Internal controls in accounting: why approval by email is not a control

Internal controls in accounting are the rules that make sure money only leaves the company with the right approval, every booking is correct and complete, and nobody can change the record unnoticed. For a 50-person GmbH that means a handful of controls built into the system: approval limits, separate people for paying and booking, protected bank details, period locks and regular access reviews. A rule that lives in email is a habit, not a control.

Most guidance on this topic is written for listed companies and the US Sarbanes-Oxley regime. A German scale-up needs something smaller and stricter at the same time: fewer controls, but ones that cannot be skipped. This guide shows how to size them, and why automation should add controls rather than remove them.

---

What are internal controls in accounting for a company that is not listed?

A control is a step that either prevents an error or detects it in time. Preventive controls stop a problem before it happens: an approval limit, a blocked account, a second signature on the payment run. Detective controls find it afterwards: a bank reconciliation, a review of manual bookings, a variance check on the monthly figures.

A GmbH is not subject to SOX, but it is not free of control duties either. The GoBD (German digital bookkeeping rules) ask every company that keeps its books electronically to run an internal control system (internes Kontrollsystem, Rz. 100 of the BMF letter). Access rights, segregation of duties, input checks and reconciliations are named as examples, and the controls must be described in the procedural documentation (Verfahrensdokumentation). Since 2021, § 1 of the Corporate Stabilisation and Restructuring Act (StaRUG) also requires managing directors to monitor developments that could threaten the company and to act on them.

There is a tax angle too. The tax authority has stated in its guidance on § 153 of the Fiscal Code (AO) that a tax-related internal control system can be an indication against intent or recklessness when an error in a tax return comes to light. The German Chamber of Tax Advisers published practical guidance for such a system in 2024, which also addresses small and medium-sized companies. None of this demands a compliance department. It demands controls that exist in practice and can be shown.

Why is approval by email not a control?

A useful test for any control has four questions. Can it be skipped? Does it leave evidence? Does it cover every case, or only the ones someone remembered? And can it be changed without anyone noticing?

Approval by email fails all four. Nothing stops a payment from being released before the reply arrives. The evidence sits in one person's inbox and leaves the company with them. Nobody can show that every invoice above the limit was approved, only that some were. And the rule itself, "anything above 5,000 euros goes to the managing director", is written nowhere the system can read, so it changes quietly whenever someone is on holiday.

The same applies to a thumbs-up in chat or an initialled PDF: they show agreement, not that the process could not continue without it. We cover the specific case of manual bookings in journal entry approval at the ledger. The point here is wider: a control must sit in the system where the action happens, or it is not a control.

Which controls does a 50-person GmbH actually need?

Start from where money and records can go wrong, not from a framework. In most companies of this size, seven controls cover most of the risk:

1. Changes to supplier bank details need a second person and a call-back to a known number. Fake "new bank account" emails are one of the most common fraud patterns, and they work because the change is a single field edit. Duplicate and outdated supplier records make it worse, as described in master data quality.
2. Invoice approval limits by amount and cost centre, enforced before booking.
3. The payment run is prepared by one person and released by another, ideally with two signatures at the bank.
4. Manual journal entries above a threshold or on sensitive accounts need a second person before posting.
5. Card limits and spend rules per person or team, with receipts tied to each transaction.
6. Period lock once the month is closed and the BWA (the monthly management report from your tax advisor) has gone out, so last month's numbers cannot shift.
7. Access review every quarter: who can book, who can pay, who can change master data, and whether leavers still have access.

Add reconciliations as the detective layer: bank, receivables, payables and intercompany, done before the month is closed. The month-end close checklist shows where they fit in the close.

What you can leave out at this size: formal control testing every quarter, a separate control owner per process, and a risk matrix with fifty lines. Those belong to listed groups.

How do you segregate duties when finance is three people?

The classic rule is that no single person should be able to create a supplier, approve its invoice, pay it and book the payment. In a team of three, full separation is not realistic. Someone has to cover holidays.

The answer is compensating controls. If one person must hold two roles, make sure a third party sees the result. Three patterns work well:

• Split at the bank, not in the team. The bookkeeper prepares the payment run, the managing director releases it. Even if everything else is done by one person, money cannot leave without a second pair of eyes.
• Review the log instead of every step. A weekly look at all master data changes, manual entries and approvals made by the same person who created the record takes ten minutes and catches most problems.
• Use the tax advisor (Steuerberater) as an outside view. If your tax advisor books or reviews the month, agree on what they check: open items, unusual accounts, entries after the period was closed.

Write down which compensating control covers which gap. That short note is part of your procedural documentation, and it is what an auditor or tax inspector will ask for.

Does automation weaken internal controls?

If software books invoices, matches payments and suggests accruals, who is checking? In practice, automation adds controls, provided it is set up the right way.

A manual process applies a rule when someone remembers it. A system applies it every time, to every transaction, and logs that it did. Approval limits cannot be skipped. A duplicate invoice is flagged before it is paid, not found in the year-end review. Segregation of duties becomes a permission setting rather than a promise.

AI changes the picture again. An AI agent that prepares bookings is a new actor in the process, and it needs the same treatment as a new employee: limited rights, a second person for anything material, and a complete record of what it did. Three conditions matter. The AI suggests and a person approves. Every suggestion and every approval is logged with name, time and reason. And anything the AI does can be traced and corrected with a visible entry. We explain what the GoBD expect from that record in audit trails in accounting, and where the approval boundary sits in AI agents for finance.

How does Agent F help you enforce internal controls?

In Agent F, controls are part of the workflow rather than a layer on top. Approval limits, approval chains and user permissions are set per company, entity and cost centre. An invoice above the limit cannot be booked or paid until the right person approves it. The person who prepares a payment run cannot release it on their own if you configure it that way.

The AI layer prepares work: it reads invoices, suggests accounts and cost centres, matches bank transactions and proposes accruals, each with a confidence score. Nothing is posted without a person's approval. Anomaly detection flags what a human might miss, such as a supplier whose bank details changed shortly before a large invoice, or two invoices with the same amount and reference.

Every action, whether by a person or by the AI, is written to an immutable audit trail. Closed periods are locked. Because finance, procurement and expenses share one data model, a control applies across the whole process instead of stopping at the edge of one tool. The data your tax advisor receives through the DATEV export carries the same approved history.

Before your next close, list the seven controls above and mark each one as enforced in the system, done by habit, or missing. Move the bank detail and payment run controls into the system first, since that is where the money is. Then write a one-page note on your compensating controls and share it with your tax advisor.

Learn how Agent F works, or see it on your own approval rules at agent-f.ai/demo.