In the first year of Cafe Oldrock, Jay and I could both pay any supplier from any account at any hour. It felt efficient. It was also the single largest risk in the business, and neither of us saw it, because we trusted each other completely. Trust was never the problem. The absence of structure around it was.
Most small African businesses run this way. The founder pays, the founder approves, the founder reconciles, and when the team grows to eight or twelve people, one trusted manager inherits all three jobs at once. Nothing goes wrong for a long time. Then something does, and the business discovers it has no way of knowing how long it has been going wrong.
Controls protect people, not just money
The usual objection is cultural. Founders worry that introducing a second signature tells a loyal manager they are suspected. I understand the instinct. But a control is not an accusation. It is the thing that lets you say, with evidence, that your people did nothing wrong when a number does not add up.
Without controls, every discrepancy becomes personal. A missing ZAR 4,000 in a business with no separation of duties has only one explanation available: someone took it. With controls, it has several: a duplicated invoice, a supplier error, a bank charge, a timing difference. The structure gives honest people somewhere to stand.
The three controls that matter at small scale
You do not need an audit committee. You need three habits, and they cost almost nothing.
Two signatures above a threshold. Pick a number that matters to your business, and require two people to approve any payment above it. At Oldrock the threshold was low enough to catch any meaningful supplier payment and high enough that daily petty purchases did not stall. Most banking platforms in Zimbabwe and South Africa now support dual authorisation natively. Turn it on.
Separate the person who pays from the person who records. The manager who releases a payment should not be the same person who enters it in the books. In a team of ten, this may mean the founder records and the manager pays, or the reverse. It does not matter who does which. It matters that one person cannot do both.
A monthly reconciliation someone else reads. Bank statement against books, every month, signed off by a person who did neither of the above. Twenty minutes. The value is not in catching fraud. It is in catching drift: the subscription nobody cancelled, the supplier who quietly raised prices, the fee that doubled.
Where small teams get this wrong
They build controls after the incident. By then the conversation is poisoned. Every new rule reads as a response to a specific person, and the team knows exactly who. Controls introduced on a calm Tuesday, before anything has happened, are just how the business runs.
They let the founder sit outside the system. If the founder can bypass dual approval, the team learns that controls are for them and not for you. I put my own payments through the same process as everyone else’s. It is slower. It is also the only way the rule means anything.
They confuse software with control. An accounting package is a record. It does not stop the same person from creating a supplier, approving the invoice and releasing the payment. The control is the separation of people, not the tool.
What changes when you do it
The first thing you notice is that conversations about money get calmer. Questions become procedural instead of personal. A manager can say “the second approval is pending” instead of “I am waiting for TC,” and the business stops routing every rand through one inbox.
The second thing is that the business becomes legible to outsiders. When an investor, a bank or a buyer asks how cash moves through the company, you can answer in a paragraph. That paragraph is worth more in a diligence process than most founders realise. Investors read governance before they read growth.
The third is that you can leave. Controls are what make it possible to spend a week in Sandton without the Harare business either stalling or running unsupervised.
The honest cost
Controls are friction, and friction is felt most on the days you can least afford it. There will be an urgent supplier payment on a Friday afternoon when the second approver is unreachable, and you will resent the rule you wrote. Some of your team will read the change as distrust no matter how you frame it, and a few conversations will be uncomfortable. You will also have to submit to your own system, which is the part founders find hardest. Pay that cost early, while the business is small and calm, because the alternative is paying it later in a far worse currency.
