Accounts Receivable Internal Controls Every Finance Team Needs

Accounts receivable internal controls are the policies, approvals, system settings, and reviews that make sure every receivable is valid, recorded accurately, collected, and reported correctly. They protect a company against errors, fraud, and misstated financial statements across the full receivables cycle, from extending credit to applying cash and writing off bad debt.

What Are Accounts Receivable Internal Controls?

Accounts receivable internal controls are the procedures a company uses to make sure receivables are real, complete, correctly valued, and properly collected. They include who can approve credit, who can issue credit memos, how payments are applied, how the AR subledger is reconciled to the general ledger, and who can access and change receivables data in the system.

Controls are part of a company's broader internal control over financial reporting. For public companies, management must assess these controls under Section 404 of the Sarbanes-Oxley Act, and receivables are often one of the key processes in scope.

Why AR Controls Matter

AR controls matter because accounts receivable is usually one of the largest current assets on the balance sheet and sits close to cash. Weak controls allow errors to build up in customer balances, make fraud such as lapping possible, distort the aging report and bad debt estimates, and lead to audit findings.

Good controls also make daily operations better. When credit, invoicing, cash application, and adjustments follow defined approvals, collectors work from accurate balances and customers receive correct statements.

Key Risks in the Accounts Receivable Cycle

The main risks in the AR cycle are extending credit to customers who cannot pay, recording invoices that are inaccurate or fictitious, misapplying or diverting customer payments, issuing unauthorized credit memos or write-offs, and reporting receivables that do not reconcile to the general ledger or are overstated because the allowance is too low.

Each risk maps to a stage of the cycle:

Segregation of Duties in Accounts Receivable

Segregation of duties in accounts receivable means dividing key tasks among different people so that no single employee can both commit and conceal an error or fraud. The core rule is that the person who handles or records cash receipts should not also be able to approve credit memos, write off balances, or reconcile the AR subledger.

Duties that should be held by different people include:

When one person can receive a payment, apply it, and issue a credit memo, that person can steal the payment and cover the shortfall with a credit. Separating these steps removes that opportunity.

Controls Across the AR Cycle

Effective AR controls are built into each stage of the receivables cycle, so problems are prevented where they start rather than found at month end.

Credit Approval Controls

Credit approval controls make sure customers are evaluated before they receive terms. They include a written credit policy, a credit application for new accounts, credit checks using bureau data and payment history, approval thresholds by credit limit, and periodic reviews of existing limits. Scoring customers consistently through structured credit management keeps credit decisions documented and comparable across the team.

Invoicing Controls

Invoicing controls make sure every shipment or service is billed once, accurately, and promptly. They include matching invoices to sales orders and delivery records, sequential invoice numbering, review of unusual pricing or manual invoices, and checks for unbilled shipments at period end.

Cash Receipt and Application Controls

Cash receipt controls protect payments from the moment they arrive until they are applied. They include using lockbox or electronic payments rather than mailed checks where possible, restrictive endorsement of checks, daily deposits, applying payments using remittance data, and reviewing unapplied cash every day. Automated cash application with a trail back to the original receipt makes it clear how every payment was split across invoices.

Payments that sit unmatched create risk and confusion. Unapplied cash should be aged and cleared on a fixed schedule, with an owner for every item.

Approvals for Credit Memos and Adjustments

Credit memos and balance adjustments should require approval from someone other than the person who requested them, with a documented reason and supporting evidence. Approval thresholds should rise with the amount. Disputes that lead to credits should be logged with an owner, reason, and resolution, which structured dispute management records with a full history.

Write-Off Controls

Write-off controls make sure balances are removed only when they are truly uncollectible and properly approved. They include a written write-off policy, required evidence of collection efforts, an approval matrix by amount, and a monthly review of all write-offs by customer and approver, so that writing off accounts receivable always follows the same documented steps.

Write-offs also feed the estimate of future losses, so the allowance for doubtful accounts should be reviewed against actual write-off history at least quarterly.

Reconciliation and Review Controls

Reconciliation controls confirm that the AR subledger agrees with the general ledger and that reconciling items are explained. A monthly accounts receivable reconciliation, prepared by one person and reviewed by another, is the control auditors rely on most. Management review of the aging report, credit balances, and large adjustments adds a second layer.

System Access Controls

System access controls limit who can create, change, or delete receivables data. They include role-based permissions, restricted access to customer master data such as addresses and bank details, approval for changes to credit limits, locked closed periods, and an audit trail that records who changed what and when.

Preventive vs Detective AR Controls

Preventive controls stop errors and fraud before they occur, while detective controls identify them after the fact so they can be corrected. A strong AR control environment combines both, because preventive controls alone cannot stop every issue and detective controls alone allow problems to occur.

Compensating Controls When Duties Cannot Be Split

When a team is too small to fully separate duties, compensating controls reduce the risk. Common compensating controls include management review of every credit memo and write-off, a supervisor reviewing the monthly reconciliation and bank deposits, mandatory vacations or job rotation for staff handling cash, and sending customer statements directly from a person who does not handle receipts.

Customer statements are a particularly strong detective control, because customers who are being shortchanged by lapping or misapplied payments often notice and call.

Testing and Monitoring AR Controls

AR controls should be tested at least annually and monitored continuously through regular reports. Testing confirms that each control is designed correctly and operating as intended, usually by sampling transactions such as credit approvals, credit memos, and reconciliations and checking for evidence of review.

Ongoing monitoring uses exception reports, such as credit memos above a threshold, write-offs by user, manual journal entries to the AR control account, and unapplied cash older than 30 days. External auditors perform similar testing during an audit of accounts receivable, so well-documented controls also shorten audit fieldwork.

AR Internal Controls Checklist

Automating AR Controls in Salesforce

Automation strengthens AR controls by applying the same rules to every transaction, recording who did what, and making exceptions visible without manual reports. Approvals, history, and permissions that live in the system are easier to test than controls that depend on email and spreadsheets.

Quick Receivable runs inside Salesforce, so receivables data follows Salesforce's role-based permissions and field history. Credit applications link to a credit risk scorecard, disputes keep their owner, reason, and resolution history, and cash application records trace every applied amount back to the original cash receipt. Teams that also need reporting oversight can review aging, overdue balances, and collector results from an accounts receivable dashboard.

Weak controls are what make accounts receivable fraud possible, and schemes such as lapping and fictitious credit memos depend on one person controlling both cash and customer balances.

Frequently Asked Questions