A control is only as good as the document that enforces it. A policy says two people approve a wire. The bank’s set-up decides whether they do.
So each test below starts from what the bank, the statements and the workbooks say, not from what the policy says.
The four questions
| The question | What to read | It fails when | How common | The full test |
|---|---|---|---|---|
| Can one person move money alone? | Each bank's signature mandate and online-banking entitlement report, beside the payments policy. | Any bank lets one person release a wire, or add a payee and pay it. | More than a third of offices send 100 or more payments a month (BofA, 2025). | Run it yourself |
| Is every account in the reports? | One month of every bank and custodian statement, the entity register, the latest consolidated report. | A statement traces to no entity, or an entity to no line in the report. | A third of offices manage 50 or more bank accounts (BofA, 2025). | Run it yourself |
| Is the report rebuilt by hand? | The workbooks behind the latest quarterly report. | A figure is typed in, not linked to the statement it came from. | About a third of offices do more than half their reporting by hand (Campden Wealth and AlTi, 2025). | Run it yourself |
| Does one person hold a recurring task? | A list of every task that recurs, with who knows it and where it is written. | One name, nothing written, and a due date inside the next month. | 65% of offices worry about keeping key staff (Campden Wealth and AlTi, 2025). | Run it yourself |
The order to run them
Money first. It is the test of the door money leaves through. NIST’s standard is one line: “do not allow a single individual to both initiate and approve a transaction,” executives included (NIST IR 7621 Rev. 1).
Accounts second. An account nobody reports is an account nobody reconciles, and the first test cannot see it.
Then the two that slow the office. A report rebuilt by hand, and a task only one person knows, rarely lose money on their own. They are how the first two go unnoticed.
What a checklist leaves out
A checklist asks: is there a payments policy? Is there a list of entities? Is there a procedure manual?
Each can be answered yes while the bank lets one person release a wire, a trust sits outside every report, and the manual has not been opened since it was written. These four tests ask a different question: does the document that actually runs the money agree with the one that describes it?
Frequently asked
What internal controls does a family office need?
Four that documents can settle: no one moves money alone, every account is in the reports, reports trace to statements, and no recurring task lives in one head. The tests above check each one.
Can we run these ourselves?
Yes. Every test uses documents the office already holds, and each linked note gives the steps.
How often?
Once in full. Then the money test whenever a signer, a bank or an online-banking administrator changes, and once a year regardless.