The Financial Control Framework Every Scaling Business Needs

One person requesting a payment, approving it, and reconciling the account it came out of — that's not delegation, that's a blind spot. In this episode, Melissa breaks down the "2% rule" (aka separation of duties) using a real client story: a $4,200 payment that looked like fraud, wasn't, but exposed a gap that could have cost a lot more.

What's inside this episode:

• The real story of a $4,200 payment that sent a founder into a spiral — and what it actually turned out to be
• The "2% rule": why no single person should be able to request, approve, and reconcile a payment
• Why this gap tends to show up right when founders start delegating (usually between 5–15 employees)
• How to set up an approval threshold in tools you probably already use, like QuickBooks Online or Ramp
• Why financial controls are about protecting your team, not suspecting them
• The exact two-hour fix one founder put in place — and the one question you can ask yourself this week to find your own gap

This episode is for you if: You've handed off bill pay, invoicing, or vendor management to someone on your team — and haven't thought about who's checking that work.

No Se Habla Taxes is the podcast for creative agency owners who want to understand the financial side of their business — without drowning in spreadsheets. Hosted by CPA and fractional controller Melissa Armstrong, each episode unpacks real operational finance questions through candid stories and practical insight. Subscribe to the newsletter at steadyhandaccounting.com for episode recaps and financial insights delivered straight to your inbox. 

Not sure if your business is healthy or just busy? No Se Habla Confusion is a $500 financial assessment for creative agencies on QBO doing $300K–$3M. I dig into your numbers, find the gaps, and tell you exactly where you stand. Email info@steadyhandaccounting.com — subject line: No Se Habla Confusion. 

Let's connect!

