Decisions become informal
Spending approvals, supplier changes and unusual payments can depend on habits that are understood by a few people but are not documented or consistently applied.
Financial Controls & Governance | Consult EFC
Clear approvals, reliable reconciliations and reporting responsibilities that keep pace with growth.
Consult EFC helps UK SMEs and technology businesses design and embed practical finance controls. We focus on the risks, people and processes in your business, with a fixed-fee scope agreed before work starts.
The brief
Financial controls are the checks, approvals, reconciliations and responsibilities that support reliable records and responsible use of resources. Governance defines who decides, who reviews and how exceptions are escalated. Controls reduce risk; they cannot remove it completely.
Growth changes the risk
Spending approvals, supplier changes and unusual payments can depend on habits that are understood by a few people but are not documented or consistently applied.
Reconciliations, cut-off, KPI definitions and review responsibilities can become unclear as systems and teams expand. The board sees a number without a reliable explanation.
A founder, finance lead or administrator may hold the knowledge and access needed to keep work moving. Absence or departure exposes the gap.
Start with the risk
We map the finance process, the relevant systems and who performs each task. We then identify where an error, unauthorised action or missing review could matter, and consider controls that are proportionate to the business.
The diagnostic distinguishes a control that has been designed from a control that has been implemented and evidenced. A written policy alone does not show that a review occurred or that an exception was followed up.
We agree the work with your management team and relevant advisers. Specialist cybersecurity, legal, tax, audit and regulated-system requirements may need separate input. This service does not automatically provide an audit opinion or certification.
Explore the detail
Approval limits, supplier bank-detail changes and payment release need clear owners. An exception should have an agreed escalation path and evidence of review.
Illustrative workflow. Actual procedures, inputs, responsibilities and exceptions are agreed for your business.
The workstreams
Supplier onboarding, bank-detail changes, approval limits and payment release responsibilities, with escalation for exceptions and an evidence trail.
A close calendar, balance-sheet reconciliation standards, cut-off responsibilities and documented preparation and review.
Access ownership, joiner and leaver processes, periodic permissions reviews, KPI definitions and controlled versions of reports.
Embedding the change
We work through the proposed controls with the people who will use them. Responsibilities, delegated authority, exceptions and record-keeping should be specific enough for the process to operate during a busy week.
A smaller team may not be able to separate every role. In those cases, management must consider proportionate compensating reviews rather than assume a generic segregation-of-duties chart solves the issue. Management retains responsibility for approval, implementation and operation.
The agreed handover can include process notes, an approval matrix, a risk register, a reconciliation pack and a review calendar. Follow-up testing, ongoing operation and audit liaison are included only where expressly scoped.
Compare the actual scope
If you are weighing a £40k+ Big Four retainer against a focused controls project, compare the actual work and responsibilities. Consult EFC proposes a fixed fee for the agreed brief, with deliverables and responsibilities explained before work starts.
| Compare | Consult EFC project | Large-firm retainer |
|---|---|---|
| Scope | Defined processes, deliverables and implementation responsibilities | Check the written scope, specialist coverage and ongoing commitments |
| Working relationship | Work directly with Kishen Patel | Confirm the team, senior input and day-to-day contact |
| Fee | A fixed fee agreed for the specific brief, with VAT treatment | Compare the quoted fee, duration, assumptions and additional charges |
| Evidence and handover | Agreed documents, owners, review points and walkthrough | Confirm what is built, tested, implemented and handed over |
The £40k+ figure is the comparison scenario used here, not a universal Big Four fee or a like-for-like quotation. Larger engagements can include wider work. Compare written proposals on equivalent scope and responsibility.
Your deliverables
01
The processes reviewed, identified gaps, existing controls, proposed actions and practical owners.
02
A documented authority framework, review points, exception routes and relevant evidence requirements.
03
Agreed templates, reconciliations, calendars, policy notes and access-review routines tailored to your systems.
04
Milestones, training, ownership and a review routine. Ongoing control testing or operation requires its own scope.
How we work
Clarify your objective, audience, information, deadlines, deliverables, responsibilities, fee and VAT treatment.
Assess the records, definitions and assumptions. Identify gaps and any accounting, tax, legal or specialist input required.
Complete the agreed work, document important judgements and review outputs with the relevant people.
Explain checks, limitations, ownership and updates. Additional work and recurring support are agreed separately.
Financial controls are repeatable checks that reduce errors and make problems easier to spot. Financial governance sets out who can make decisions, who reviews them and how exceptions are escalated. The design needs to fit the team that will use it.
For a supplier bank-detail change, document who verifies the request through a known contact channel, who approves it and where the evidence is kept. Then check how those steps actually work when someone is on leave or a payment is urgent.
Assign a preparer and reviewer for key reconciliations. Set a close timetable and a rule for escalating unresolved differences. For a small team that cannot separate every duty, consider an independent review of higher-risk transactions or exceptions.
A useful controls register lists the risk, the check, its owner, its frequency and the evidence it leaves behind. Give priority to changes the team can operate consistently. Reviewing a process and testing how it operates over time are separate pieces of work.
Bring one process that relies on memory, manual work or a single person. We can use it to discuss where the first review should focus.
Your questions
Controls are the specific checks and activities that address risk. Governance establishes responsibility, authority, oversight and escalation. Both need to fit the business and be supported by evidence.
No. A controls design or improvement engagement is not a statutory audit, assurance report or certification. We agree the procedures, responsibilities and limitations of the work.
Yes. We assess the actual people and systems. Where roles cannot be fully separated, proportionate compensating reviews can be considered. Management remains responsible for the final control design and operation.
No. Controls can reduce risk but cannot eliminate it. Collusion, management override, poor operation and changes in circumstances can undermine even a well-designed process.
We can coordinate information and clarify responsibilities where agreed. The auditor determines its own procedures and conclusions. Audit liaison and additional support should be expressly scoped.
We assess the processes, entities, systems, risks, information and implementation needs, then propose a fixed-fee scope with VAT treatment and responsibilities explained.
The timetable depends on the diagnostic, availability of information, people, systems and implementation work. We agree milestones rather than treat a four-week example as a guarantee.
Compare the written scope, deliverables, team, responsibilities, testing, implementation and ongoing support. The £40k+ Big Four comparison on this page is an illustrative comparison scenario, not a universal fee or like-for-like quotation.
Work directly with Kishen
Tell us the objective, where things stand and any important date. A short outline is enough to start.
Kishen Patel is an ICAEW Chartered Accountant with experience across Big Four audit, investment banking and corporate advisory. Consult EFC has advised 100+ businesses and remains sector agnostic.
We agree scope, information, responsibilities, fee, VAT treatment and timing before work begins. An introductory call does not commit you to an engagement.
Prefer to explore first? Use the relevant assessment tool for an immediate planning result and downloadable action plan. It is not professional advice.