Financial Controls for Startups: A Practical UK Guide

A startup needs a short list of financial controls, put in place early and run every month: separate business and personal money, split who requests a payment from who approves it, reconcile the bank, review the numbers against source documents, and keep records that meet the law. You do not need a finance department to do this. You need a few rules that stop one person from controlling a whole transaction, and the habit of checking them.

This guide is for founders and early finance hires in the UK. It covers what to set up first, how to cope when your team is too small for textbook segregation of duties, and when the controls start to matter to investors.

Consult EFC

Build Investor-Ready Financial Controls

Consult EFC provides strategic financial guidance and investor-ready metrics for UK startups preparing to raise funding or scale.

Explore financial guidance

TL;DR

Financial controls are the rules that keep your money safe, your numbers accurate and your records lawful. Startups need a lean version, not a corporate one.
Start with five: business and personal money kept apart, payment approvals, bank reconciliation, a monthly review, and proper record keeping.
When you cannot separate duties between people, use compensating controls, such as the founder releasing payments and reviewing every transaction at month end.
Weak controls surface in due diligence. Fix them before a funding round or a sale, not during one.
Revisit the set at each stage: pre-seed, first hires, first round, scale-up.

What financial controls are, and why startups skip them
The legal floor: what UK law already requires
The five controls to set up first
What to do when you only have three people
Controls that grow with the company
Why investors and buyers care
Our perspective
A 30-day plan to put controls in place
When to bring in outside help
Common mistakes to avoid
FAQ
Sources

What financial controls are, and why startups skip them

Financial controls are the processes and checks that protect your cash, make your reporting reliable and show that your company follows the rules. They are not the same as bookkeeping. Bookkeeping records what happened. Controls decide who is allowed to make it happen, and who checks afterwards.

Most startups skip them for understandable reasons. There are three people, everyone trusts everyone, and speed matters more than paperwork. The problem is that the habits you form in month three are the ones your company carries into month thirty. One founder with the banking login, the card and the bookkeeping access is efficient until there is an error, a fraudulent invoice or a dispute between co-founders. Then nobody can show what is true.

The cost of lax controls tends to arrive at the worst moment: an investor asks for a reconciled cash position, a buyer’s accountants find unexplained transactions, or HMRC asks a question you cannot document an answer to.

The legal floor: what UK law already requires

Some controls are not optional. Under the Companies Act 2006, every company must keep adequate accounting records, meaning records sufficient to show and explain its transactions. GOV.UK guidance on company and accounting records says these include day-to-day records of money received and spent, plus records of assets and liabilities. It also says you must keep them for 6 years from the end of the last financial year they relate to, and that failing to do so can lead to fines of up to £3,000 or director disqualification.

The same page is clear that a limited company is a separate legal entity, so there must be a clear division between company finances and those of owners and directors. In practice that means a dedicated business bank account, no personal spending through it, and any money you put in or take out recorded properly, for example as a director’s loan.

That gives you the first two controls before you have written a policy.

The five controls to set up first

If you do nothing else, do these. Each takes hours rather than weeks.

1. Keep business and personal money apart

Open a business account in the company’s name and use it for everything. Pay yourself through payroll, dividends or a recorded director’s loan, never by quietly using the company card for personal costs. Beyond the legal point, mixed finances make every later task harder: the accounts, the valuation, the data room.

2. Split requesting from approving

The person who raises a payment should not be the only person who authorises it. Even with two founders, you can set up your banking so that one prepares payments and the other releases them. This is the heart of segregation of duties, which one startup-focused legal guide calls the single most important internal control concept and the one most startups break from day one.

3. Set approval limits

Decide in writing who can commit the company to spend what. A simple version: anyone can spend up to £250 on a pre-agreed budget line, a founder approves up to £5,000, and both founders approve anything above that. Choose figures that fit your burn rate, and review them as you grow.