LI: https://www.linkedin.com/in/armstrongmelissacpa/

Website: https://steadyhandaccounting.com/

Transcript

Copy Transcript Copied

0:40

Hey, it's Melissa. Welcome back to No Se Habla Taxes, the podcast where we talk about the money stuff nobody explained to you when you started your agency. I'm a CPA and fractional controller, and every week, I take something that sounds either terrifying or terminally boring and turn it into 15 minutes you can actually use. Before we get into it, let me apologize for missing last week. I've been buried with work, which can be a good thing, but my producer has informed me more than once that she's not thrilled about me being MIA, and she's right to be annoyed. So sorry. I am back, and I'll try not to make it a habit. Today's topic falls into the terrifying/boring category, which is my favorite kind. We're talking about financial controls, And before you skip ahead because that sounds like a compliance seminar, let me tell you about the day one of my clients found out that one person on her team could approve a payment, send the payment, and reconcile the payment all without another human being ever laying eyes on it. Let's just say that she did not sleep well that night. So a couple of years ago, I picked up a client, I'm gonna call her Dana, who ran a 12-person branding agency. Dana was the classic founder who built the plane while she was flying it. Early on, she did the books herself, and then hired an operations manager, we'll call her Priya. And she handed Priya everything; bill pay, invoicing, vendor relationships, the banking logging, all of it. And listen, I understand why. Dana wanted it off her plate. Priya was sharp, organized. She had a system for everything, so it felt efficient. It felt like delegation done right. Then one afternoon, Dana was skimming the bank feed, mostly out of habit, and saw a payment for $4,200 to a vendor she didn't recognize. 123 Acme Printers, not a name that she had ever seen on an invoice. So this is when she started spiraling. She called me convinced that she had been robbed by her own operations manager. So we dug in, pulled the trail together. Turns out the agency's print vendor, Acme Print Co., had rebranded and Priya had simply updated the vendor record and paid the new invoice like she always did. No theft, no drama, just, you know, completely legitimate transaction. But there was something that Dana couldn't shake. It wasn't that the payment was fraudulent because it wasn't. It's that she had absolutely no way of knowing that from where she sat. One person had requested it, approved it, sent it, and would also have been the one reconciling it at month end. If Priya had wanted to pay herself or a fake vendor or her cousin's LLC, the system would've waved it through with a smile, which is a genuinely fun way to discover that you have no idea what's actually leaving your bank account. Dana didn't fire Priya. It wasn't her fault. She trusted her completely, and honestly, she still does. What she fixed wasn't the person, it was the structure. That's what we're discussing today, because this isn't really a story about a bad employee. There isn't one in here. It's a story about a business that outgrew its financial guardrails before anybody noticed that the guardrails were gone The technical term for this is separation of duties, but let's just call it the 2% rule. No single person in your business should be able to initiate a payment, approve the payment, and reconcile the account it came out of. That's the whole concept. Three jobs, and ideally not all three sitting in one chair. Here's why this matters more as you scale and not less. When you're a three-person shop, you probably are the whole financial system. You see everything because everything runs through you. But somewhere between 5 and 15 employees, most founders hand off the day-to-day and step back. That is healthy. That's the goal. It's supposed to happen. The problem is when you hand off the day-to-day without also splitting up who can do what. You don't need three finance employees to fix this. You need three checkpoints. Maybe Priya still enters the bill and initiates the payment, but Dana or a second team member has to approve anything over a certain amount before it goes out, and then separately, someone who isn't Priya reconciles the bank account each month and actually looks at what cleared. Hint, hint, that's where I come in. That's it. That's the whole framework: who requests, who approves, who reviews after the fact. If the same name is in all three boxes, you have found your gap. Once you know who should be checking whom, the next question is how. And this is 10 times less painful to set up than it sounds. Most bill pay tools built into QuickBooks Online, and most standalone ones like Ramp already have approval workflows sitting there unused. You can set a dollar threshold, say anything over $500, for example, requires a second approval before it's released, and the system will actually enforce it instead of relying on somebody remembering to ask. If you're not ready for software, an email works. I don't love it, it's not my favorite, but it's better than nothing. A rule that says nothing over a certain amount goes out without a thumbs up from somebody else in writing is a real control. It's not fancy, but it creates a paper trail and it creates a pause. Fraud and honest mistakes both love speed. A built-in pause is often all it takes. The threshold number isn't the point. The point is that it's there. It exists. Everybody knows it, and it's not optional based on how busy the week is. I wanna be careful here because this is the part where founders start mentally auditioning their team for a true crime podcast, and this is not what we're doing here. Most financial fraud in small businesses isn't a mastermind. It's an ordinary person under ordinary financial pressure who happens to notice that nobody would check. The pattern behind almost every case I've seen isn't malice from day one. It's opportunity plus no oversight sustained over time. A slightly inflated expense report that nobody questioned, a vendor that got paid twice and the refund never made it back, a vendor that quietly stopped being a real vendor at all. Controls are not about assuming the worst of your people. They are about not putting anyone in a position where the worst version of a bad month is also the easiest option available Good controls protect your team as much as they protect you. Nobody has to be the one person who could have taken something and didn't. None of this means that you have to go back to doing your own books at 11:00 PM. That's not what we're advertising here. Delegation is still the goal. The difference is you can't disappear. You have to be an active participant, and you need visibility. In practice, that looks like a few new habits. You keep access to your bank account and your QBO, even if you never touch the day-to-day. You actually open the monthly report that somebody is sending you, not just forward it to your inbox's, you know, miscellaneous folder. And you have somebody outside the daily operation, an accountant, a fractional controller, essentially a second set of eyes to look at the full picture on a regular cadence. You still trust your team, but a team that has only internal eyes on its own money is essentially a business with a blind spot, a blind spot in the structure. Dana's fix ended up taking about two hours to set up a $500 approval threshold in her Ramp account, a standing rule that she personally reviews anything that is flagged, and a monthly quarter hour where she actually reads the reconciliation instead of skimming the total. Priya kept doing 90% of what she was already doing. The only thing that changed was that no single person, including Dana, could move money without somebody else seeing it. So here is what I want you to actually do this week, not just nod along. Take 10 minutes and ask yourself one question: Who in my business can approve a payment, send a payment, and reconcile that account all by themselves? Write down the name of that person. If that person is anyone other than nobody, meaning if there's one person who touches all three, set up one checkpoint before Friday. It can be as simple as a dollar amount that requires your sign-off or a rule that you personally glance at the bank feed every Monday. You don't need a system overhaul. You need one pause point that didn't exist last week. Financial controls will never be the sexiest topic on this podcast. That's okay, because they are the difference between a scare that can cost you a bad night's sleep, like Dana had, and a scare that costs you real money that you never see again. If you're sitting there realizing you genuinely don't know who can touch what in your financial systems, that is exactly the kind of thing that we dig into in the No Se Habla Confusion Assessment. It's a flat-fee, 90-minute conversation and an independent look at your books, and you walk away actually knowing where the gaps are instead of guessing. Email me at info@steadyhandaccounting.com and use the subject line No Se Habla Confusion, and we'll take a look. Until next time, take care of your people, take care of yourself, take care of your numbers, and remember, in this corner of the world, no se habla taxes.