Controls your accounting software should enforce
Which controls accounting software can enforce on its own, such as balanced journals, closed months and numbering, and which still depend on people.
By Achekam · · 5 min read · For Running a business businesses in South Africa, Nigeria, Kenya
Owners often assume that once the books are "in the system", the system is keeping them honest. Some of that is true. Good accounting software refuses entries that cannot be right, stops people changing months that are finished, and makes sure two documents never share a number. But software cannot tell whether a supplier is real, whether a discount was justified, or whether the person approving a payment actually read it.
Knowing where that line falls tells you what to test, what to trust and where a person still has to look. This article sorts the controls a small business can expect its software to enforce from the ones that stay with its people.
Two kinds of IT control
ACCA draws a useful distinction. General IT controls help ensure systems operate as intended and produce reliable output: who can sign in, how changes are made, how data is protected. Application controls are automated and designed to ensure complete and accurate recording of data from input to output: the checks built into each screen and each posting.
Investopedia defines internal controls more broadly as the processes and procedures a company uses to keep records accurate, prevent fraud and improve efficiency. Software is one part of that system, not the whole of it.
For a small business, the practical question is narrower: when someone types something into the books, what will the software refuse?
Checks on what goes in
These are the application controls worth expecting from any accounting system, and how Achekam applies them.
Every journal must balance
ACCA lists arithmetic and accounting controls, such as reconciliations and trial balances, among the common control procedures. The most basic is that debits equal credits. In Achekam, an unbalanced journal is refused outright, rather than being saved with a warning.
Finished months stay finished
In Achekam, months can be soft-closed, hard-closed and locked. A closed month refuses postings from every source, not just manual journals, and reopening a hard close needs a second approver. Before closing, the screen checks that the ledger balances and that no posting suggestions, unposted bills or unmatched bank lines are waiting.
Corrections leave a trail
A posted journal in Achekam is corrected only by a reversal. Nobody can quietly edit last month's entry; the original and its correction both stay in the ledger.
Numbers that cannot collide
Issuing a customer invoice takes the next number in its sequence and posts it to the ledger. At the till, several tills can run at once, and the server hands out receipt numbers so two tills never share one. On the purchasing side, a supplier's invoice number stops a matched supplier invoice being posted twice.
Imports that must add up
When a bank statement is imported, Achekam checks that the opening balance plus the movements equals the closing balance. A statement with a missing page fails the check, instead of leaving a silent gap in the bank account.
Who can get in
General IT controls start with access. A business on Achekam can set its own IP allowlist and two-factor sign-in rules, and they bind outsiders too: a member of an accounting firm opening the business's books must meet that business's own allowlist and two-factor rules. The firm's people do not get a side door.
Access controls are only as good as their upkeep. Remove people who have left, review who holds administrator rights, and require two-factor sign-in for anyone who can approve payments. Our article on two-factor sign-in goes further.
What software cannot do
Investopedia gives authorisation of invoices, verification of expenses and limiting physical access to cash, inventory and equipment as examples of preventative controls. Software can route an invoice to an approver. It cannot make the approver read it.
These stay with people:
- Judgement. Whether an expense was for the business, whether a price was fair, whether a customer deserves credit.
- Review. Reading the management accounts, questioning variances, and following up what looks odd. ACCA lists management controls such as variance analysis for this reason.
- Matching that needs a decision. In Achekam, bank lines are matched by suggestion, but a person accepts each match, and a reconciliation completes only when nothing is left unexplained.
- Physical controls. Locking the cash box and the stock room is outside any ledger.
- Segregation of duties in a small team. Software can enforce it where it is built in. In Achekam's payroll, for example, a pay run is approved by someone other than the person who prepared it, and nobody can approve a run that pays themselves. But if one person holds every role, no system can split them.
A checklist for testing your own set-up
Run these tests once, on a quiet afternoon, and write down what happened:
- Try to post a journal that does not balance. It should be refused.
- Try to post a journal into a month you have closed. It should be refused.
- Try to change a posted journal. You should only be able to reverse it.
- Check that invoice numbers run in sequence with no gaps you cannot explain.
- Try to enter the same supplier invoice number twice for the same supplier.
- Sign in from an address outside your allowlist, if you use one. Access should be refused.
- List every user with administrator or approval rights. Each one should be someone who needs it.
- Pick three payments from last month and check who approved each, and whether that person could also have created it.
If a test passes, you can rely on the software for that control. If it fails, or if the honest answer to number eight is "the same person", you have found a gap to close with a person, a rule or a change of roles. For a framework that ties these pieces together, see the COSO framework for a small business.
Where to read more
ACCA's article on internal controls, the control environment and segregation of duties explains general and application controls and lists the common control procedures. Use it to decide which of the people-dependent controls above your business needs most, and give each one a named owner.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