4. Reconcile the bank every month

Match every line in the bank account to a record in your accounting software. Reconciliation is how you find duplicate payments, missing invoices, unrecognised subscriptions and fraud. Ideally the person who reconciles is not the person who makes the payments. If that is impossible, the second founder should at least review the reconciliation.

5. Keep a source document for every transaction

Every expense needs an invoice or receipt, every receipt needs a business reason, and every document needs to be stored somewhere you can retrieve it. This is also what your obligation to keep records rests on. Use receipt capture in your accounting software, and make “no receipt, no reimbursement” a rule you actually enforce.

What to do when you only have three people

Textbook segregation of duties assumes you have enough staff to divide the tasks among. A seed-stage company often does not. The answer is not to give up. It is to use compensating controls: checks that cover the gap when you cannot separate the roles.

Turley Law’s guidance describes two that work well for lean teams: the founder personally reviewing and releasing bank payments, and a mandatory month-end review of all transactions against source documents. Neither is sophisticated. Both are effective because they put an independent pair of eyes on the money.

Practitioners also stress that a smaller organisation’s controls can be less formal and less structured and still work, provided they focus on preventing fraud and on separating the initiation of transactions from their approval.

Here is how that looks in a team where one person does the bookkeeping:

Task	Who does it	Compensating check
Raising supplier bills	Operations lead or bookkeeper	Founder approves in the bank before release
Adding a new supplier or changing bank details	Bookkeeper	Founder confirms by phone using a known number
Recording transactions	Bookkeeper	Founder reviews the full ledger monthly against source documents
Bank reconciliation	Bookkeeper	Founder signs off the reconciliation and any unusual items
Payroll changes	Whoever runs payroll	Second person checks the payroll summary before payment

The same logic applies to any process where one person prepares something and another approves it. Approval workflows for timesheets are a good illustration of separating submission from sign-off, and the principle carries straight across to expense claims and supplier payments.

Write down every case where one person has to cover two roles, and who reviews it. A documented exception is a control. An undocumented one is a risk.

Controls that grow with the company

The right set depends on your stage. Here is a realistic progression.

Pre-seed, founders only. Business account, dual authorisation if the bank allows it, accounting software with bank feeds, receipts captured, monthly founder review. If you are setting up your books from scratch, our guide to accounting for startups walks through the foundations.

First hires. Add approval limits, a simple expense policy, payroll checks and a supplier onboarding rule. Begin a monthly management pack with cash, burn, runway and variance to budget. Our financial planning guide for startups covers how budgets and forecasts fit alongside the controls.

Around a funding round. Investors will want clean monthly accounts, reconciled balance sheet accounts, a documented approval matrix and a financial model that ties to actuals. For SaaS companies that also means revenue recognition you can explain, and MRR and churn definitions that do not shift from month to month.

Scale-up. Introduce formal delegated authority, a finance calendar with month-end deadlines, access reviews for finance systems, and board-level oversight of risk. Our wider guide to financial controls for growing UK SMEs picks up from here.

Why investors and buyers care

Controls are not just about fraud. They are evidence that your numbers can be trusted, and trust is what funding and valuation rest on.

Listed companies are now held to a higher standard. The FRC’s Provision 29 guidance introduces a requirement for boards to declare the effectiveness of the company’s material controls, and it applies to material controls only, as the board determines, not every control. Provision 29 targets premium listed companies, not startups. But it shows where expectations are heading, and investors in private companies often look for the same maturity: do you know which controls matter, and can you show they work?

The government’s guidance on the new offence of failure to prevent fraud makes a similar point in a different way. The offence applies only to large organisations, so a typical startup is outside it, yet the guidance describes its principles as good practice others may find helpful. If you plan to grow into that bracket, building proportionate fraud prevention early is cheaper than retrofitting it.

