Accounting controls help professional-service firms authorize work, bill accurately, protect funds and produce reliable records. Each control should name the person responsible, when the check occurs, the evidence retained and how exceptions are resolved. Controls reduce risk; they cannot guarantee that every error or fraud will be detected.
This article is part of our guide to industry accounting specialties.
Assign responsibility at each financial handoff
Separate authorization, custody of funds, recording and review where practical. The employee entering a supplier invoice should not be the only person approving and releasing the payment. The person issuing a client credit or refund should not also provide its only review.
In a small practice, complete separation may be impractical. Use compensating controls: an owner reviews bank information obtained directly, approves defined payments, reviews reconciliations and investigates unusual credits, write-offs and payroll changes. A signature added without examining the supporting evidence is not an effective review.
| Area | Suggested control | Evidence |
|---|---|---|
| Engagement and rates | Approve scope, pricing, rate changes and billing terms before use. | Signed agreement, rate history and approved changes. |
| Client billing | Check the invoice against contractual billing rights and supported work. | Time or milestone support and billing approval. |
| Supplier payments | Approve the supplier invoice before releasing payment; verify bank changes independently. | Purchase support, approval and verification record. |
| Receipts and refunds | Apply receipts to the correct client; approve refunds and credits independently. | Deposit detail, customer ledger and refund authorization. |
| Payroll | Approve employee and pay changes before processing; compare the run with the approved records. | Change authorizations, register and funding reconciliation. |
| Expenses | Require business purpose, support and approval by someone other than the claimant. | Receipt, claim and approval. |
| Bank and cards | Reconcile regularly and obtain an independent review of unresolved items. | Statements, reconciliations and reviewer notes. |
| Access | Use individual accounts, appropriate permissions and prompt updates on departure or role change. | Access list and dated review record. |
| Client funds | Apply the profession’s safekeeping, accounting and disbursement rules. | Client-level ledgers, reconciliations and required authorizations. |
| Close and reporting | Reconcile supporting schedules and investigate significant exceptions. | Close checklist, adjustments and action log. |
Choose the review frequency according to transaction volume, risk and applicable requirements. Each payment and pay change needs appropriate authorization; bank reconciliation and management reporting commonly fit a monthly process. A fixed weekly timesheet deadline is a possible operating policy, not a universal rule for every service model.
If this raises questions about Monthly Financial KPI Dashboard, “A Practical Owner Dashboard: Financial KPIs Worth Reviewing Monthly” addresses it directly.
Distinguish billing, revenue and collections
A time entry records effort. An invoice asserts a contractual amount due. Revenue reflects the accounting framework’s recognition requirements, and a collection changes cash. These events can occur on different dates.
For U.S. GAAP contracts within Topic 606, assess the contract criteria, including collectibility, identify the performance obligations and determine when or as they are satisfied. The basis for recognizing revenue over time must be supported. An unconditional right to consideration is presented as a receivable; a right dependent on further performance may be a contract asset. FASB’s revenue-recognition implementation Q&As discuss these distinctions.
Do not automatically bill or accrue every aged time entry. It may represent authorized billable work, an unapproved scope change, work included in a fixed fee or effort that cannot be recovered. Review the contract and performance evidence, then determine the appropriate billing, recognition or adjustment. Cash-basis and tax reporting require their own rules; a GAAP project schedule is not automatically taxable income.
Late time or expense entries also require judgment. Determine the correct period under the accounting basis, the materiality of the error and whether previously issued statements are affected. A blanket instruction to accrue everything or post everything into the following month can produce incorrect results.
Adapt controls to the billing model
- Time and materials: retain approved rates and effective dates, review time classifications and discounts, and support reimbursable expenses under the agreement.
- Fixed fee: approve scope and changes, compare effort with the project budget, and retain evidence supporting contractual billing milestones and revenue recognition.
- Recurring services: confirm the service period, renewal and cancellation terms, authorized price changes and any obligations continuing after an invoice is paid.
