give every document an owner and a review date.
- Change the document whenever the process or the system changes, and before a new system goes live.
- Run a simple quarterly self-check: pick a few transactions and confirm each key control ran and left its evidence.
- Report the results to the board or audit committee in the regular pack, in one page.
Documentation written once for an investor and then shelved is worse than none, because it describes a company that no longer exists. Kept current, it is the cheapest insurance a growing company can buy.
General information as at 25 September 2026, not advice on any particular case. Laws, rules and thresholds change; check the current text or ask your advisers before acting. This note is awaiting desk review (reviewer to be confirmed).