A financial-controls checklist for lean teams
An internal controls small business checklist built for lean teams: seven controls that survive a two-person finance function, and where to start first.
Maverick spend is off-contract buying that quietly erodes negotiated savings. What causes it, what it costs, and fixes a lean finance team can run.
Maverick spend is any purchase made outside an existing contract, preferred supplier or approved channel when one was available.
If you have no agreement for a category, buying it wherever is not maverick spend. The term means you negotiated a price and then someone paid a different price for the same thing.
It shows up as a full-price purchase from a supplier you have a discount with, or a subscription bought on a card while a group licence sits unused. None of it looks like waste in isolation, and each has a sensible reason attached.
The maverick-spend research in the procurement literature is consistent: off-contract buying erodes between 5% and 16% of negotiated savings, and each dollar brought under procurement management yields 6% to 12% in savings.
The second figure is the one that pays for the work: this is about coverage, not about catching people. Ardent Partners research puts average spend under management at 57.1%, against 91.5% for best-in-class organizations. At a typical company, two of every five dollars are spent with nobody watching the price, and in a small group with no procurement function it is worse.
It happens because in the moment the compliant path is slower, less visible or more punishing than the alternative. Four causes account for nearly all of it.
Something breaks. A crew is idle. A customer is waiting. The person on the ground makes the fastest call available, and it is rarely the contracted one, because contracted suppliers come with account numbers, order minimums and delivery windows.
This is the most defensible kind. You do not fix it by tightening rules, you fix it by making the contracted path fast enough to survive a bad Friday.
Most groups have no list of what has been negotiated and with whom; the knowledge lives in the owner's head and an email thread from two years ago. You cannot ask people to buy on contract if they cannot find out what is on contract, and this is the cheapest cause on the list to fix.
Even where people know a supplier is preferred, they rarely know the terms. Is the discount 8% or 22%? Without that, a cheaper list price elsewhere looks like a win, and the buyer makes a locally rational, globally expensive decision.
This is the cause people are least willing to name. If following the process means a form, a two-day wait and a chasing email, while going around it means buying the thing and filing a receipt, your process charges a fee for compliance. Any control that makes the correct path slower than the incorrect one gets routed around by competent staff. That is a design failure, not a discipline failure.
In a group, maverick spend hides behind entity boundaries, because no single set of books shows the pattern.
Each entity's ledger looks reasonable alone. The leak appears only when you add up one category across all entities and find four suppliers, three price points and no leverage. Volume that would have earned a discount was split into pieces too small to matter. Spend authority is also delegated by location, so the location lead optimises their own site and cannot see the group buying the same item elsewhere for less.
A group of four operating entities each buys packaging and shipping supplies locally.
Entity A buys from a national distributor at a negotiated 18% off list, arranged three years ago by the owner. Entity B buys locally because delivery is same-day. Entity C buys on a card from an online retailer at list price. Entity D buys from the same distributor as Entity A, on an account its own manager opened, at list price, because nobody knew the group agreement existed.
Annual spend is similar across the four. Three are paying more than they need to, and one of those three is overpaying a supplier the group already has terms with. That is the purest form of maverick spend: same vendor, same product, worse price, because information did not travel.
The fix costs nothing. Consolidate the accounts onto the group agreement, put the combined volume into the next negotiation, and keep the local supplier for same-day needs with a ceiling.
Pull one year of spend by vendor across every entity, sort by total, and read the top thirty rows.
Look for three patterns: one category under several vendor names, one vendor under several account numbers, and any category above a meaningful annual total with no agreement behind it.
Then estimate coverage: what share of total spend sits with vendors where you have negotiated terms? That is your spend under management, and against the 57.1% average and 91.5% best-in-class figures from Ardent Partners it tells you how much room you have.
The exercise depends on ledgers being current and consistently coded across entities. If coding varies by entity, the report is noise.
Five things, in order, none needing a procurement function.
Publish the catalogue. One page, per category, naming the preferred supplier, the account to use and the headline terms. Put it where people buy, not in a policy folder. That kills both information-based causes.
Consolidate duplicate accounts. Where several entities hold accounts with one supplier, merge or link them for volume purposes. One phone call per supplier.
Set a threshold and make the compliant path faster below it: buy from the catalogue with no approval below, request first above. Speed below the line buys compliance above it.
Build one genuine emergency path. A named card, a stated ceiling, and a rule that emergency purchases are reported the same day rather than approved in advance. If you do not design it, people improvise and you never hear about it.
Review the top thirty vendors quarterly. Fifteen minutes, looking for new names with real volume, which is where next year's agreements come from.
Four of those five reduce friction rather than adding it. Controls that add friction without a faster compliant path get overridden, and the ACFE's Occupational Fraud 2024 research found over half of frauds in its 1,921 cases traced to controls that were weak or overridden. A control everyone works around protects nobody. See internal controls for a small business.
Do not respond to maverick spend by requiring approval for everything. Universal approval slows every purchase, buries the approver in low-value decisions, and teaches capable people to find workarounds for purchases that were never risky. You get the same leakage plus a bottleneck.
Do not name individuals either. If your best site manager buys off-contract, the likely explanation is that they were keeping a promise to a customer and the contracted path could not help them.
Both will tell you what you spent and with whom inside one entity, and neither knows what you negotiated.
Ask a ledger three questions and the boundary shows itself.
What did we spend with this vendor? Answered in a minute if books are current and coding consistent: vendor totals, spend by category, transaction detail, all in one file. Was that purchase on contract? Unanswerable: there is no price-agreement layer and no preferred-supplier flag, so nothing in the ledger marks a purchase as off-contract. What did the group spend with this vendor? Also unanswerable: vendor totals stop at the entity boundary, so the group view that reveals the leak means exporting every file and combining them. That manual step is why the review happens yearly instead of quarterly.
Neither tool is at fault: spotting maverick spend requires knowing your agreements, and your agreements are not in your ledger. If spend also feeds your cash planning, the 13-week cash flow forecast is the next step.
Run the spend-by-vendor report across all entities, write the one-page catalogue for your top ten categories, and consolidate duplicate supplier accounts. It is a week of work spread across a month, and usually recovers more margin than a pricing exercise.
If your books are not current or consistent enough across entities to produce that report honestly, that is the part cruisr works on: current ledgers, a fast close and group-level consolidation on top of QuickBooks Online or Xero. Talk to us.
An internal controls small business checklist built for lean teams: seven controls that survive a two-person finance function, and where to start first.
How to build a 13 week cash flow forecast with the direct method, from opening cash and receipts through disbursements, the weekly roll and a group roll-up.
A decision framework for corporate cards vs reimbursements vs centralized AP in a group of companies, and what each one costs you at the close.
Free, on your own QuickBooks or Xero, delivered in a 30-minute readout.
No obligation · No migration · Nothing installed · No credit card required