The practical test comes in due diligence. Buyers and investors look for unreconciled accounts, unapproved payments, revenue booked inconsistently and a gap between the management accounts and the statutory ones. We cover the usual findings in the finance gaps due diligence exposes in UK SMEs. Every one of them is cheaper to fix in advance.

Our perspective

We work with founders and SME owners who often call us at a moment of pressure: a round is coming, an exit is on the horizon, or growth has outrun the finance function. The pattern is consistent. The businesses that cope best are not those with the most elaborate policies. They are the ones with a handful of controls that someone senior actually owns and reviews.

Our view is that controls should be built backwards from the questions an investor, lender or buyer will ask. Can you show cash to the penny? Can you explain every movement in revenue? Can you show who approved what? If you can answer those without a scramble, your controls are doing their job.

That is also why we think a full-time CFO is rarely the first answer. At seed or Series A, you usually need senior judgement a few days a month: someone to design the control set, set up the monthly review, make the model tie to the ledger and hold the founders to account. That is what a fractional CFO does, and it brings the rigour of larger firms without a full-time salary attached.

— Kishen Patel

A 30-day plan to put controls in place

You can get most of the way there in a month.

Week 1: separate and secure. Confirm the business account is used for everything company-related. Turn on dual authorisation or a payment-release step. Remove shared logins and list who has access to banking and accounting software.
Week 2: write the approval matrix. One page: who can approve what, up to what value, and who approves the approver. Add the rule on new suppliers and changed bank details.
Week 3: clean the books. Reconcile every bank account to date. Chase missing receipts. Clear unexplained items in suspense or director’s loan accounts.
Week 4: start the monthly rhythm. Set a month-end checklist with dates: reconcile, review ledger against documents, produce a short management pack, and have a second person sign it off.

After that, diarise a quarterly review. Ask which controls were skipped, which were circumvented, and which no longer fit the size of the business.

When to bring in outside help

Some situations justify senior input rather than a do-it-yourself approach. If you are preparing for investment, a buyer is asking for due diligence, you have found an error you cannot explain, or you have outgrown your bookkeeper’s capacity, a fractional CFO can set the framework and then step back.

At Consult EFC, our financial controls and governance services are built for exactly this stage, and our fractional CFO services are led by ICAEW Chartered Accountant Kishen Patel. If a funding round is the trigger, our investor-grade financial modelling work makes sure the model and the ledger agree, and if you want to see how your finances would look to a buyer, our due diligence preparation services test them before anyone else does. You can also start from our home page.

Common mistakes to avoid

Treating trust as a control. Trusting your team is sensible. Relying on trust instead of a check is not, and it is unfair to the people involved.
Giving one person every key. The same person creating suppliers, paying them and reconciling the bank is the classic failure.
Approving in chat. A thumbs-up in a messaging app is not an audit trail. Approve in the bank or accounting system.
Never testing the controls. A control that exists on paper but is skipped every month is worse than none, because it creates false comfort.
Waiting for the round. Cleaning up two years of unreconciled transactions under deadline is expensive and visible to investors.

FAQ

What are the most important financial controls for a startup?

Separating business and personal money, splitting payment requests from approvals, reconciling the bank monthly, keeping a source document for every transaction and reviewing the numbers each month. These cover the biggest risks of fraud, error and non-compliance at little cost.

Do startups legally have to have internal controls?

No law prescribes a specific control set for a small private company. However, the Companies Act 2006 requires every company to keep adequate accounting records, and directors are responsible for them. Controls are how you make sure those records are accurate and complete.

How can a startup separate duties with only two or three people?

Use compensating controls. A founder can release all bank payments, review the ledger against source documents each month and sign off the bank reconciliation. Document any case where one person has to perform two steps, and have someone else check it.

When should a startup get a fractional CFO to review its controls?

The common triggers are a coming funding round, a loan application, due diligence from a buyer or investor, or growth that has outpaced your bookkeeper. A fractional CFO can design the control set and the monthly reporting cycle without a full-time hire.