Internal controls and the audit trail

What the log is for

Xero History and Notes on a transaction, plus the org’s audit trail, record who created, edited, and reconciled. QBO’s Audit log is the same idea. Use them when a rec breaks, when a payment vanished, and when you inherit a messy file. Do not delete and recreate to “clean history” — void or credit note.

Segregation, even in a family shop

The person who can pay bills should not be the only person who can add a supplier. The person who reconciles should not be the only person who can unlock dates. If the team is three relatives, at least split: one prepares, one reviews the P&L and aging monthly, and lock dates need a second pair of eyes.

• Bank feeds, not typed statements, wherever the bank allows.
• No shared logins. Xero and QBO are licensed per user on purpose.
• Advisor-level lock after close.
• Supplier bank-detail changes get a callback, not just an email.
• Refunds and credit notes over a set amount get a second approval.

Fraud tells in the rec

Round-dollar refunds to new payees, duplicate invoice numbers, a supplier whose address matches an employee, and “consulting” coded around month-end to flatten profit. AI auto-rec will happily OK a familiar-looking payee. Sample. Ask.