Private companies rarely need a full audit committee, and every one of them needs a small set of financial controls.
Segregation of duties. The person who approves payments should not be the person who enters vendors, reconciles the account, or signs cheques. In a small business this may mean an owner performing a review rather than hiring another person.
Bank reconciliation reviewed monthly by someone other than the preparer, with the statements delivered directly to the reviewer.
New vendor and change-of-bank-details verification by callback to a known number. Payment redirection fraud is the most common financial loss in small businesses and this single control prevents most of it.
Payroll changes reviewed against source documents.
Expense approvals with defined thresholds.
Financial statements produced monthly and reviewed against budget, with variances explained.
Annual external review or audit where lenders, investors or a future sale make it worthwhile.
Board reporting. A short financial package before each meeting rather than at it.
Insurance. Crime and fidelity coverage sized to the exposure, and social engineering coverage, which is frequently a separate sublimit.