- Advances and retainers: determine ownership of the funds, what earns the fee, refund obligations and any professional safekeeping requirements before configuring the ledger.
In a medical practice, reconcile charges, contractual adjustments, payer and patient receipts, and unapplied balances. In an engineering or consulting practice, reconcile project records with the general ledger without treating hours logged as automatic revenue. Client and patient information used in the accounting process should be limited to what the task requires and handled under the applicable confidentiality rules.
Florida law firms need specific trust procedures
For Florida lawyers, Chapter 5 of the Rules Regulating The Florida Bar governs client and third-party funds. Advances against fees and costs are held in trust, separately from the lawyer’s property. A true retainer paid for availability is distinct from an advance against future billed services. Naming a payment “retainer” does not resolve that distinction.
The rules require specified trust records and monthly reconciliations, including comparison of reconciled trust-account balances with client trust ledgers. Follow the complete rule and applicable fee requirements. A contract’s expiry or rollover clause cannot override professional obligations. Client trust cash should not be treated as the firm’s available operating funds.
Verify payment changes through an independent channel
A changed supplier bank account deserves more than a review of the email requesting it. Confirm the change using an established contact and independently obtained telephone number, then document who verified it and who approved the update. The FBI’s business email compromise guidance recommends independently verifying payment requests and changes to account numbers or payment procedures.
Apply a similar control to unusual refunds, new payment destinations and urgent requests that bypass normal approval. Preserve the original request and verification evidence. Do not let the person changing payment details provide the only approval for the resulting payment.
Know what assurance the engagement provides
Bookkeeping maintains transaction records. An internal-controls consulting assessment examines how transactions are authorized, recorded and checked. Neither automatically supplies an assurance opinion on the financial statements or controls.
The AICPA distinguishes compilation, review and audit engagements: a compilation provides no assurance; a review provides limited assurance based primarily on inquiry and analytical procedures; an audit provides reasonable, high but not absolute assurance and an opinion under the relevant reporting framework. Independence requirements also differ.
A preparation engagement under AR-C section 70 provides no assurance. Applicability depends on the actual engagement, not merely whether software produces a financial statement. SSARS No. 27 clarifies that AR-C 70 need not apply when financial-statement preparation is not the primary objective of an engagement performed under CS section 100 consulting standards. It does not create a blanket exemption for all advisory work.
The clarification is effective for financial statements for periods ending on or after December 15, 2026, with early implementation permitted, as explained in the AICPA and CPA.com implementation FAQ. Confirm the standard, reporting period and agreed scope before relying on the deliverable.
Implement controls with evidence and follow-up
- Map how work, invoices, cash and records move through the practice.
- Prioritize client funds, payments, payroll and other material risks.
- Assign approval and review responsibilities, including a backup when someone is absent.
- Document required evidence and exception escalation.
- Check a sample of completed transactions to see whether the controls actually operated.
- Track unresolved exceptions to an owner and due date, then confirm the correction.
Reassess after a system change, staffing change, new service model or recurring exception. For assistance defining an accounting-controls engagement, contact CPA Firm South Florida with the current workflows, records and reporting requirements.
This connects to Business Email Compromise Controls — see “Business Email Compromise: Accounting Controls That Reduce Risk” for the details.
Frequently asked questions
Does time recorded by staff automatically become billable revenue?
No. Check the contract, authorized scope, billing rights, performance completed and applicable accounting framework. Time records can support the analysis but do not establish every condition for billing or revenue recognition.
Can one person handle bookkeeping in a small firm?
Yes, but concentrated duties need oversight. Separate payment approval where possible, give an owner direct access to bank information and arrange an independent review of reconciliations and unusual transactions. Document any remaining gaps.
Is an internal-controls assessment the same as a financial-statement review?
No. A consulting assessment of accounting procedures does not automatically provide assurance. A formal financial-statement review is a separately defined engagement under the applicable professional standards and provides limited assurance.