Documenting Controls: How to Prove What You're Already Doing

If you’ve ever heard this during an audit—

“Can you show us how this control is documented?”

—and thought but we do this every month, you’re not alone.

In many small governments, controls exist. They’re just not written down. And in the audit world, if a control isn’t documented, it’s very hard to rely on—even if it’s happening consistently.

This post breaks down what documenting controls actually means, why it matters, and how small governments can do it without creating unnecessary paperwork.

What Does “Documenting Controls” Really Mean?

Documenting controls does not mean:

• Writing a 20-page internal control manual

• Creating procedures no one will follow

• Turning your office into a bureaucracy

It simply means:

Writing down who does what, when, and how, and keeping evidence that it happened.

That’s it.

Why Documentation Matters (Especially in Small Governments)

Small governments often rely heavily on:

• One or two people

• Institutional knowledge

• Verbal processes

That works—until:

• Someone retires or leaves

• A question comes up during the audit

• A peer reviewer asks how a control operates

• A board member wants clarity

Documentation:

• Protects staff

• Reduces audit findings

• Speeds up audits

• Makes transitions easier

• Provides consistency year over year

It’s not about distrust. It’s about continuity.

What Controls Should Be Documented First?

Start with areas that auditors focus on most:

1. Bank Reconciliations

Document:

• Who prepares the reconciliation

• Who reviews it

• How often it’s done

• What happens if issues are found

Evidence:

• Initials and date on the reconciliation

• Notes explaining unusual items

2. Cash Receipts

Document:

• How cash and checks are received

• Who records them

• When deposits are made

• Who reviews activity

Evidence:

• Deposit logs

• Receipts

• Review signatures

3. Disbursements

Document:

• Invoice approval process

• Payment authorization thresholds

• Who releases checks or ACH payments

Evidence:

• Approved claims listings

• Check registers reviewed by management or board

4. Payroll

Document:

• Who inputs payroll

• Who approves payroll changes

• How payroll reports are reviewed

Evidence:

• Payroll summaries signed or initialed

• Documentation of new hires and pay changes

5. Journal Entries

Document:

• Who can post entries

• Which entries require review

• How reviews are documented

Evidence:

• Journal entry logs

• Supervisor sign-off

How to Document Controls Without Overcomplicating Things

Use Plain Language

Write procedures the way you’d explain them to a new hire.

Example:

“The clerk prepares the monthly bank reconciliation. The administrator reviews and initials it within two weeks of month-end.”

Clear. Simple. Effective.

One Page Is Often Enough

Most controls can be documented in:

• A short memo

• A simple checklist

• A paragraph in a procedures binder

Longer isn’t better—clear is better.

Tie Documentation to Real Actions

Avoid documenting controls that don’t actually happen.

Auditors will ask:

• Is this control designed?

• Is it implemented?

• Is it operating consistently?

If you can’t show evidence, revise the control—not the story.

What Counts as “Evidence”?

Good documentation evidence includes:

• Initials and dates

• Email approvals

• Board minutes

• Signed reports

• Checklists marked complete

• Notes explaining exceptions

It doesn’t need to be fancy. It needs to be consistent.

Common Mistakes to Avoid

• Documenting controls that are too complex to follow

• Relying on verbal explanations only

• Forgetting to document reviews

• Updating procedures but not practices

• Waiting until audit season to write everything down

Documentation should support your process—not replace it.

For CPAs: How to Help Clients Document Controls

If you advise small governments:

• Start with what they already do

• Help them put it into writing

• Focus on high-risk areas

• Encourage documentation of review, not just preparation

• Keep it realistic

Good documentation improves audit quality and client confidence.

Documentation Is Protection, Not Paperwork

Documenting controls isn’t about creating more work.
It’s about proving the good work you’re already doing.

Even with:

• Limited staff

• Simple systems

• Tight timelines

Small governments can document controls in a way that is:

• Practical

• Defensible

• Repeatable

Strong controls don’t live in binders.

They live in habits—and habits are easiest to defend when they’re written down.