Legal service for foreign clients
Internal Controls Design & Internal Audit in Thailand
Close fraud gaps with process, not with trust.
Quick answer
Most mid-sized company fraud is not caused by bad people but by one person who can order, receive, and pay. Sound internal control starts with segregating those duties, setting tiered approval limits, and leaving an audit trail at each step. We design controls proportionate to the business — without adding steps that slow it down — then retest on a cycle to confirm they still operate.
From THB 30,000 — From THB 30,000 per process cycle designed · 3–6 weeks per process cycle
Who this is for
- Businesses that saw irregularities they could not prove
- Multi-branch operations with heavy cash
- Companies preparing for investors or listing
- Family firms professionalizing management
What you receive
- Process maps with control points marked
- A segregation-of-duties and approval-limit matrix
- Control testing results with recommendations
- An annual internal audit plan the team can run
Documents to prepare
- Current procedures and approval manuals
- Organization chart and job descriptions
- Sample purchase, receipt, and payment documents
- User access rights in the accounting system
How it works
5-step process
- 1
Walk the real process
We follow live documents end to end rather than reading the manual.
- 2
Identify the exposure points
Find where one person controls an entire cycle.
- 3
Design workable controls
Controls must cost less than the loss they prevent.
- 4
Test and train
We test live samples and explain the reasoning to staff.
- 5
Retest on a cycle
Controls decay as people change, so annual retesting is required.
In depth
Internal Controls Design & Internal Audit: what foreign clients need to know
Internal audit is not about catching staff out. It tests whether the processes a business wrote down are the ones actually followed each day. Most mid-sized Thai companies lose money through the same familiar gaps: petty cash nobody counts independently, purchasing where the person ordering also receives the goods, and accounting-system access still open for staff who resigned months ago.
Segregation of duties that works in a small team
Control textbooks assume enough headcount to split approval, recording and custody three ways. A company with two people in accounts cannot do that. The workable answer is compensating controls: the owner personally reviews the bank reconciliation monthly, and any amount above a set threshold needs a second signature every time.
We design controls starting where cash leaves the business, because that is where loss happens fastest, then work back to approvals and source documents. That order gives a company its highest-value controls first, rather than a thick manual nobody reads.
Testing real transactions, not circulating a questionnaire
Assessments built on a questionnaire the supervisor fills in themselves usually report that all is well. We instead sample real transactions across several months and walk each one from requisition to purchase order, goods receipt, tax invoice and the bank payment line. Any missing link in that chain is a measurable gap.
Results are reported as an error rate per process alongside the value involved, so management can see which gap to fix first by reference to money at risk rather than gut feel.
Linking internal control to tax and the financial statements
Most control gaps end up as tax problems. Expenses without the documentation the law requires get added back to taxable income, input tax on defective invoices is denied, and stock that does not reconcile to the ledger becomes a matter the auditor must qualify.
We therefore issue two reports: one for management, who must change the process, and one for the accounts team, who must change how entries are recorded and documents filed for inspection. Both draw on the same numbers, so no internal argument arises over who is right.
Cost structure: government fees vs professional fees
| Item | Official fee | Professional fee | Note |
|---|---|---|---|
| Risk assessment and first audit plan | No government fee | THB 35,000–80,000 | Delivers a quarterly plan naming each process and sample size |
| One full internal audit cycle | No government fee | THB 60,000–200,000 by number of locations and transaction volume | Includes both reports and the results meeting with management |
| Building the control framework and operating manual | No government fee | THB 80,000–250,000 by number of processes designed | Includes forms, the approval matrix and one round of user training |
A multi-branch retailer losing tens of thousands of baht in stock monthly
Situation: Book stock exceeded the physical count every month, and nobody could say at which step it disappeared.
What we did: We traced goods from the central warehouse to each branch shelf and found inter-branch transfer notes issued after the fact with no recipient signature.
Outcome: Once receipt signatures were required before a transfer could be posted, the variance fell to an explainable level within two count cycles.
A factory whose expenses were added back during a tax audit
Situation: The company had substantial expenses genuinely paid but lacking the supporting documents the law requires.
What we did: We defined a minimum document set per expense type and placed the checkpoint at payment approval, so incomplete items could not pass.
Outcome: In the following accounting year, not one item was added back for missing documentation.
When to act, and when waiting is fine
Start now if the business has just added branches or purchasing staff
Growth is when old controls break, because what the owner used to watch personally no longer fits in one pair of eyes.
Waiting is fine while the team is tiny and the owner approves every payment personally
Here, invest first in document filing and a monthly bank reconciliation habit, then build the full framework as the team grows.
FAQ
Frequently asked questions
Do small firms need this?
Yes, in simpler form — for example owner approval for every payment above a set limit.
How is this different from the annual audit?
The external auditor opines on statements; internal audit examines whether processes are sound.
We found fraud — what next?
Secure evidence before confronting anyone, then weigh disciplinary, civil, and criminal routes together.
How does internal audit differ from the statutory auditor?
The statutory auditor gives an opinion on the financial statements as the law requires; internal audit tests the processes themselves to cut loss and tax exposure.
Do unlisted companies need it?
It is not mandatory, but companies with high cash turnover or multiple branches usually recover the cost through reduced shrinkage and fewer disallowed expenses.
How often should we audit?
Quarterly for cash and purchasing processes; annually is enough for the rest.
Will the findings expose staff who made mistakes?
Our reports address processes — the weakness and the fix — not individuals, unless we find conduct amounting to fraud, which we report to management directly.
Related services
Forensic Accounting & Fraud Investigation
Evidence that stands in court, not just a suspicion that money is missing.
Statutory Audit by Licensed CPAs
Audit reports accepted by the DBD, with control observations you can act on.
Virtual CFO for Scaling Businesses
Senior finance leadership at a cost a mid-sized company can carry.
Written by: Thai Law & Accounting Services — attorneys and licensed accountants
Reviewed by: Reviewed by a Notarial Services Attorney registered with the Lawyers Council of Thailand.
Last updated: 2026-08
Information as of August 2026. Government fees and processing times change — verify with the relevant agency before acting, or let our team verify for you.