1. The Building Blocks of a Reliable Control System
Effective controls rest on a simple idea: no single person should control a financial transaction from start to finish. Separating who approves, who records, and who holds the money makes theft and error much harder to hide.
Recognized standards give this structure a common vocabulary. The COSO Internal Control—Integrated Framework groups controls into five parts: the control environment, risk assessment, control activities, information and communication, and monitoring. New York corporations do not have to adopt COSO by name, but its logic guides most sound systems.
Segregation of Duties
Segregation of duties spreads authority so that approving, recording, and holding funds sit with different people. The table below shows how splitting incompatible functions closes the most common gaps.
| Financial Function | Risk If One Person Controls It | Better Owner |
|---|---|---|
| Approving payments | Unauthorized or inflated payments | Manager or officer |
| Recording transactions | Concealed entries and cover-ups | Bookkeeper or accountant |
| Bank access and custody | Direct diversion of funds | Separate custodian |
| Reconciling accounts | Undetected discrepancies | Independent reviewer |
Many small companies say they lack the staff to divide these roles. A practical fix is a compensating control, such as owner review of monthly bank statements before anyone else handles them.
Audit Trails and Documentation
An audit trail records who did what and when, so every entry can be traced back to a source. In practice that means ERP system logs, approval histories, electronic signatures, and change records that flag edits after the fact.
Documentation gives those trails substance. New York corporations should retain the core records that support each transaction:
- Invoices and receipts that justify each payment.
- Written approvals or authorization forms for spending above set limits.
- Monthly bank reconciliations tied to the general ledger.
- Journal entry support that explains adjustments and accruals.
2. Where Weak Controls Create Legal Exposure in New York
Poor controls do more than distort numbers. They open the door to criminal conduct and civil claims that reach the people running the company.
New York treats employee theft as larceny under Penal Law Article 155, and embezzlement of company funds falls within that definition. Once stolen amounts cross set dollar thresholds, the charge rises to grand larceny, with felony exposure at higher values. Beyond any prosecution, the corporation may pursue civil recovery, and an insurer may deny a claim when basic controls were absent.
Falsified records create a separate risk. Under Penal Law Article 175, making or altering business records with intent to defraud is a crime, and the offense becomes a felony when it conceals another crime. Backdated invoices and adjusted ledgers are frequent triggers, which is why an accounting fraud inquiry often starts with the ledger itself.
Directors and officers carry a matching duty. Business Corporation Law Section 717 requires directors to act in good faith and with the care of a reasonably prudent person. That standard includes financial oversight, so monitoring internal controls is part of the job, not an optional extra. Ignoring known weaknesses can support a breach-of-duty claim, and disputes over accounting compliance often trace back to steps the board skipped rather than misunderstood.
3. Federal and New York Requirements Are Not the Same
Public and private corporations answer to different rulebooks, and confusing the two is a costly mistake.
Publicly traded companies must meet the federal Sarbanes-Oxley Act. Section 404 requires management to assess internal control over financial reporting and, for larger filers, requires an auditor to attest to it. Private New York corporations are not bound by Section 404, yet they still answer to state larceny, records, and fiduciary standards.
- Public companies: Sarbanes-Oxley Section 404 assessments, external audit oversight, and federal record rules apply.
- Private companies: New York Penal Law and Business Corporation Law set the baseline, along with lender or investor demands.
- Both: shareholders may inspect books and records under Business Corporation Law Section 624.
The lesson is that having no SEC filing does not mean having no control obligations.
4. Building Controls That Hold Up under Scrutiny
A defensible system depends less on software and more on consistent habits. The steps below give a starting framework that scales as the business grows.
- Write down each control so procedures survive staff turnover.
- Require a second signature or approval above a set dollar amount.
- Reconcile bank and credit accounts monthly, and have someone outside the recording role review them.
- Keep supporting documents long enough to answer an audit or a subpoena.
- Review system access rights whenever roles change or employees leave.
Periodic testing matters as much as design. An occasional independent review, coordinated through accounting oversight and audit support, confirms that controls work in practice rather than only on paper.
5. Frequently Asked Questions
What is segregation of duties in accounting?
Segregation of duties means no single employee handles a transaction from approval to recording to payment. Splitting these roles reduces the chance that one person can commit and then hide fraud. In a very small office, owner review of statements can stand in until staffing allows a full split.
Are internal controls legally required for New York corporations?
No single statute forces a private New York corporation to adopt a named control framework. Even so, larceny and business-records laws, plus the director duty of care under Business Corporation Law Section 717, create real pressure to maintain them. Public companies face a stricter mandate under Sarbanes-Oxley Section 404.
6. Review Your Internal Controls before a Loss Occurs
Closing control gaps early costs far less than responding after fraud surfaces or a shareholder raises questions. A periodic, independent review of authorization, recording, and reconciliation duties helps New York corporations catch weaknesses and manage legal risk. Treat that review as routine maintenance for both the books and the board's oversight duty.
06 Apr, 2026
