pro · Lesson 4 · 8 min
Internal controls and the audit trail
Cloud software logs who posted. It does not stop one person doing everything. Design the habits the log will show.
Dotted words have a reminder. Hover on a computer, tap on a phone.
From earlier
- QBO
- P&L
- lock date
- CPA
What the log is for
Xero History and Notes on a transaction, plus the org’s audit trail, record who created, edited, and reconciled. QBO’s Audit log is the same idea. Use them when a rec breaks, when a payment vanished, and when you inherit a messy file. Do not delete and recreate to “clean history” — void or credit note.
Segregation, even in a family shop
The person who can pay bills should not be the only person who can add a supplier. The person who reconciles should not be the only person who can unlock dates. If the team is three relatives, at least split: one prepares, one reviews the P&L and aging monthly, and lock dates need a second pair of eyes.
- Bank feeds, not typed statements, wherever the bank allows.
- No shared logins. Xero and QBO are licensed per user on purpose.
- Advisor-level lock after close.
- Supplier bank-detail changes get a callback, not just an email.
- Refunds and credit notes over a set amount get a second approval.
Fraud tells in the rec
Round-dollar refunds to new payees, duplicate invoice numbers, a supplier whose address matches an employee, and “consulting” coded around month-end to flatten profit. AI auto-rec will happily OK a familiar-looking payee. Sample. Ask.
Check
Choices shuffle each visit. Misses send you back to the section. Look back clears the quiz so you can try again. Practice drills deal a new problem on try-again.
Choose an answer, then check.
This try
Shared Xero logins are a problem because:
Practice this
Stay in the flow — open a drill without backing out to the list.