Published October 16, 2026. A GAO- and IRS-grounded control design for intake, recording, reconciliation, access separation, exception review, and record retention.
Decision this research supports
A small business deciding whether a bookkeeping assistant should handle incoming payments needs a workflow design, not a generic trust claim. Cash receipts include checks, transfers, card settlements, platform payouts, refunds, and adjustments. The assistant may record and reconcile them, but concentration of custody, recording, adjustment, and approval creates avoidable risk. This review adapts public internal-control and recordkeeping guidance into buyer questions; it is not an audit standard for every private company or accounting advice.
Use objectives and risks before controls
GAO’s Green Book organizes internal control around objectives, risks, control activities, information, communication, and monitoring. Nonfederal businesses may use it as a framework, but should tailor it. Start by naming objectives: receipts are complete, recorded in the right period and account, deposited intact, matched to customers, and available for review. Then identify failure modes such as diversion, duplicate posting, unapplied cash, altered payee details, missing fees, premature refunds, and stale reconciliation items.
Separate incompatible actions
Where staffing permits, the person with custody of a receipt should not be the sole person who records, reconciles, and writes it off. System permissions should separate bank administration, customer-master changes, journal entries, refund approval, and reconciliation review. A small team may not achieve perfect separation, so management should document compensating review, such as owner review of bank activity and adjustment reports. The assistant must not approve their own exception or create a second identity to bypass controls.
Create a daily receipt register
Record source, payer, customer or invoice reference, gross amount, fee, net amount, currency, receipt date, settlement date, destination account, processor identifier, and posting status. Import from controlled sources where possible and preserve the raw report. Unidentified receipts belong in an exception queue, not a guessed customer account. Duplicate identifiers, amount mismatches, unexpected bank destinations, and changed remittance instructions should stop automation and trigger independent verification.
Reconcile three views
A useful reconciliation compares the sales or receivable record, processor or remittance record, and bank settlement. Differences may reflect timing, fees, batching, refunds, disputes, currency, or error. Record each reconciling item with owner, reason, age, evidence, and resolution date. The reviewer should see opening exceptions, new exceptions, cleared items, and closing balance. Clearing an item without evidence merely hides uncertainty. Aging thresholds should escalate to the accounting owner.
Protect records and access
IRS guidance makes the business responsible for keeping records that support tax items for the applicable period. NIST small-business guidance supports controlled access, authentication, backups, and incident planning. Store receipt evidence in approved systems, use individual accounts and strong authentication, review access periodically, and remove it promptly on role change. Avoid placing full bank details or customer personal data in general task tools. Test recovery of both the ledger export and supporting evidence.
Monitor outcomes, not activity
Review unmatched receipt rate, time to post, aged reconciling items, manual journal volume, refund exceptions, changed bank instructions, access-review exceptions, and correction rate. A low exception count is not automatically good; it may mean under-reporting. Sample completed transactions back to raw evidence and forward to the bank. Trend reasons rather than ranking individuals. The owner should use findings to improve system mappings, customer instructions, approval limits, and training.
Method
We reviewed the named primary government sources on October 16, 2026, extracted statements relevant to the workflow, and separated those statements from our operational analysis. We compared the source requirements or guidance with the records an assistant can realistically prepare, route, and preserve. This is desk research, not an experiment, legal opinion, audit, or vendor comparison. A recommendation below is an inference about safer process design; it is not a claim that a checklist guarantees compliance, accuracy, security, or a business outcome.
What an assistant can and cannot own
An assistant can maintain the intake queue, check required fields, attach source records, identify missing information, calculate a due date from an approved rule, route an exception, and preserve the decision trail. The accountable owner must set policy, interpret disputed requirements, approve exceptions, and decide any legal, tax, employment, accounting, security, or customer remedy. Write that boundary into the procedure. A well-run handoff makes retained judgment visible instead of quietly shifting it to the person doing the administrative work.
Implementation pattern
Pilot one representative workflow for two weeks. Give it a named owner, a versioned instruction, a controlled source of truth, required fields, permitted actions, stop conditions, and an escalation route. Collect both ordinary cases and exceptions. At review, examine missing-input rate, queue age, correction rate, approval delay, and whether another authorized person can reconstruct each outcome. Change one control at a time where practical, record why it changed, and set the next review date before expanding scope.
Evidence packet design
A useful evidence packet begins with a stable case identifier and a short cover record: request received, applicable workflow version, current owner, status, due date, and unresolved questions. Attach source records without rewriting them, and create a separate activity log for checks, calculations, communications, approvals, and corrections. Each derived value should point to its inputs and method. Each exception should show what is missing, why it matters, who can decide, and when the case will be revisited. Preserve the submitted version as well as the approved outcome. Restrict sensitive fields to the smallest audience that needs them, and use links to controlled records instead of scattering copies across chat, email, and personal storage. A backup reviewer should be able to locate the governing instruction, reproduce material calculations, distinguish facts from interpretation, and see exactly where accountable judgment entered the process. If that reconstruction depends on memory, the packet is not ready.
Quality assurance and change control
Quality review should combine field validation with consequence-based sampling. Automated checks can detect missing identifiers, invalid dates, duplicate amounts, broken links, and status contradictions; they cannot decide whether a purpose is legitimate, an exception is reasonable, or a conclusion is sound. Define which outputs require pre-release approval and which may be sampled later. Track corrections by category and denominator so a changing workload does not distort the trend. When a rule, source, or system changes, record the change owner, effective date, affected cases, migration decision, and communication. Retest the workflow with an ordinary case, an exception, an unavailable approver, and a correction. The goal is not a perfect-looking dashboard. It is early detection, a recoverable record, and a clear route from evidence to an authorized decision.
Limitations
The cited materials have different purposes and coverage. Federal tax, employment, statistical, consumer-protection, security, and internal-control sources do not automatically apply to every organization, worker, transaction, or jurisdiction. Source pages and underlying rules can change after the checked date. Local law, contracts, industry rules, system design, and the facts of a case may require a different process. Readers should validate applicability with qualified owners and use this framework to organize evidence, not to replace professional judgment.
Buyer conclusion
The staffing decision is strongest when the buyer can name the output, source, authority boundary, acceptance check, and exception owner before delegating. That design lets an assistant contribute useful coordination without being asked to invent policy or make an unreviewed high-consequence decision. Buyers comparing providers should ask to see how work is queued, evidenced, reviewed, corrected, and handed back. The useful proof is a traceable sample and a functioning escalation path, not a broad promise that an assistant can handle everything.
Sources
- The Green Book: Standards for Internal Control in the Federal Government - U.S. Government Accountability Office. Checked October 16, 2026.
- How long should I keep records? - Internal Revenue Service. Checked October 16, 2026.
- Small Business Information Security: The Fundamentals (NISTIR 7621 Rev. 1) - National Institute of Standards and Technology. Checked October 16, 2026.
