Financial Controls Audit
Could one person in your business raise and approve a payment alone?
For most Auckland small businesses, the honest answer is yes - and that's how invoice fraud happens. Our financial controls review finds the gaps in how money moves through your business, before someone else does.
- Remote & friendly
- No jargon
- Flat fee, no upsells
- NZ-based
- high
One person can raise and approve payments
Payments leave the business on a single login. Fix: turn on dual authorisation in your bank and Xero - free, takes an afternoon.
- medium
Supplier bank-detail changes go unverified
No call-back step before paying a changed account number - the exact gap invoice scams rely on. Fix: a two-line verification rule.
- low
Former bookkeeper still has Xero access
Two inactive logins retain payment visibility. Fix: remove, then review user access quarterly.
6
Controls reviewed
5–7
Business days to report
$0
Cost of most fixes
30 min
Walkthrough call included
Cybersecurity stops the intruder. Controls stop the money leaving.
Invoice scams and payment redirection are among the most common ways NZ small businesses actually lose money - and they don't need a hacker. They just need nobody double-checking.
One fake invoice
A scammer emails a convincing invoice, or “updates” a real supplier's bank account number. If nobody verifies the change by phone, the money is gone.
One person, end to end
When the same person can create a supplier, raise an invoice, and approve the payment, there's nothing standing between a mistake - or fraud - and your bank account.
Nobody's watching the feed
Small unusual payments hide easily when reconciliation is rushed or skipped. Most fraud is discovered months late - by accident.
Six ways money leaks out of a small business
A plain-language review of how payments actually happen in your business - practical checks, no judgement.
Payment approval workflows
Who can pay whom, from which accounts, and with whose sign-off. We map the real process - not the one written down.
Can a single person send money out of the business unchecked?
Separation of duties
Raising, approving, and reconciling payments should involve more than one set of eyes - even in a two-person business, there are practical ways to do this.
Does the person who pays the bills also check the bank statement?
Supplier & bank-detail changes
The classic invoice-scam vector. We check whether a request to change a supplier's bank account would be verified before the next payment run.
If a supplier emailed new bank details today, would anyone call to confirm?
Fraud-risk indicators
Patterns that make fraud easy to miss: dormant supplier accounts, round-figure payments, invoices just under approval thresholds.
Would a $980 invoice from an unfamiliar supplier raise any flags?
Reconciliation & oversight
Whether someone genuinely reviews the bank feed against invoices, how often, and whether the owner still sees the numbers.
When did you last look at every payment that left your account?
Accounting software access
Xero and MYOB user roles, admin rights, and - the one we find most often - ex-staff and old bookkeepers who still have access.
Who can log into your Xero right now, and what can they do there?
This is a practical controls review, not a formal accounting audit - we check whether your systems would catch fraud or error before money leaves, and we say so plainly in the report.
What you walk away with
One flat fee. Four concrete things. Nothing on subscription.
- 01
A written report in plain English
Every gap explained without jargon, ranked High / Medium / Low by how urgently it needs attention.
- 02
A prioritised action plan
What to fix first, what can wait, and what's already fine. Most fixes are process changes that cost nothing to implement.
- 03
A 30-minute walkthrough call
We go through the report together, answer anything, and make sure you know exactly what to do next. No drama, no upsell.
- 04
Documentation for your insurer or bank
Evidence of your payment controls and the improvements made - the thing cyber-insurance renewals increasingly ask for.
Sound familiar?
One person handles all the money
You, your partner, or one trusted staff member does invoicing, payments, and reconciliation. It works - until it doesn't.
You handed off the books and stopped looking
The business grew, someone else took over invoicing, and you haven't reviewed a payment run in months.
Your insurer or bank is asking questions
Cyber insurance renewals increasingly want evidence of payment controls. Our report gives you something concrete to show them.
You've had a near miss
A suspicious invoice, a dodgy “bank details changed” email, a payment that almost went through. You caught it this time.
Remote, friendly, done in days
Same process as our security check - no site visit, no disruption, no jargon.
- Step 01
A 30-minute chat
We talk through how money actually moves in your business - who invoices, who approves, who reconciles. No preparation needed.
- Step 02
The review
With read-only access to your accounting software (or a screen-share if you prefer), we check user roles, approval settings, and payment patterns.
- Step 03
Report + walkthrough call
A plain-language report with a prioritised action plan, and a call to walk through it. Most fixes cost nothing to implement.
Reviewed by people who speak both languages
SecCheck pairs CompTIA Security+ certified cybersecurity experience with a professional accounting and financial-controls background. The same Auckland team that runs your security check runs this one - so the two halves of your risk are reviewed by people who understand how they connect.
Simple, flat pricing
One price, one report, no upsells. Book the combined check and save $150.
Security Check
Core cybersecurity review for small teams.
$400NZD · one-off
- Email & phishing exposure
- Account security & MFA
- Website & domain health
- Device & backup hygiene
- Plain-language report + walkthrough call
Financial Controls Check
Just the money side - how payments are raised, approved, and reconciled.
$350NZD · one-off
- Payment approval workflows
- Separation of duties assessment
- Supplier & bank-detail change verification
- Fraud-risk indicators review
- Xero / MYOB access review
- Plain-language report + walkthrough call
Security + Financial Controls
Everything in both checks, reviewed together in one engagement.
$600NZD · one-off
Save $150 vs booking both separately
- All Security Check items
- All Financial Controls items
- Risks connected across both reviews
- Single combined report + walkthrough call
- Prioritised action plan
Common questions
Straight answers about what a controls review does - and doesn't - involve.
Find the gaps before someone else does
One flat fee, one plain-language report, and a walkthrough call. Most controls fixes cost nothing to implement.
Book your check