How do you know?
Every control exists to answer one question. A binder of policies isn't the same as knowing.
For thirty years, whenever someone walked into my office to tell me an account was fine, a wire was good, a vendor was paid correctly, I asked the same four words: how do you know?
The answers told me everything. The good ones were boring: "Because two people signed off, and here's the log." The dangerous ones were warm: "Because Maria handles that, and Maria's been with us forever."
I believe in Maria. I've met a hundred Marias and they are, almost without exception, honest, careful, and underpaid. But "Maria handles that" is not a control. It's a dependency. If Maria is out sick the week something goes wrong — or if, one time in a thousand, Maria is the thing going wrong — you have no answer to the question. And the question always gets asked eventually. By an auditor, by an insurance adjuster, by a partner, or by you, at 2 a.m., after the money is gone.
A control is anything that lets you answer "how do you know?" in one sentence, with evidence,
without asking Maria.
Notice what's missing from that definition: binders. Most companies I visit have a policies document somewhere — written for an insurer, a lender, or a lawyer — that describes a company that doesn't exist. The binder says invoices over $5,000 require two approvals. The bookkeeper, who is fast and trusted, approves them alone, because the second approver is busy and the vendors are familiar. The binder isn't lying, exactly. It's just fiction.
Knowing looks different. Knowing is small, specific, and checkable. Here are three questions worth asking this Monday morning:
Who can move money out of the company, alone? List the names. Every name on that list is a single point of failure — not because they're dishonest, but because they're alone.
If a vendor emailed new bank details today, what would happen? If the honest answer is "we'd probably update them," that's the most expensive sentence in your business. (More on this next week.)
When did someone last look at the bank activity who doesn't also create it?Separation isn't about suspicion. It's about making sure one tired person's mistake doesn't become the company's mistake.
None of this requires a bank's bureaucracy. At the bank we had hundreds of people and a control for everything; a fifteen-person company needs maybe six controls, chosen well. The art is in the choosing — putting the answer where the question is most expensive.
Start with the four words. Walk the money's path through your company and ask it at every step. Where you get a one-sentence answer with evidence, move on. Where you get a warm feeling and a name, stop. That's where we'd begin.